Re: Security in a shell that starts ssh

2001-06-12 Thread Aaron Dewell
That would probably work, but for style I'd use 'break;' instead of 'i=100;'. You also don't need to be quite so paranoid with printf, it's generally safe unless you are printf'ing data entered by the user. If it's all your own text, they can't insert anything strange into it... Also, instead

Re: Security in a shell that starts ssh

2001-06-12 Thread Aaron Dewell
That would probably work, but for style I'd use 'break;' instead of 'i=100;'. You also don't need to be quite so paranoid with printf, it's generally safe unless you are printf'ing data entered by the user. If it's all your own text, they can't insert anything strange into it... Also, instead

Re: root fs/crypted

2001-05-30 Thread Aaron Dewell
Having a crypto install option (even if it's a little more complex to get) is still better than not having one. At this point, all one can do is encrypt a filesystem off of a non- encrypted root partition. Like removable media or something else that is mounted by hand. There are some

Re: kernel: NAT: 0 dropping untracked packet c1aa2300 1 10.20.30.132 - 62.142.131.12

2001-03-31 Thread Aaron Dewell
I assume that is on the ethernet side facing the ISP? Or that you have one ethernet card and all traffic is going there? Cable modem? (read: shared media) My bet would be that someone else is doing NAT as well, and you are seeing their packets too (probably because they are using only one

Re: Woody ssh exploit

2001-02-22 Thread Aaron Dewell
You could just recompile it yourself. I don't even use any of the Debian SSH packages anymore, they are mostly out-of-date anyway. The current SSH2 in woody is 2.0.13, for example. I just download the source and compile it myself for those kind of things. There's another good point to that:

Re: Woody ssh exploit

2001-02-22 Thread Aaron Dewell
You could just recompile it yourself. I don't even use any of the Debian SSH packages anymore, they are mostly out-of-date anyway. The current SSH2 in woody is 2.0.13, for example. I just download the source and compile it myself for those kind of things. There's another good point to that:

Re: Woody ssh exploit

2001-02-22 Thread Aaron Dewell
On Thu, 22 Feb 2001, Peter Cordes wrote: On Thu, Feb 22, 2001 at 11:10:39AM -0800, Micah Anderson wrote: We are currently running woody on a production machine (yes, I am not that happy about that decision). Woody does not get potato's security updates, and does not get new unstable

Re: who owns the ports?

2001-02-07 Thread Aaron Dewell
Well, finger is probably running through inetd... Either that or you are running that scanner detecter package that binds to every port known in the universe. Aaron On Wed, 7 Feb 2001, Matthias G. Imhof wrote: Performing strobe or nmap on my system, I get, e.g., the following list:

Re: who owns the ports?

2001-02-07 Thread Aaron Dewell
Well, finger is probably running through inetd... Either that or you are running that scanner detecter package that binds to every port known in the universe. Aaron On Wed, 7 Feb 2001, Matthias G. Imhof wrote: Performing strobe or nmap on my system, I get, e.g., the following list: 79/tcp

Re: your mail

2000-03-16 Thread Aaron Dewell
Yes, the best policy is always to disable anything on your machine that you're not using. Those you _are_ using, you then filter the crap out of. Personally, my workstation-type machines only listen on port 6000 (X), 22 (ssh), and occasionally ftp and tftp if I need them for a specific