Re: ipsec setkey and 2.4.21 kernel

2003-10-14 Thread Mark Devin
Mark Devin wrote: Mark Devin wrote: Mark Devin wrote: I have been running a custom compiled 2.4.21 kernel using the kernel source package from Adrian Bunk's site on Woody. I had an ipsec link setup and it was working well using the Kame implementation which debian has backported int

Re: ipsec setkey and 2.4.21 kernel

2003-10-14 Thread Mark Devin
Mark Devin wrote: Mark Devin wrote: Mark Devin wrote: I have been running a custom compiled 2.4.21 kernel using the kernel source package from Adrian Bunk's site on Woody. I had an ipsec link setup and it was working well using the Kame implementation which debian has backported int

Re: ipsec setkey and 2.4.21 kernel

2003-10-03 Thread Mark Devin
Mark Devin wrote: Mark Devin wrote: I have been running a custom compiled 2.4.21 kernel using the kernel source package from Adrian Bunk's site on Woody. I had an ipsec link setup and it was working well using the Kame implementation which debian has backported into the 2.4.21 k

Re: ipsec setkey and 2.4.21 kernel

2003-10-03 Thread Mark Devin
Mark Devin wrote: Mark Devin wrote: I have been running a custom compiled 2.4.21 kernel using the kernel source package from Adrian Bunk's site on Woody. I had an ipsec link setup and it was working well using the Kame implementation which debian has backported into the 2.4.21 kernel so

Re: ipsec setkey and 2.4.21 kernel

2003-10-02 Thread Mark Devin
Mark Devin wrote: I have been running a custom compiled 2.4.21 kernel using the kernel source package from Adrian Bunk's site on Woody. I had an ipsec link setup and it was working well using the Kame implementation which debian has backported into the 2.4.21 kernel sources. I

ipsec setkey and 2.4.21 kernel

2003-10-02 Thread Mark Devin
I have been running a custom compiled 2.4.21 kernel using the kernel source package from Adrian Bunk's site on Woody. I had an ipsec link setup and it was working well using the Kame implementation which debian has backported into the 2.4.21 kernel sources. I just recompiled my kernel today w

Re: ipsec setkey and 2.4.21 kernel

2003-10-02 Thread Mark Devin
Mark Devin wrote: I have been running a custom compiled 2.4.21 kernel using the kernel source package from Adrian Bunk's site on Woody. I had an ipsec link setup and it was working well using the Kame implementation which debian has backported into the 2.4.21 kernel sources. I just recom

ipsec setkey and 2.4.21 kernel

2003-10-02 Thread Mark Devin
I have been running a custom compiled 2.4.21 kernel using the kernel source package from Adrian Bunk's site on Woody. I had an ipsec link setup and it was working well using the Kame implementation which debian has backported into the 2.4.21 kernel sources. I just recompiled my kernel today wi

Re: Someone scanned my ssh daemon

2003-06-17 Thread Mark Devin
On Mon, 2003-06-16 at 23:32, Tomasz Papszun wrote: > On Mon, 16 Jun 2003 at 14:26:33 +0200, Stefan Neufeind wrote: > > On 16 Jun 2003 at 7:00, Halil Demirezen wrote: > > > > > To be brief, I don't usually come accross that there is an exploit for > > > only effective to debian boxes. Plus, There a

Re: Someone scanned my ssh daemon

2003-06-17 Thread Mark Devin
On Mon, 2003-06-16 at 23:32, Tomasz Papszun wrote: > On Mon, 16 Jun 2003 at 14:26:33 +0200, Stefan Neufeind wrote: > > On 16 Jun 2003 at 7:00, Halil Demirezen wrote: > > > > > To be brief, I don't usually come accross that there is an exploit for > > > only effective to debian boxes. Plus, There a

Re: Someone scanned my ssh daemon

2003-06-15 Thread Mark Devin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mark Devin wrote: | It looks as though someone is trying to crack my box through ssh. OK, now I realise that it is an ssh scanner. See: http://www.monkey.org/~provos/scanssh/ Why is it that the Debian version of sshd gives out any information about

Someone scanned my ssh daemon

2003-06-15 Thread Mark Devin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 It looks as though someone is trying to crack my box through ssh. This is what logcheck emailed me: - -- snip -- Jun 16 04:36:02 jack sshd[20026]: Connection from 212.202.204.149 port 2323 Jun 16 04:36:03 jack sshd[20027]: Connection from 212.202.204

Re: Someone scanned my ssh daemon

2003-06-15 Thread Mark Devin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mark Devin wrote: | It looks as though someone is trying to crack my box through ssh. OK, now I realise that it is an ssh scanner. See: http://www.monkey.org/~provos/scanssh/ Why is it that the Debian version of sshd gives out any information about its

Someone scanned my ssh daemon

2003-06-15 Thread Mark Devin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 It looks as though someone is trying to crack my box through ssh. This is what logcheck emailed me: - -- snip -- Jun 16 04:36:02 jack sshd[20026]: Connection from 212.202.204.149 port 2323 Jun 16 04:36:03 jack sshd[20027]: Connection from 212.202.204.1

grsecurity vs lsm vs lids

2003-06-11 Thread Mark Devin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OK, I have been seeing lots of people on this list recommend using the grsecurity kernel patch. Now I want to give it a go, but I see that there is also a lsm patch and I also remember lids being recommended in the past by others. I would like to le

grsecurity vs lsm vs lids

2003-06-11 Thread Mark Devin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OK, I have been seeing lots of people on this list recommend using the grsecurity kernel patch. Now I want to give it a go, but I see that there is also a lsm patch and I also remember lids being recommended in the past by others. I would like to learn

Re: chkrootkit and LKM

2003-06-01 Thread Mark Devin
On Mon, 2003-05-26 at 23:27, IC0N wrote: > > Checking `lkm'... You have 1 process hidden for readdir command > You have 1 process hidden for ps command > Warning: Possible LKM Trojan installed > > Sometimes I get 2 or 3 processes, sometimes NONE > If a process is created between the output of ps

Re: chkrootkit and LKM

2003-06-01 Thread Mark Devin
On Mon, 2003-05-26 at 23:27, IC0N wrote: > > Checking `lkm'... You have 1 process hidden for readdir command > You have 1 process hidden for ps command > Warning: Possible LKM Trojan installed > > Sometimes I get 2 or 3 processes, sometimes NONE > If a process is created between the output of ps

Remotely monitoring security

2003-05-17 Thread Mark Devin
I need to come up with some solutions for remotely monitoring the security of a server which is off-site. There is no direct connection from the main office to this box except using the internet backbone. I see two immediate issues: 1. I need to setup some method for receiving system logs from