Re: Anti-Rootkit app

2008-01-14 Thread Rob Gallagher
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Jordi, On 13/01/2008, Jordi Espasa Clofent wrote: Hi all, I need to install an anti-rootkid in a lot of servers. I know that there're several options: tripwire, aide, chkrootkit... ¿What do you prefer? Obviously, I have to define my

Added native socks support to libc in FreeBSD 7

2008-01-14 Thread Raffaele De Lorenzo
Upgrade: 1) Added IPv6 Support (need to be tested) Cheers Raffaele Hi, i added a native (client) Socks V4/V5 support inside FreeBSD libc library. The work is based of my project (see http://csocks.altervista.org) CSOCKS. You can get it here:

Re: Anti-Rootkit app

2008-01-14 Thread Miroslav Lachman
Jordi Espasa Clofent wrote: Hi all, I need to install an anti-rootkid in a lot of servers. I know that there're several options: tripwire, aide, chkrootkit... ¿What do you prefer? Obviously, I have to define my needs: - easy setup and configuration - actively developed I am using

Re: Anti-Rootkit app

2008-01-14 Thread Klaus Steden
Hi Dan, Good security is usually a comprehensive strategy, rather than hoping for a one-size-fits-all-magic-bullet solution. Combine a coherent packet filter with strong passwords, a competent IDS, BSD securelevels, and a file system integrity checker, and you've got a pretty solid strategy for

FreeBSD Security Advisory FreeBSD-SA-08:01.pty

2008-01-14 Thread FreeBSD Security Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 = FreeBSD-SA-08:01.ptySecurity Advisory The FreeBSD Project Topic:

FreeBSD Security Advisory FreeBSD-SA-08:02.libc

2008-01-14 Thread FreeBSD Security Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 = FreeBSD-SA-08:02.libc Security Advisory The FreeBSD Project Topic:

Re: Anti-Rootkit app

2008-01-14 Thread Jan Münther
Tim Clewlow schrieb: One solution would be to have /var/log/auth.log being tailed out via a serial port to another computer that is not accessable via a network - or have it sent to a printer for a permanent hard-copy. It all depends on how much you really want to do in regard to security.

Re: Anti-Rootkit app

2008-01-14 Thread Tim Clewlow
--- Dan Lukes [EMAIL PROTECTED] wrote: I need to install an anti-rootkid If I understand correctly, an intruder need to be superuser to be able to install a rootkit. If our intruders has superuser privileges, they can tamper any anti-rootkit. Is the main reason

Re: FreeBSD Security Advisory FreeBSD-SA-08:02.libc

2008-01-14 Thread Mike Tancsa
At 06:09 PM 1/14/2008, FreeBSD Security Advisories wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 = FreeBSD-SA-08:02.libc Security Advisory

Re: FreeBSD Security Advisory FreeBSD-SA-08:02.libc

2008-01-14 Thread Mike Tancsa
At 12:22 AM 1/15/2008, Mark Andrews wrote: For the usual suspects of applications running, (e.g. sendmail, apache, BIND etc) would it be possible to pass crafted packets through to this function remotely via those apps ? ie how easy is this to do ? The usual suspects don't call

Re: FreeBSD Security Advisory FreeBSD-SA-08:02.libc

2008-01-14 Thread Mark Andrews
At 06:09 PM 1/14/2008, FreeBSD Security Advisories wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 = FreeBSD-SA-08:02.libc Security Advisor y

Re: FreeBSD Security Advisory FreeBSD-SA-08:02.libc

2008-01-14 Thread Garrett Wollman
On Mon, 14 Jan 2008 23:28:46 -0500, Mike Tancsa [EMAIL PROTECTED] said: For the usual suspects of applications running, (e.g. sendmail, apache, BIND etc) would it be possible to pass crafted packets through to this function remotely via those apps ? ie how easy is this to do ?

Re: FreeBSD Security Advisory FreeBSD-SA-08:02.libc

2008-01-14 Thread Gregory Shapiro
Topic: inet_network() buffer overflow For the usual suspects of applications running, (e.g. sendmail, apache, BIND etc) would it be possible to pass crafted packets through to this function remotely via those apps ? ie how easy is this to do ? Speaking solely for sendmail, this