rying Fedora Core 1

Today I installed Fedora Core Release 1 in a VMWare session on my laptop. I was unable to using the CD-ROMs I burned and got the same error as described in this thread. I ended up installing the OS using the three .iso files on my laptop hard drive. I installed a default desktop into a 4 GB partition. Here are the daemons listening, the filesystem stats, and the uname output:

[root@localhost root]#netstat -natup

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address   Foreign Address  State      PID/Program name

tcp        0      0 0.0.0.0:1026    0.0.0.0:*        LISTEN     1665/rpc.statd

tcp        0      0 127.0.0.1:1027  0.0.0.0:*        LISTEN     1830/xinetd

tcp        0      0 0.0.0.0:111     0.0.0.0:*        LISTEN     1645/portmap

tcp        0      0 0.0.0.0:22      0.0.0.0:*        LISTEN     1814/sshd

tcp        0      0 127.0.0.1:631   0.0.0.0:*        LISTEN     1777/cupsd

tcp        0      0 127.0.0.1:25    0.0.0.0:*        LISTEN     1851/sendmail: acce

tcp        1      0 127.0.0.1:1034  127.0.0.1:631    CLOSE_WAIT 2103/eggcups

udp        0      0 0.0.0.0:1024    0.0.0.0:*                   1665/rpc.statd

udp        0      0 0.0.0.0:993     0.0.0.0:*                   1665/rpc.statd

udp        0      0 0.0.0.0:111     0.0.0.0:*                   1645/portmap

udp        0      0 0.0.0.0:631     0.0.0.0:*                   1777/cupsd

[root@localhost root]#df -h

Filesystem            Size  Used Avail Use% Mounted on

/dev/sda2             3.6G  1.9G  1.6G  54% /

/dev/sda1              99M  6.3M   88M   7% /boot

none                   62M     0   62M   0% /dev/shm

[root@localhost root]#uname -a

Linux localhost.localdomain 2.4.22-1.2115.nptl #1

 Wed Oct 29 15:42:51 EST 2003 i686 i686 i386 GNU/Linux

The coolest thing in my opinion was trying the yum (Yellow dog Updater, Modified) program. When fedora.redhat.com was down this afternoon I followed these instructions to add a backup source for yum. I then used yum to add nmap. It worked like a charm:

[root@localhost root]# yum install nmap

Gathering header information file(s) from server(s)

Server: Fedora Core 1 - i386 - Base

Server: Fedora Core 1 -- Fedora US mirror

Server: Fedroa Linux (stable) for Fedora Core 1 -- Fedora US mirror

Server: Fedora Core 1 updates -- Fedora US mirror

Server: Fedora Core 1 - i386 - Released Updates

Finding updated packages

Downloading needed headers

Resolving dependencies

Dependencies resolved

I will do the following:

[install: nmap 2:3.48-1.i386]

Is this ok [y/N]: y

Getting nmap-3.48-1.i386.rpm

nmap-3.48-1.i386.rpm      100% |=========================| 368 kB    00:02

Running test transaction:

Test transaction complete, Success!

nmap 100 % done 1/1

Installed:  nmap 2:3.48-1.i386

Transaction(s) Complete

Unfortunately, since no package of ettercap was available, I couldn't try adding it. I then gave up2date a try. I used it too update packages on the system.

[root@localhost root]# up2date-nox -u

Fetching package list for channel: fedora-core-1...

Fetching http://fedora.redhat.com/releases/fedora-core-1/headers/header.info...

########################################

Fetching package list for channel: updates-released...

Fetching http://fedora.redhat.com/updates/released/fedora-core-1/headers/header.info...

########################################

Fetching Obsoletes list for channel: fedora-core-1...

Fetching Obsoletes list for channel: updates-released...

Fetching rpm headers...

########################################

Name                                    Version        Rel

----------------------------------------------------------

glibc                                   2.3.2          101.1               i686

glibc-common                            2.3.2          101.1               i386

nscd                                    2.3.2          101.1               i386

Testing package set / solving RPM inter-dependencies...

########################################

glibc-2.3.2-101.1.i686.rpm: ########################## Done.

glibc-common-2.3.2-101.1.i3 ########################## Done.

nscd-2.3.2-101.1.i386.rpm:  ########################## Done.

Preparing              ########################################### [100%]

Installing...

   1:glibc-common           ########################################### [100%]

   2:glibc                  ########################################### [100%]

Stopping sshd:[  OK  ]

Starting sshd:[  OK  ]

   3:nscd                   ########################################### [100%]

[root@localhost root]#

up2date worked well too. I think I could like this distro.

I got an email from Red Hat explaining the new status of their products. From the email:

"Get Enterprise Linux in three ways:

--> Enterprise Linux WS: for desktop/client systems.
Starting at $179
--> Enterprise Linux ES: for small/mid-range servers.
Starting at $349
--> Enterprise Linux AS: for high-end and mission-critical systems.
Starting at $1499

>>compare all three:

http://info.redhat.com/a/tA-s$LDAJPSNNAOmLYvAK7ybs-q/utbn2"

Wow, those prices are amazing! I'll be interested to see who adopts this product.

Read More

Let Freedom Ring...Not

The so-called "hacker" who "defaced" aljazeera.net was sentenced yesterday to 1000 hours of community service and a $2000 fine, according to stories by aljazeera.net and Reuters.

The intruder, a "Web designer," "posed as an Al Jazeera employee." presumably to Verisign, the registry for the .net domain.

This far more informative article has technical details on the "hack." Apparently the perpetrator convinced Verisign to change its listing for aljazeera.net's domain servers to a system controlled by the intruder.

The DoJ reports the perp also "re-routed all e-mail traffic to an account he had created on MSN Hotmail using the name of the Al Jazeera systems administrator."

Aljazeera.net was also hit by denial of service attacks during the second Gulf War.

Read More

Stephen Northcutt Hints at New 2004 SANS Courses

I received an email from Stephen Northcutt discussing various SANS initiatives. I found the last paragraph interesting. As this was a mass-mailing I'd like to share what he said:

"We do have other tracks in development if the writers and researchers stay on track in the second half of 04 we hope to complete a track on content and email security and a six day legal track designed primarily for attorneys. We have an advanced windows operations and advanced windows audit track in the works. On the unix side of the house we are
working on a Linux, Apache, MySQL, and Perl course designed to help you field and maintain a secure working Internet ecommerce presence. Finally, we have started development on Oracle security. Creating a six day track is a huge amount of work, if you are an expert in any of these topics, there may be a spot for you on the development team. If you think you might be interested, drop me a line, Stephen@sans.org.

Warm Regards,
Stephen Northcutt"

SANS already has 12 tracks and it's good to see they are considering others.

Read More

While reading this OSNews thread on FreeBSD, I learned of the portsman tool. It's a curses-based front end to the FreeBSD ports tree. It offers similar functionality to portupgrade but through a menu system. I found it interesting that it was hosted at berlios and not at SourceForge like most open source projects.

One adjustment I made to use portsman was to change the default TERM value from 'xterm' to 'xterm-color' so I could see the menu better in an SSH session using root's default csh (actually tcsh) shell. Just edit the .cshrc value in root's home directory and then execute 'source .cshrc' to change the variable. To only change the TERM variable for the session, execute

setenv TERM xterm-color

It's different for sh or bash. There, run

TERM=xterm-color
export TERM

Read More

21st Century Pilotless Airwolf Stolen

OK, it's obviously not Airwolf. According to this Israeli newspaper the Steadicopter was recently stolen a few days after the completion of its test program and final test flights. According to the article:

"Steadicopter CEO Tuvia Scgl told 'Globes' today that he had no doubt that industrial espionage was behind the theft. "We're convinced that the thief was working for our competitors, because he went directly to the helicopter's location, and broke only the guardrails to that room.

'The helicopter is unique. No other company in the world has succeeded in operating such a flying machine, capable of independent flying without remote control. Many companies have tried, but none of their tests worked.'"

Read More

Criminals Extort Companies With DoS Attacks

I learned at Slashdot of an article at Financial Times about criminals extorting companies by subjecting them to denial of service attacks. From the article:

"More than a dozen offshore gambling sites serving the US market were hit by the so-called Distributed Denial of Service attacks and extortion demands in September and the tactic is now spreading. Sites have been asked to pay up to $50,000 to ensure they are free from attacks for a year. Police are urging any victims not to give in to blackmail and report the crime."

This is a lot easier than breaking into a victim and extorting them for theft of credit cards or intellectual property. Just have your home users and university machines blast away at a victim and collect the cash.

Read More

New Sguil 0.3.0 Install Doc for FreeBSD 4.9 REL

I just published a new installation guide for Sguil 0.3.0. Sguil is an interface to Snort which operates using Network Security Monitoring principles. This means it is dedicated to answering the "now what?" question that faces analysts who receive IDS alerts. Sguil provides alert, session, and full content data with a minimum of mouse clicks, window changes, and keystrokes.

Users not familiar with FreeBSD should have no problems following the instructions. I provide dozens of screen shots and step-by-step comments to get the OS and all needed applications installed.

The document is available in .pdf form here (.pdf).

The new guide uses FreeBSD 4.9 RELEASE as the server platform and Windows 2000 or XP as the analyst workstation.

Please send comments on the guide to sguil at taosecurity dot com. I plan to incorporate as many suggestions for improvement as humanly possible.

Update:I'm collaborating with Soup4You2 from BSDHound on an expanded document.

Read More