[ISN] Linux Security Week - June 10th 2002

From: InfoSec News (isnat_private)
Date: Tue Jun 11 2002 - 01:23:46 PDT

  • Next message: InfoSec News: "[ISN] [infowarrior] - Comments on the ADTI report released today"

    |  LinuxSecurity.com                            Weekly Newsletter     |
    |  June 10th, 2002                              Volume 3, Number 23n  |
    |                                                                     |
    |  Editorial Team:  Dave Wreski             daveat_private    |
    |                   Benjamin Thomas         benat_private     |
    Thank you for reading the LinuxSecurity.com weekly security newsletter.
    The purpose of this document is to provide our readers with a quick
    summary of each week's most relevant Linux security headlines.
    This week, perhaps the most interesting articles include "Enhancing E-Mail
    Security With Procmail," "Monitoring Linux firewalls with firelogd,"
    "Anti-virus/anti-spam mail server setup using MailScanner," and "Privacy
    vs. Security: A Bogus Debate?"
    FEATURE: Introduction to Nessus, a Vulnerability Scanner
    Nessus is a vulnerability scanner which performs scanning a target network
    to seek for vulnerabilities in the network, such as, software bugs,
    backdoors, and etc. The program is developed by Renaud Deraison.
    ** EnGarde Secure Linux walks away with Network Computing Editor's 
       Choice Award, Beats HP,Immunix... **
    "EnGarde walked away with our Editor's Choice award thanks to the depth of
    its security strategy, which covers nearly all the bases. Everything from
    the low-level mechanisms (binary integrity checking and stack protection)
    to high-level usability issues (including an excellent patching interface)
    demonstrate the serious effort the Guardian Digital crew has invested in
    This week, advisories were released for tcpdump, uucp, ethereal, dhcp,
    bind, mailman, Conectiva's kernel, imap, nss_ldap, ghostscript, and xchat.  
    The vendors include Caldera, Conecitva, Debian, EnGarde, Mandrake, Red
    Hat, SuSE, Trustix, and Yellow Dog.
    Find technical and managerial positions available worldwide.  Visit the
    LinuxSecurity.com Career Center: http://careers.linuxsecurity.com
    | Host Security News: | <<-----[ Articles This Week ]-------------
    * Security on a Shoestring
    June 8th, 2002
    Like lots of network administrators, Gerald Posey would love to install
    commercial firewalls, IDSes and vulnerability assessment tools on his
    system. But he can't. His law enforcement agency in Louisiana lacks the
    money and manpower to guard an entire network, so instead he looks for
    less expensive options--free ones, actually.
    * Anti-virus/anti-spam mail server setup using MailScanner
    June 6th, 2002
    Wouldn't it be great to have the ability to stop email-borne virus
    traffic, arguably the most ubiquitous kind, at the server level where you
    control the action? If this idea appeals to you, read on.
    * Enhancing E-Mail Security With Procmail
    June 5th, 2002
    Welcome to the home page of the Procmail Email Sanitizer. The Sanitizer is
    a tool for preventing attacks on your computer's security via email
    messages. It has proven to be very effective against the latest crop of
    Microsoft email worms that have gotten so much attention in the popular
    * Aide 0.9 Released
    June 4th, 2002
    The most common type of hacker simulation is a remote scan of a company's
    network, which gives the target company an idea of what its networks look
    like to a hacker on the Internet. The cost of worldwide intellectual
    property theft, much of which occurs as a result of corporate espionage
    conducted through the Internet, may be as high as US$300 billion per year,
    according to industry watchers.
    * Writing PAM Modules, Part Three
    June 3rd, 2002
    PAM stands for Pluggable Authentication Modules and is a system for
    providing application independence for authentication. A PAM-enabled
    application calls a stack of PAM modules to run authentication, open and
    close sessions, and check account validity.
    | Network Security News: |
    * Monitoring Linux firewalls with firelogd
    June 7th, 2002
    Monitoring firewalls on a Linux system can be a challenge because of the
    text-based nature of the OS. The firelogd program can greatly improve the
    monitoring process by e-mailing concise summaries of important entries to
    an admin.
    * IDS at the Crossroads
    June 7th, 2002
    Four infosec innovators size up new threats and how IDSes are evolving to
    meet them. Gleichauf, Klaus, Ranum and Roesch are interviewed in this
    article. Intrusion detection is on the minds of many folks. How are
    threats evolving today?
    * The Scanner Tarpit HOWTO
    June 6th, 2002
    How to configure a Linux firewall protecting a publicly-accessible
    (boundary, DMZ) network to detect worms' and attackers' scanning activity
    and react in real time to block and interfere with that scanning activity.
    A discussion of reporting tools and possible extensions is also included.
    |  Vendors/Products:     |
    * EnGarde Secure Linux walks away with Editor's Choice, Beats HP,
    June 8th, 2002
    EnGarde walked away with our Editor's Choice award thanks to the depth of
    its security strategy, which covers nearly all the bases. Everything from
    the low-level mechanisms (binary integrity checking and stack protection)
    to high-level usability issues (including an excellent patching interface)
    demonstrate the serious effort the Guardian Digital crew has invested in
    * EnGarde Secure Linux Review Wins Perfect Score
    June 6th, 2002
    Guardian Digital's Engarde Secure Linux Professional offers a lightweight,
    robust, and secure Linux Distribution for small and large networks.  This
    distribution is really great for small to large business. Ease of
    administration and added security means less man hours. The home business
    user would appreciate its completeness, ease of use, and its low cost.
    |  General:              |
    * An Idea To Can the Spam
    June 7th, 2002
    The problem is that filters do not always prevent mail from bad sources,
    and the whole "opt-in" farce has resulted in spammers sending whatever
    messages they want. Yahoo, MSN and many other free (and even paid) e-mail
    services seem to be repositories for spammers. Even when customers pony up
    dollars for better accounts, the results are often the same.
    * Is Linux Ready for National Security?
    June 5th, 2002
    The popularity of the Linux open source operating system is exploding in
    the public sector, both in the U.S. and abroad. In May, IBM Corp. alone
    announced a deal to supply the Air Force, Department of Defense (DoD),
    Department of Agriculture, Department of Energy, and Federal Aviation
    Administration (FAA) with Linux systems.
    * Privacy vs. Security: A Bogus Debate?
    June 5th, 2002
    David Brin is a privacy heretic. He doesn't agree with those in the
    intelligence and law-enforcement communities who argue that Americans have
    to surrender freedoms to make their lives safe. Nor does he agree with
    advocates who argue that it makes sense to protect privacy at all costs --
    certainly not if it means living with added insecurity.
    * June Honeynet Scan of the Month
    June 4th, 2002
    This month's challenge is to make sense of a seemingly innocuous flurry of
    UDP packets. All submissions are due no later then 22:00 GMT, Friday, 21
    June. Results will be released Friday, 28 June.
    Distributed by: Guardian Digital, Inc.                LinuxSecurity.com
         To unsubscribe email newsletter-requestat_private
             with "unsubscribe" in the subject of the message.
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Tue Jun 11 2002 - 04:13:51 PDT