+---------------------------------------------------------------------+
| LinuxSecurity.com Weekly Newsletter |
| November 8th, 2004 Volume 5, Number 44n |
| |
| Editorial Team: Dave Wreski dave@private |
| Benjamin D. Thomas ben@private |
+---------------------------------------------------------------------+
Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.
This week, advisories were released for "Installing and securing VoIP with
Linux," "Securing Source Code Should Be a Priority," and "Keep an Eye on
Your Linux Systems with Netstat."
----
>> The Perfect Productivity Tools <<
WebMail, Groupware and LDAP Integration provide organizations with the
ability to securely access corporate email from any computer, collaborate
with co-workers and set-up comprehensive addressbooks to consistently keep
employees organized and connected.
http://ads.linuxsecurity.com/cgi-bin/newad_redirect.pl?id=gdn05
----
LINUX ADVISORY WATCH:
This week, advisories were released for rsync, squid, subversion, gaim,
apache, postgresql, mpg123, abiword, iptables, xpdf, libxml, lvm10, hdcp,
ppp, Apache, speedtouch, proxytunnel, shadow, mysql, netalk, mod_ssl, and
libtiff. The distributors include Conectiva, Debian, Fedora, Gentoo,
Mandrake, Openwall, Slackware, and Trustix.
http://www.linuxsecurity.com/articles/forums_article-10206.html
-----
Mass deploying Osiris
Osiris is a centralized file-integrity program that uses a client/server
architecture to check for changes on a system. A central server maintains
the file-integrity database and configuration for a client and at a
specified time, sends the configuration file over to the client, runs a
scan and sends the results back to the server to compare any changes.
Those changes are then sent via email, if configured, to a system admin or
group of people. The communication is all done over an encrypted
communication channel.
http://www.linuxsecurity.com/feature_stories/feature_story-175.html
------
>> The Perfect Productivity Tools <<
WebMail, Groupware and LDAP Integration provide organizations with
the ability to securely access corporate email from any computer,
collaborate with co-workers and set-up comprehensive addressbooks to
consistently keep employees organized and connected.
http://ads.linuxsecurity.com/cgi-bin/newad_redirect.pl?id=gdn05
--> Take advantage of the LinuxSecurity.com Quick Reference Card!
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf
+---------------------+
| Host Security News: | <<-----[ Articles This Week ]----------
+---------------------+
* Installing and securing VoIP with Linux
November 7th, 2004
Successful businesses usually have the same goal, minimize costs to
maximize profits. Today with the plethora of open source solutions, a
small business can present a high tech image and still keep a lid on the
expenses. Early last winter, we had the opportunity to present a proposal
for a financial institution to add two new remote offices.
http://www.linuxsecurity.com/articles/documentation_article-10215.html
* TCP/IP checksum vectorization using AltiVec, Part 1
November 6th, 2004
This two-part article demonstrates the kinds of performance gains AltiVec
can produce on the TCP/IP checksum, or on code similar to it. It gives
special attention both to instructions that help improve performance, and
to general unrolling and scheduling techniques. The net result?
Performance increased by a factor of four.
http://www.linuxsecurity.com/articles/documentation_article-10214.html
* SSH User Identities
November 4th, 2004
OpenSSH supports more than just simple passwords for authentication. It
can be configured to use PAM (Pluggable authentication modules),
Challenge/Response protocols, Kerberos authentication, authenticated
host-based trust[1], and there are even patches for other methods, such as
X509 keys. However the most popular alternate authentication method is
Identity/Pubkey authentication.
http://www.linuxsecurity.com/articles/documentation_article-10189.html
* Securing Source Code Should Be a Priority
November 4th, 2004
The efforts of the "Source Code Club" to sell the source code to Cisco
firewalls may be despicable, but they may also be a blessing in disguise.
By making a public show of Cisco's inability to keep its secrets to
itself, these desperados may actually be doing us all a big favor.
http://www.linuxsecurity.com/articles/privacy_article-10200.html
* Keep an Eye on Your Linux Systems with Netstat
November 3rd, 2004
Two of the fundamental aspects of Linux system security and
troubleshooting are knowing what services are running, and what
connections and services are available. We're all familiar with ps for
viewing active services. netstat goes a couple of steps further, and
displays all available connections, services, and their status. It shows
one type of service that ps does not: services run from inetd or xinetd,
because inetd/xinetd start them up on demand.
http://www.linuxsecurity.com/articles/documentation_article-10185.html
+------------------------+
| Network Security News: |
+------------------------+
* Alleged DDoS kingpin joins most wanted list
November 6th, 2004
The fugitive Massachusetts businessman charged in the first criminal case
to arise from an alleged DDoS-for-hire scheme has appeared on an FBI most
wanted list, while the five men accused of carrying out his will are
headed for federal court.
http://www.linuxsecurity.com/articles/general_article-10211.html
* Crack Program Released for Wireless Nets
November 6th, 2004
One year after a vulnerability in the Wi-Fi Protected Access encryption
algorithm was reported, a proof-of-concept program for the attack has been
released.
http://www.linuxsecurity.com/articles/network_security_article-10213.html
* Recovering From an Attack
November 6th, 2004
No matter the size of your network, sooner or later you'll have to clean
up an infected machine. Recovery from an attack can be daunting, but
following some simple steps will make it less painful.
http://www.linuxsecurity.com/articles/intrusion_detection_article-10209.html
* Sourcefire - the open source answer to network security
November 4th, 2004
In the past couple of years, technologies such as intrusion detection and
protection systems have become mainstream tools in the corporate security
arsenal. But many feel less than satisfied with the performance of some of
these technologies.
http://www.linuxsecurity.com/articles/network_security_article-10193.html
+------------------------+
| General Security News: |
+------------------------+
* Linux in Government: Stanislaus County Does Linux with a Best
Practices Slant
November 6th, 2004
If you call the Stanislaus County administrative offices and ask for
Richard Robinson, be sure to specify that you want to speak with the
director of strategic business technology. If not, you most likely will
get the county's CEO, who has the same name.
http://www.linuxsecurity.com/articles/government_article-10212.html
* Experts Debunk Linux Security Criticisms
November 6th, 2004
Some Linux experts are questioning a report by British-based mi2g, which
calls Linux the "most breached" computing environment worldwide, with
Microsoft Windows placing a distant second. The London-based security firm
said its study analyzed more than 235,000 successful attacks against
"permanently connected -- 24/7 online--computers" worldwide between
November 2003 and October 2004.
http://www.linuxsecurity.com/articles/forums_article-10210.html
* The Cost of Security Training
November 5th, 2004
It has been said before that the cost of IT training for those of us in
the computer security industry is really quite high. After all, there is
not only the cost of the course itself, but also the associated costs of
hotels, food, and rental vehicles if the course is out of town.
http://www.linuxsecurity.com/articles/forums_article-10201.html
* The Rise of Security Threats
November 1st, 2004
Disgruntled or former employees pose a threat to any business and can gain
access to internal systems relatively easily. Confidential company
information can be used maliciously by employees either hacking into
servers and files or by utilizing hacking tools readily available via the
Internet and with a higher concentration of computer literate workers
these risks are even more significant.
http://www.linuxsecurity.com/articles/network_security_article-10156.html
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email newsletter-request@private
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
_________________________________________
Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/
This archive was generated by hypermail 2.1.3 : Tue Nov 09 2004 - 05:02:22 PST