Baslinux mailing list

[baslinux AT lists.ibiblio.org]

dropbear works perfectly in BL3 after you have added password for root, 
and user with password, using Steven's package.

It did not work in BL2 after I added a password (with busybox passwd?)
because shadow still listed passwords as blank and dropbear checked shadow 
not passwd and told me I have blank passwords.  I deleted shadow.  There 
is probably a Slackware program I could use to modify shadow, which I am 
told is more secure than passwd.

So my dropbear package should be usable (glibc2 dynamic, or uclibc static) 
with BL3, or if you delete shadow, with BL2.

A kind person at the dropbear list said to read:

http://tldp.org/HWOTO/Security-Quickstate-HOWTO/intro.html
which is very large and includes secions on netstat, nmap, ipchains, 
intrusion detection (rootkits) and firewalls.

There are prepackaged rootkits that modify common binaries or use kernel 
modules.  ls won't show the modified files.   If common commands act oddly 
you should be suspicious.  I think a rootkit would have some trouble 
modifying the busybox ls top ps find who w last login netstat.

Tipoffs are files names r00t... or ".. ", mysterious processes, or 
immutable files.

To detect immutable files you need lsattr (e2fsprogs):

/usr/bin/lsattr  `echo $PATH | tr ':' ' '`| grep i--

This should detect immutable files on root's path.

I got as output

lsattr:  'No such file or directory While reading flags on /sbin/bdflush
and several other such lines for files in /sbin/
         fsck.hpfs fsck.msdos fsck.umsdos sln

I then did:

lsattr /sbin/fsck*
------------------ fsck         Does this mean my linux files are okay?
------------------ fsck.ext2
lsattr:  No such.... fsck.hpfs  (etc. for msdos umsdos)

Maybe it means I don't have any hpfs or dos files on the path?

This is a much simpler procedure than compiling and running chkrootkit.

Also look for strange files in /tmp.

'Reexamine your system for unnecessary services'.  Do we have any?

/etc/services lists a bunch of services/servers.

X is a server and listens on port 6000.  In theory someone could crack 
your computer this way.  Opera had some security bugs.

X11 TCP port is low to moderate risk.  (What is this?).

ftp servers are very high risk.  tftp even worse.  Okay on LAN.
(pure-ftpd, asmutils ftpd). 
Are ftpput and ftpget okay to use?  They are clients not servers.

Use scp or sftp when connected to the internet instead.
(I compiled and posted scp with dbclient and dropbear).
You probably need to run dropbear at one end and scp at the other.

telnet server (inet.d in BL2) should be avoided except for local use.
Do not allow root logins.

ssh is low to moderate risk (dropbear server, dbclient = ssh equiv).
Windows can use PuTTY ssh client.

http is low risk  (busybox httpd, mini-httpd).  Safe way to transfer files 
between two linux computers, but Win98 does not have httpd.

sunrpc used by NFS and NIS is high risk and a favorite crack target.

Instead of the sunrpc/ipchains firewall method, use ssh to share a modem 
connection (uses programs on the server not the client).  scp for file 
transfer instead of nfs.

Steven, can you explain how to use X this way with the client as X 
terminal?  What is ssh X11Forwarding?   X11 TCP uses 6000-6009.

netstat shows what servers are running, in my case tcp (and if I start X, 
several lines of that).

Probably BL would not get cracked anyway because it uses busybox.
(I have played with various servers while online and nothing bad seems to 
have happened).

Sindi

keesan AT sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org