★ wanayoo — archive 1999 http://packetstorm.securify.com/linux/security/indexdl.shtmlNouvelle recherche | Portail wanayoo
ArchivesForums
 
about usforumsassessmentdefensepapersmagazinesmiscellaneouslinkscareers


linux / security / 

To Change Sort Order, Click On A Category.
Sorted By: Downloads.

File Name Downloads File Size Last Modified
linux-2.2.14-stealth..>13797807Feb 11 12:40:37 2000
Patch for linux kernel 2.2.14 to discard packets that many OS detection tools use to query the TCP/IP stack. Includes logging of the dropped query packets. Changes: Version 4 is handled by sysctl. Note that the kernel config options are now under networking. Homepage here. By Sean Trifero
linux-2.2.16-ow1.tar..>124523329Jul 7 23:49:12 2000
The Secure-Linux patch adds a few security features to the kernel which, while not a complete method of protection, will stop most of the 'cookbook' buffer overflow exploits cold. It also adds the option of restricting the use of symlinks and named pipes in +t (temp) directories which fixes most tmp-race exploits as well. It can also add a little bit more privacy to the system by restricting access to parts of /proc to root so that users may not see who else is logged on or what they're doing. Also tightens down file descriptors 0, 1, and 2, implements process limits and shared memory destruction, and priveledged IP aliases for kernel 2.0. Changes: Now works on kernel 2.2.16! Readme available Homepage: http://www.openwall.com/linux. By Solar Designer
linux.klog.txt12087004Feb 16 14:09:35 2000
Patch for the linux kernel which may help you inexpensively deploy some packet loggers at key network ingress/egress points. Turns any Linux system into an ethernet logger that records mac address, ip address, ports and protocols with a timestamp in the system log. It can be activated and deactivated at the system console with two keystrokes. Homepage here. By DR
linux-2.2.14-stealth..>11905565Feb 10 14:19:52 2000
Patch for linux kernel 2.2.14 to discard packets that many OS detection tools use to query the TCP/IP stack. Changes: Patch3 actually works! Includes logging of the dropped query packets. Homepage here. By Sean Trifero
lsi_v1.0_RH.sh11593328Jun 1 11:38:52 2000
TSS v1.0beta1 is a shell script to check the local security of a Red Hat 6.0 / 6.1 / 6.2 machine. It checks for crontab, userhelper, shadow passwords, and the piranha account. Homepage here. By Grazer
linux-2.2.14-stealth..>115117717Mar 24 20:45:12 2000
Patch for linux kernel 2.2.14 to discard packets that many OS detection tools use to query the TCP/IP stack. Includes logging of the dropped query packets. Changes: Version 7 has added module sysctl support, and now blocks res1 and res2 packets (bogus flags). Homepage here. By Sean Trifero
stackshield0.7.tar.g..>114017317Jan 7 14:42:41 2000
Stack Shield - A "stack smashing" technique protection tool for Linux. The "stack smashing" technique is the most common way used in exploits to break the security of programs. Stack Shield is a tool for adding protection to programs from this kind of attacks at compile time whitout changing a line of code. Stack Shield uses a more secure protection system than other tool like Immunix Stack Guard. Stack Shield is designed to support the GCC under a Linux Intel 386 class platform. Homepage here. By Vendicator
lids-0.8.1pre1-psk-2..>103469307Feb 17 12:02:32 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: LIDS can be locally switched off, ability for some programs to change routes/firewall rules, and a more secure interpretation of lids.conf. Homepage here. By Xie Hua Gang
medusa-0.7.10.tar.gz983111625Feb 25 13:47:49 2000
Medusa DS9 is used to increase Linux's security. It consists of two major parts, Linux kernel changes and the user-space daemon. Kernel changes do the monitoring of syscalls, filesystem actions, and processes, and they implement the communication protocol. The security daemon communicates with the kernel using the character device to send and receive packets. Changes: New features include ptrace handling, and an improved i386 entry.S offset generator, and automake support. Documentation fixes were made, and a bug in constable was fixed. Homepage here. By Marek Zelem and Martin Ockajak
BufOverA.tar.gz952161785Apr 23 11:45:01 2000
BufOverA is a set of small Linux kernel patches which detect and block buffer overflows. The archive includes a whitepaper. Homepage here. By Massimo Bernaschi
stealth-2.2.17.diff9247725Sep 18 13:14:40 2000
Stealth IP Stack is a kernel patch for Linux 2.2.17 which makes your machine almost invisable on the network without impeding normal network operation. Many denial of service attacks, such as stream, are much less effective with this patch installed, and port scanners slow to a crawl. It works by restricting TCP RST packets (no "Connection Refused"), restricting ICMP_UNREACH on udp (Prevents UDP portscans), retricting all ICMP and IGMP requests. A sysctl interface is used so these features can be turned on ande off on the fly.  Homepage: http://www.energymech.net/madcamel/fm. By Robert Salizar
medusa-0.7.9.tar.gz91698825Feb 16 12:18:02 2000
Medusa is a package which improves overall security of Linux OS by extending standard Linux security architecture, but preserving backward compatibility. There is a small kernel patch and a user space security daemon. Kernel changes do the monitoring of syscalls, filesystem actions, and processes, and they implement the communication protocol. The security daemon communicates with the kernel using the character device to send and receive packets. Changes: file hiding, new sample config file, and many documentation fixes and updates. Homepage here. By Marek Zelem and Martin Ockajak
linux-2.2.14-stealth..>91414468Mar 1 13:26:27 2000
Patch for linux kernel 2.2.14 to discard packets that many OS detection tools use to query the TCP/IP stack. Includes logging of the dropped query packets. Changes: Module support! Homepage here. By Sean Trifero
StJude_LKM-0.03.tar...>89923086Aug 11 08:40:24 2000
Saint Jude LKM is a Linux Kernel Module for 2.2.11 and greater kernels. This module implements the Saint Jude model for improper privilege transitions. This will permit the discovery of local, and ultimately, remote root exploits during the exploit itself. Once discovered, Saint Jude will terminate the execution, preventing the root exploit from occuring. This is done without checking for attack signatures of known exploits, and thus should work for both known and unknown exploits. Changes: Support for SMP kernels, module-sealing is enabled, and a memory leak fix. By Tim Lawless
acm-1.02.tar.gz8738892Feb 22 14:31:37 2000
The Administrators Control Module (ACM) for kernel 2.2.x patches system calls like execve(), setuid(), open(), ipc(), setgid(), setreuid(), and setregid() for better security logging. By Xfer
bmap-1.0.16.tar.gz85332189Apr 12 16:05:16 2000
The Linux kernel includes a powerful, filesystem independant mechanism for mapping logical files onto the sectors they occupy on disk, which can be subverted (with bmap and friends) to perform a variety of functions interesting to the computer forensics community and the computer security community. By Daniel Ridge
lids-0.9.6a-2.2.16.t..>814100234Jun 23 17:28:34 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Fixes for capability errors, small bugfixes. Homepage: http://www.lids.org. By Xie Hua Gang
lids-0.9.7-2.2.16.ta..>80996381Jul 8 15:31:02 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Many bug fixes and code cleanups, initrd support, and acl/inode updates. Homepage: http://www.lids.org. By Xie Hua Gang
linux-2.2.14-ow2.tar..>76520899Feb 29 00:56:52 2000
The Secure-Linux patch adds a few security features to the kernel which, while not a complete method of protection, will stop most of the 'cookbook' buffer overflow exploits cold. It also adds the option of restricting the use of symlinks in +t (temp) directories which fixes most tmp-race exploits as well. It can also add a little bit more privacy to the system by restricting access to parts of /proc to root so that users may not see who else is logged on or what they're doing. Changes: Now works on kernel 2.2.14! Homepage here. By Solar Designer
linux-2.2.15-ow1.tar..>75323489May 7 15:19:35 2000
The Secure-Linux patch adds a few security features to the kernel which, while not a complete method of protection, will stop most of the 'cookbook' buffer overflow exploits cold. It also adds the option of restricting the use of symlinks and named pipes in +t (temp) directories which fixes most tmp-race exploits as well. It can also add a little bit more privacy to the system by restricting access to parts of /proc to root so that users may not see who else is logged on or what they're doing. Also tightens down file descriptors 0, 1, and 2, implements process limits and shared memory destruction, and priveledged IP aliases for kernel 2.0. Changes: Now works on kernel 2.2.15! Readme available Homepage here. By Solar Designer
lids-0.9pre1-2.2.14...>75371263Apr 1 14:01:31 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: The ability to send security alerts through network using HTTP Post, mail, or remote syslog directly from the kernel, respawning if the top LIDS process is killed, alerts are only one line, and hidden processes network connections are also hidden. Homepage here. By Xie Hua Gang
medusa-0.7.12.tar.gz750119194Aug 18 12:04:03 2000
Medusa DS9 is used to increase Linux's security. It consists of two major parts, Linux kernel changes and the user-space daemon. Kernel changes do the monitoring of syscalls, filesystem actions, and processes, and they implement the communication protocol. The security daemon communicates with the kernel using the character device to send and receive packets. Changes: Filesystem capabilities support has been added to the constable, a fix for a compilation problem when syscall tracing is disabled, new sample configuration file, and documentation changes. Homepage: http://medusa.fornax.sk. By Marek Zelem and Martin Ockajak
lids-0.9pre4-2.2.14...>74872913Apr 15 01:06:02 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Fixes an ugly bug which prevented LIDS from protecting files under the root directory of a partition in some particular cases, and lidsadm switch check fixed. Homepage here. By Xie Hua Gang
lids-0.9pre2-2.2.14...>73573586Apr 4 15:46:32 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Kernel based portscan detection, disconnects a user automatically that violates the rules, and messsage logging when user binds to a port lower than 1024. Homepage here. By Xie Hua Gang
libsafe-1.3.tgz700296807Apr 21 19:01:58 2000
The libsafe library protects a process against the exploitation of buffer overflow vulnerabilities in process stacks. Libsafe works with any existing pre-compiled executable and can be used transparently, even on a system-wide basis. It works by putting a wrapper around dangerous functions that contain any buffer overflows within the current stack frame, so that the return address can not be changed. Homepage here. By Navjot Singh
phantom_security-1.0..>690221425Mar 10 16:46:47 2000
GNU Phantom.Security is a computer-controlled security system. Using the software and a simple circuit board (schematics included) that you build, you can create a good basic security system that is computer controlled. The system can use off-the-shelf security devices like motion sensors, door magnets, and fire/smoke detectors with little to moderate modification. And if the machine the system is running on is connected to a LAN/WAN or the Internet, you can have it send e-mail. If you have a pager or cell phone capable of receiving e-mail, then you will have around the clock intrusion/fire detection for your home or office. Homepage here. By Joe Thielen
lids-0.8-2.2.14.tar...>68563260Feb 7 11:46:45 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace on your system. LIDS can also provide raw device and I/O access protection. Changes: An even better design - Use of the kernel capabilities, Hot switching capabilities, Allow unmount when shutdown (for UPS), New behaviour for interpretation of lids.conf, Buffers containing passwd are cleaned, and a 2-level encryption password. Homepage here. By Xie Hua Gang
Sysctl.sh6766357Jun 18 22:21:13 2000
Using the sysctl support in linux to enhance a system security against outside attacks. Includes a script to optimize these settings by echoing values to /proc/sys/net/ipv4/*, turning on kernel security features which lessen the effect of SYN floods, smurf attacks, and turn on source validation by reversed path to add more protection against spoofed packets. Tested on linux 2.2.x. By Spender
lids-0.8pre3-psk-2.2..>64663585Jan 25 12:15:24 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace on your system. LIDS can also provide raw device and I/O access protection. Changes: A fix for a code regression in 0.8pre2 that can oops the kernel. Homepage here. By Xie Hua Gang
StJude_LKM-0.01.tar...>64413455Jul 10 11:48:56 2000
Saint Jude LKM is a Linux Kernel Module for the 2.2.0 series of kernels. This module implements the Saint Jude model for improper privilege transitions. This will permit the discovery of local, and ultimately, remote root exploits during the exploit itself. Once discovered, Saint Jude will terminate the execution, preventing the root exploit from occuring. This is done without checking for attack signatures of known exploits, and thus should work for both known and unknown exploits. By Tim Lawless
lids-0.8pre4-psk-2.2..>63663486Jan 26 13:06:22 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Bugfixes. Homepage here. By Xie Hua Gang
lids-0.8pre1-psk-2.2..>62462070Jan 18 09:58:18 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace on your system. LIDS can also provide raw device and I/O access protection. Changes: Use of capabilities bounding for even more control, switch of any capability without turning LIDS off, control of programs executed before LIDS is sealed, and unmount special authorization when rebooting for automatic shutdowns. Homepage here. By Xie Hua Gang
lids-0.8pre2-psk-2.2..>62263625Jan 24 13:17:50 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace on your system. LIDS can also provide raw device and I/O access protection. Changes: Minor typos, license to kill for smoother automatic shutdown (UPS), update option for lids.conf dev/inode numbers, and a 2-level encryption password. Homepage here. By Xie Hua Gang
lids-0.9pre3-2.2.14...>60473328Apr 11 15:03:25 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Fixes for missing symbols for modules and an oops at sealing time, and optional console hangup. Homepage here. By Xie Hua Gang
scandetect.tar.gz5841531Jul 27 10:18:41 2000
Scan Detect prevents attackers from running TCP port scanners against your Linux system by listening on a given TCP port and if any host on the internet connects to that TCP port, Scan Detect will use Ipchains to block that host completely. Homepage: http://personal.mia.bellsouth.net/mia/k/f/kf4dez. By Ryan Mann
lids-0.9-2.2.14.tar...>58073829Apr 26 15:00:28 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Compilation problem fixed. Homepage here. By Xie Hua Gang
lids-0.9.4-2.2.15.ta..>57593399May 17 15:54:02 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Additional checking is done when adding acls, fixes when the kernel is reading lids.conf, fixes for inherit and no_inherit flags, and fixes for lidsadm. Homepage here. By Xie Hua Gang
rstd-1.1.tar.gz57010755Sep 21 16:52:19 2000
RSTD is a companion to the Stealth IP stack which will send rate-limited tcp rst (Connection Refused) packets on specified ports.  Homepage: http://www.energymech.net/madcamel/fm. By Robert Salizar
linux-2.3.99-pre5-se..>5683719Apr 21 23:19:10 2000
This is the securestackpatch by Openwall, ported for linux 2.3.99-pre5. There are no fancy configuration options, when you use this patch, next time you compile your kernel, the stack will be secure. By Karin
lids-0.9.8-2.2.17.ta..>56387110Sep 12 21:48:00 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: LIDS is now based on Linux kernel version 2.2.17. Homepage: http://www.lids.org. By Xie Hua Gang
dspspy1.1.0.tar.gz5547294Jun 6 15:14:50 2000
dspspy is a sound recording utility for spying. dspspy waits until a sound is detected (input via /dev/dsp) and then it records it to a unique file. dspspy records sounds from the microphone to raw sound files. This can be used as a surveillance system. Homepage: http://www.geocities.com/dvoid_2000/projects.html. By Richard Svensson
ippersonality-200007..>551208892Jul 27 19:37:34 2000
The Linux IP Personality patch fools OS detection by changing some characteristics of the network traffic. Among the things that can be changed are the TCP Initial Sequence Number (ISN), TCP initial window size, TCP options (their types, but also their order in the packet), answers to some pathological TCP packets, and answers to some UDP packets. Homepage: http://ippersonality.sourceforge.net. By Gael Roualland
lids-0.9.5-2.2.15.ta..>54793898May 29 12:12:47 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Bugfixed for protect mount point, lids_check_base, fixes for lidsadm when adding ACLs, added sparc64 support. Homepage here. By Xie Hua Gang
acl-0.5.4-4.tar.gz53971557Oct 7 12:16:39 1999
Linux, in the tradition of UNIX-like operating systems, implements file system permissions using a rather coarse scheme. While this is sufficient for a surprisingly large set of applications, it is too inflexible for many advanced scenarios. For that reason, all the major commercial UNIX operating systems have extended this simple scheme in one way or the other. For Linux, such extensions are not stable enough yet. Standard distributions do not include ACLs so far.
linux-2.2.17-ow1.tar..>53323355Sep 12 14:11:29 2000
The Secure-Linux patch adds a few security features to the kernel which, while not a complete method of protection, will stop most of the 'cookbook' buffer overflow exploits cold. It also adds the option of restricting the use of symlinks and named pipes in +t (temp) directories which fixes most tmp-race exploits as well. It can also add a little bit more privacy to the system by restricting access to parts of /proc to root so that users may not see who else is logged on or what they're doing. Also tightens down file descriptors 0, 1, and 2, implements process limits and shared memory destruction, and priveledged IP aliases for kernel 2.0. Changes: Now works on kernel 2.2.17! Readme available Homepage: http://www.openwall.com/linux. By Solar Designer
lids-0.9.9-2.2.17.ta..>52682351Sep 30 18:00:22 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off on the fly and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: This is a bugfix and code cleanup release.  Homepage: http://www.lids.org. By Xie Hua Gang
linux-2.2.14-ow1.tar..>51821992Jan 7 17:37:44 2000
This patch (for kernel version 2.2.14) is a collection of security-related features for the Linux kernel, all configurable via the new 'Security options' configuration section. Features a Non-executable user stack area, Restricted links in /tmp, Restricted FIFOs in /tmp, Restricted /proc, Special handling of fd 0, 1, and 2, Enforce RLIMIT_NPROC on execve(2), Destroy shared memory segments not in use, and Privileged IP aliases. Homepage here. By Solar Designer
linux-2.2.16-stealth..>50917368Jun 8 12:45:21 2000
Patch for linux kernel 2.2.16 to discard packets that many OS detection tools use to query the TCP/IP stack. Includes logging of the dropped query packets and packets with bogus flags. Changes: Now works with kernel v2.2.16. Homepage: http://www.innu.org/~sean. By Sean Trifero
envcheck.tgz5046481Sep 13 13:40:21 2000
Klogd Local Exploit. Envcheck is a Linux kernel module which detects and prevents exploitation of the recent glibc vulnerabilities by intercepting the execve system call and sanitising the enviroment passed. At the cost of a very small performance penalty, it has advantages over a glibc upgrade, including logging of exploit attempts, it works with statically linked binaries, it is transparent to applications that may be sensitive to a change of glibc, and it partially protects libc5. Homepage: http://c.home.cern.ch/c/cons/www/security/. By Lionel Cons
StJude_LKM-0.02.tar...>50413520Jul 29 10:10:26 2000
Saint Jude LKM is a Linux Kernel Module for the 2.2.0 series of kernels. This module implements the Saint Jude model for improper privilege transitions. This will permit the discovery of local, and ultimately, remote root exploits during the exploit itself. Once discovered, Saint Jude will terminate the execution, preventing the root exploit from occuring. This is done without checking for attack signatures of known exploits, and thus should work for both known and unknown exploits. Changes: Fixed bug which would prevent the setreuid syscal from being restored upon exit. By Tim Lawless
lids-0.9.3-2.2.15.ta..>49892720May 9 13:36:51 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Fixed bugs in Access control for DENY type, fixed bugs to cause the system crash, fixed bugs lidsadm when updating. Homepage here. By Xie Hua Gang
linux-2.2.17-stealth..>49617725Sep 5 19:01:30 2000
Patch for linux kernel 2.2.17 to discard packets that many OS detection tools use to query the TCP/IP stack. Includes logging of the dropped query packets and packets with bogus flags. Changes: Now works with kernel v2.2.17. Homepage: http://www.innu.org/~sean. By Sean Trifero
medusa-0.6.3.tar.gz479111820Nov 4 10:13:05 1999
Medusa is a package, which improves overall security of Linux OS by extending standard Linux security architecture, but preserving backward compatibility. There is a small kernel patch and a user space security daemon. Homepage here.
linux-2.2.12-ow6.tar..>47924545Oct 12 11:33:52 1999
The Secure-Linux patch adds a few security features to the kernel which, while not a complete method of protection, will stop most of the 'cookbook' buffer overflow exploits cold. It also adds the option of restricting the use of symlinks in +t (temp) directories which fixes most tmp-race exploits as well. It can also add a little bit more privacy to the system by restricting access to parts of /proc to root so that users may not see who else is logged on or what they're doing. By Solar Designer
lids-0.3-2.2.13.tar...>47719308Oct 29 08:30:40 1999
lids is an intrusion detection system patch for the Linux kernel; it can protect important files from being changed. When it's in effect, no one (including root) can change the protected files or directories and their sub-directories, and the protected append-only files can only be appended. It can also protect the hard disk's MBR, and can also disallow sniffing while the NIC is in promiscuous mode. Changes: Upgraded the kernel version to 2.2.13. Protected append-only files. Protected writing to the hard disk MBR. Fixed some bugs in the last version. Added config tools (lidsadm). Added the patch from Bosko Radivojevic changed APPEND_ONLY and IMMUTABLE flags; added PROMISC mode for network interfaces (disallowing sniffing). lids homepage. By Xie Hua Gang
lids-0.1-2.2.12.tar...>4759330Oct 15 16:52:49 1999
lids is an intrusion detection system patch for the Linux kernel; it can protect important files from being changed. When it's in effect, no one (including root) can change the protected files or directories and their sub-directories. First release. By Xie Hua Gang
lids-0.6.1-2.2.13.ta..>47335528Dec 15 11:42:30 1999
Linux IDS Patch - Version 0.6.1 - Dec 15, 1999. Lids is an intrusion detection system in the Linux kernel. This patch (Version 0.6.1) is for the Linux kernel 2.2.13. LIDS 0.6 has a brand new design. When LIDS is in effect, no one (including root) can change the protected files or directories and their sub-directories, and the protected append-only files can only be appended. It can also protect the hard disk's MBR, and can also disallow sniffing while the NIC is in promiscuous mode. Changes: A bugfix. Homepage here. By Xie Hua Gang
linux-2.2.13-ow1.tar..>47319873Oct 27 13:53:38 1999
This patch (for kernel version 2.2.13) is a collection of security-related features for the Linux kernel, all configurable via the new 'Security options' configuration section. In addition to the new features, some versions of the patch contain various security fixes. The number of such fixes changes from version to version, as some are becoming obsolete (such as because of the same problem getting fixed with a new kernel release), while other security issues are discovered. Homepage here. By Solar Designer
lids-0.2-2.2.12.tar...>46810208Oct 19 12:12:10 1999
lids is an intrusion detection system patch for linux kernel 2.2.12; it can protect important files from being changed. When it's in effect, no one (including root) can change the protected files or directories and their sub-directories. Changes: Bug fixes related to hard links, rename, symlinks , mknod, and mkdir, and now no one can mv, rm, chmod, chown, or ln in the directories you protect. lids homepage. By Xie Hua Gang
bmap-1.0.17.tar.gz46639631Apr 17 13:04:00 2000
The Linux kernel includes a powerful, filesystem independant mechanism for mapping logical files onto the sectors they occupy on disk, which can be subverted (with bmap and friends) to perform a variety of functions interesting to the computer forensics community and the computer security community. Changes: A fix for a casting error that created problems on files located above 2GB. By Daniel Ridge
lids-0.4.1-2.2.13.ta..>46634208Nov 26 14:16:18 1999
lids is an intrusion detection system patch for the Linux kernel; it can protect important files from being changed. When it's in effect, no one (including root) can change the protected files or directories and their sub-directories, and the protected append-only files can only be appended. It can also protect the hard disk's MBR, and can also disallow sniffing while the NIC is in promiscuous mode. Changes: Now there is a password to turn lids on/off, Fixed bug in protecting MBR writing, Fixed bug in log file protection, and Fixed bugs in lidsadm for security reasons. lids homepage. By Xie Hua Gang
lids-0.6-2.2.13.tar...>46435786Dec 10 13:01:33 1999
Linux IDS Patch - Version 0.6 - Dec 9, 1999. Lids is an intrusion detection system in the Linux kernel. This patch (Version 0.6) is for the Linux kernel 2.2.13. LIDS 0.6 has a brand new design. When LIDS is in effect, no one (including root) can change the protected files or directories and their sub-directories, and the protected append-only files can only be appended. It can also protect the hard disk's MBR, and can also disallow sniffing while the NIC is in promiscuous mode. Changes: IP firewalling rules protection, ptrace syscall lock, Allow some specified processes to access /dev/mem, Modules protection, Mounted filesystem protection, Hide sensitive processes, Running processed protection, More safty & detailed logging. Homepage here. By Xie Hua Gang
lids-0.4-2.2.13.tar...>46422576Nov 19 10:33:02 1999
lids is an intrusion detection system patch for the Linux kernel; it can protect important files from being changed. When it's in effect, no one (including root) can change the protected files or directories and their sub-directories, and the protected append-only files can only be appended. It can also protect the hard disk's MBR, and can also disallow sniffing while the NIC is in promiscuous mode. Changes: Seal the kernel program, mounted filesysten protection, loaded modules protection, running processes protection, and more safty and detailed logging. lids homepage. By Xie Hua Gang
linux-2.0.38-ow4.tar..>46225659Oct 27 13:53:49 1999
This patch (for kernel version 2.0.38) is a collection of security-related features for the Linux kernel, all configurable via the new 'Security options' configuration section. In addition to the new features, some versions of the patch contain various security fixes. The number of such fixes changes from version to version, as some are becoming obsolete (such as because of the same problem getting fixed with a new kernel release), while other security issues are discovered. Homepage here. By Solar Designer
SuSEcompartment-0.5...>45211745Jan 4 00:49:07 2000
SuSE Compartment is a program to build secure compartments for running untrsted/insecure programs, and has got the usual uid/gid setting and chrooting abilitity, but the nice thing is the easy access to linux per process capabilities. Homepage here. By Marc
motion-2.0.tar.gz44445106Sep 8 10:28:29 2000
motion uses a video4linux device as a motion detector. It will make snapshots of the movement it sees, making it usable as an observation or security system. It can send out email, SMS messages, or invoke an external command when detecting motion. Changes: New stable release! Integrated motion tracking, Improved lightswitch detection, and fixed support for quickcams. Homepage: http://motion.technolust.cx/. By Jeroen Vreeken
dspspy1.1.3.tar.gz43211202Jun 13 13:17:38 2000
dspspy is a sound recording utility for spying. dspspy waits until a sound is detected (input via /dev/dsp) and then it records it to a unique file. dspspy records sounds from the microphone to raw sound files. This can be used as a surveillance system. Changes: Major code rewrite using the ncurses library. A pause feature using SPACE has been added. Homepage: http://www.geocities.com/dvoid_2000/projects.html. By Richard Svensson
capsel.tgz431134765Sep 12 12:08:06 2000
Capsel v1.56 is a Linux kernel module for v2.2.x with many features that increase your system security. It features the ability to stop chroot jail break, stop ptracing, control the execve call, and removes read permission from core dumps. It also changes the behavior of set*uid system calls which may be used by programs to drop almost all capabilities and UID without dropping capabilities that are needed to work correctly (i.e. bind sockets). Changes: Capsel now clears all environment variables for privileged executables. It no longer needs a patched glibc to prevent users from using dynamic linker (LD_PRELOAD-like) stuff. Readme available here. Homepage: http://www.elzabsoft.pl/~wp. By Wojciech Purczynski
gspy-0.1.2-src.tar.g..>422145920Jul 21 21:26:36 2000
Gspy retrieves images from a video4linux device and processes these into a daily mpeg movie on the disk drive. Each image is recorded with a time stamp to insure accurate real world correlation. Special motion detection algorithms are used to reduce the size of the daily movies by eliminating pictures with similar content as well as the normal compression obtained via the mpeg process. The result is a time lapse video per day with nonlinear time compression using only the images of interest. Screenshot available here. Homepage: http://gspy.sourceforge.net. By Lawrence P. Glaister
virtualftpd.tgz38574931Jul 24 12:37:32 2000
Virtual FTPD v6.4 is a secure FTP daemon which is derived from the OpenBSD ftp daemon and can allows virtual FTP accounts which do not have an /etc/passwd entry. Homepage: http://startuplinux.com/software.html. By Michael Saarna
lids-0.9.5b-2.2.16.t..>36595185Jun 9 12:58:52 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Compiler error fixes. Homepage: http://www.lids.org. By Xie Hua Gang
dspspy1.1.2.tar.gz3369834Jun 8 17:10:00 2000
dspspy is a sound recording utility for spying. dspspy waits until a sound is detected (input via /dev/dsp) and then it records it to a unique file. dspspy records sounds from the microphone to raw sound files. This can be used as a surveillance system. Changes: A new utility has been added for calibrating the mic threshold. Homepage: http://www.geocities.com/dvoid_2000/projects.html. By Richard Svensson
motion-1.3.tar.gz31638198Jun 28 19:00:26 2000
motion uses a video4linux device as a motion detector. It will make snapshots of the movement it sees, making it usable as an observation or security system. It can send out email, SMS messages, or invoke an external command when detecting motion. Changes: Bug fixes, motion tracking with the mini_ssc library. A sensitivity mask and a minimum gap between snapshots was added. Homepage: http://motion.technolust.cx/. By Jeroen Vreeken
lids-0.9.5a-2.2.16.t..>31495128Jun 8 17:03:47 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off online and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Now works with the 2.2.16 kernel, bugfixes for protecting the mount point and kernel port scan detection. Homepage: http://www.lids.org. By Xie Hua Gang
motion-1.4.tar.gz30638491Jul 5 22:19:00 2000
motion uses a video4linux device as a motion detector. It will make snapshots of the movement it sees, making it usable as an observation or security system. It can send out email, SMS messages, or invoke an external command when detecting motion. Changes: Can now be made to ignore sudden light changes, and a lightswitch filter was added. Homepage: http://motion.technolust.cx/. By Jeroen Vreeken
lids-1.0.1-2.4.0-tes..>26466512Oct 8 11:13:32 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off on the fly and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: This is the initial release of the series designed for the 2.40 kernel.  Homepage: http://www.lids.org. By Xie Hua Gang
motion-1.5.tar.gz20840537Aug 6 17:36:39 2000
motion uses a video4linux device as a motion detector. It will make snapshots of the movement it sees, making it usable as an observation or security system. It can send out email, SMS messages, or invoke an external command when detecting motion. Changes: Support for feeding images to a video4linux loopback device was added. A division by zero bug was fixed. An "install" target was added to the Makefile. Homepage: http://motion.technolust.cx/. By Jeroen Vreeken
lids-1.0.2-2.4.0-tes..>18866388Oct 11 00:01:30 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off on the fly and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: A bug in sys_utime was fixed which prevents users from changing the inode attribute.  Homepage: http://www.lids.org. By Xie Hua Gang
snoopy-1.2.tar.gz16410126Oct 15 15:54:20 2000
Snoopy is designed to log all commands executed by providing a transparent wrapper around calls to execve() via LD_PRELOAD. Logging is done via syslogd and written to authpriv, allowing secure offsite logging of activity. Changes: A fix for a very manacing bug. By Mike Baker
ip_scfw-0.9.1.tar.gz13518678Oct 21 00:02:27 2000
The SYN cookie firewall implements syn cookie syn flood protection on all hosts behind it. Contains a patch to Linux kernel 2.2.17 and an administration tool.  Homepage: http://www.bronzesoft.org/projects/scfw.
motion-2.1.tar.gz10747360Sep 26 16:44:13 2000
motion uses a video4linux device as a motion detector. It will make snapshots of the movement it sees, making it usable as an observation or security system. It can send out email, SMS messages, or invoke an external command when detecting motion. Changes: Added night_compenstate for dark pictures, Added realmotion option, changed default configuration. Homepage: http://motion.technolust.cx/. By Jeroen Vreeken
11logger-0.1.3.tar.g..>10414925Oct 17 00:03:04 2000
11logger is a small kernel patch, a module and some userspace tools to add SIGSEGV logging and history capabilities to Linux 2.2.x. 11logger is very useful in security auditing and general debugging. Changes: This release fixes a problem with the kernel patch which didn't unlock the spin lock in signal.c, and segvdump now reports more information on i386.  Homepage: http://www.kyuzz.org/antirez/sigsegv. By Antirez
11logger-0.1.2.tar.g..>8014278Oct 15 13:17:33 2000
11logger is a small kernel patch, a module and some userspace tools to add SIGSEGV logging and history capabilities to Linux 2.2.x. 11logger is very useful in security auditing and general debugging.  Homepage: http://www.kyuzz.org/antirez/sigsegv. By Antirez
motion-2.2.tar.gz7046572Oct 4 18:14:18 2000
motion uses a video4linux device as a motion detector. It will make snapshots of the movement it sees, making it usable as an observation or security system. It can send out email, SMS messages, or invoke an external command when detecting motion. Changes: Segfault bug fixed, now created mpegs when killed.  Homepage: http://motion.technolust.cx/. By Jeroen Vreeken
motion-2.3.tar.gz2348474Oct 15 17:12:08 2000
motion uses a video4linux device as a motion detector. It will make snapshots of the movement it sees, making it usable as an observation or security system. It can send out email, SMS messages, or invoke an external command when detecting motion. Changes: A workaround for changed strtok behaviour in Red Hat 7.0, a FAQ has been added, and better MPEG creation checks.  Homepage: http://motion.technolust.cx/. By Jeroen Vreeken
pam_watch-0.2.tar.gz228747Oct 15 17:19:20 2000
Pam_watch is a pam module that installs two fifos for each console and allows you to take control by using them. One fifo can be used to read from STDOUT of the user console and the other to write to the STDIN of it. A simple client utility that uses these features is included.  Homepage: http://frida.fri.utc.sk/~behan/devel/pam_watch/.
lids-0.9.11-2.2.17.t..>088958Dec 2 13:14:28 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off on the fly and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Bugfixed the file ACLs inherit, add EXEC domain support in kernel and lidsadm, and other bug fixes.  Homepage: http://www.lids.org. By Xie Hua Gang
lids-0.9.10-2.2.17.t..>084798Nov 17 01:07:29 2000
The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off on the fly and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Fixed umount filesystem bug, fixed NFSd and FTPd capability usages, and sys_sysctl() bugfixed.  Homepage: http://www.lids.org. By Xie Hua Gang
libformat-1.0pre5.ta..>05211Nov 13 11:53:12 2000
libformat is a library for the Linux operating system that intercepts, among others, calls to the printf() family of functions to prevent format string attacks, in which a possibly malicious user supplied format string is used. This is a programming error, but has recently been used to break computer security. This library can be used to protect against compromises due to yet undiscovered vulnerabilities in privileged programs. libformat checks for format strings containing the %n format specifier in writable parts of a process' address space, and if found, the process is terminated with the KILL signal.  Homepage: http://box3n.gumbynet.org/~fyre/software. By Tim J Robbins
linuxbsm-0.60.tar.gz020637Nov 24 19:04:16 2000
The Linux Basic Security Module (Linux BSM) is a kernel patch and userspace tools to implement C2 level security. It is patterned after Sun's Solaris Basic Security Module.  Homepage: http://linuxbsm.sourceforge.net. By Jeremy Banford, Daniel Holmlund
pax-linux-2.2.17.pat..>027234Nov 15 19:14:52 2000
PaX is an implementation of non-executable pages for IA-32 processors (i.e. pages which user mode code can read or write, but cannot execute code in). Since the processor's native page table/directory entry format has no provision for such a feature, it is a non-trivial task. The project was designed to provide Linux with protection from buffer overflows. Making parts of the memory pages read/write access enabled, but not executable provides the protection.  Homepage: http://pageexec.virtualave.net. By PaX
fpf.tar.gz06456Dec 2 18:10:23 2000
FPF is a lkm for Linux which changes the TCP/IP stack in order to emulate other OS's TCP fingerprint. The package contains the lkm and a parser for the nmap file that let you choose directly the os you want.  Homepage: http://www.pkcrew.org. By Fusys, Cyrax
rsbac-v1.1.0.tar.gz0421092Dec 11 17:38:03 2000
Rule Set Based Access Control (RSBAC) is an open source security extension for current Linux kernels. It is based on the Generalized Framework for Access Control (GFAC) and provides a flexible system of access control implemented with the help of a kernel patch. All security relevant system calls are extended by security enforcement code. This code calls the central decision component, which in turn calls all active decision modules and generates a combined decision. This decision is then enforced by the system call extensions. Changes: This version was ported to 2.4.0-test11. sys_mmap and sys_mprotect are now intercepted.  Homepage: http://www.rsbac.org.
StJude_LKM-0.04.tar...>020052Nov 2 01:13:55 2000
Saint Jude LKM is a Linux Kernel Module for 2.2.11 and greater kernels. This module implements the Saint Jude model for improper privilege transitions. This will permit the discovery of local, and ultimately, remote root exploits during the exploit itself. Once discovered, Saint Jude will terminate the execution, preventing the root exploit from occuring. This is done without checking for attack signatures of known exploits, and thus should work for both known and unknown exploits. Changes: Fixed bugs, added a Makefile, hid the old execve better, added a homepage.  Homepage: http://www.sourceforge.net/projects/stjude. By Tim Lawless
tcpspy-1.1.tar.gz05995Nov 13 11:55:49 2000
tcpspy is a linux administrator's tool that logs information about incoming and outgoing TCP/IP connections: local address, remote address and, probably the most useful feature, the user name. The current version allows you to include and exclude certain users from logging - this may be useful if you suspect one of the users on your system is up to no good but do not want to violate the privacy of the other users.  Homepage: http://box3n.gumbynet.org/~fyre/software. By Tim J Robbins
tcpspy-1.4.tar.gz011051Dec 7 10:41:09 2000
tcpspy is a linux administrator's tool that logs information about incoming and outgoing TCP/IP connections: local address, remote address and, probably the most useful feature, the user name. The current version allows you to include and exclude certain users from logging - this may be useful if you suspect one of the users on your system is up to no good but do not want to violate the privacy of the other users. Changes: Can now log the filename of the executable that created or accepted connections. Assorted bug fixes and code cleanups.  Homepage: http://box3n.gumbynet.org/~fyre/software. By Tim J Robbins
motion---512Jun 23 17:10:14 2000
Directory: motion uses a video4linux device as a motion detector, taking snapshots of the motion it sees.