http://www.linuxsecurity.com/feature_stories/feature_story-65.html

This week, advisories are not found in this newsletter. They can be located in our new publication, "Linux Advisory Watch." We hope that this change in format makes focusing on patching system vulnerabilities easier.

Advisories: Read 'Linux Advisory Watch, September 1st, 2000

Our sponsor this week is WebTrends. Their Security Analyzer has the most vulnerability tests available for Red Hat & VA Linux. It uses advanced agent-based technology, enabling you to scan your Linux servers from your Windows NT/2000 console and protect them against potential threats. Now with over 1,000 tests available.

http://www.webtrends.com/redirect/linuxsecurity1.htm

Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines.

Host Security News:

August 31st, 2000 -- Intrusion Detection Level Analysis of Nmap and Queso -- The purpose of this paper is to help Intrusion detection analysts and firewall administrators identify NMAP & QUESO scans. This paper will provide bit level analysis in detecting NMAP and QUESO scans. This type of analysis is vital for individuals who are performing firewall administration and need to understand more details relating to these scanners and the scans they perform.

http://www.linuxsecurity.com/articles/intrusion_detection_article-1471.html

August 31st, 2000 -- PAM - Pluggable Authentication Modules -- PAM (Pluggable Authentication Modules) provides the backbone of most authentication in modern Linux systems (and can be implemented in others, such as Solaris), yet it is typically ignored and woefully under-utilized. Anytime you log into a modern Linux system, whether via telnet, ssh, pop, ftp, and so on, you are using PAM to process the authentication request.

http://www.linuxsecurity.com/articles/host_security_article-1474.html

August 28th, 2000 -- Anyone with a Screwdriver Can Break In! -- This article will discuss the second weakest layer of computer security, Physical Security1. As we'll see, any attacker with physical access to a computer, a little ingenuity, and sufficient time can compromise the system. By way of example, I'll demonstrate attack and defense on a Red Hat Linux box and show how you might slow down, or even prevent, these kinds of attacks. You don't need a Linux machine, or even technical responsibility, for this article to be useful.

http://www.linuxsecurity.com/articles/general_article-1444.html

Network Security News:

September 1st, 2000 -- Inexpensive measures to solve security problems -- Computer security is difficult to achieve. It requires constant vigilance, and it involves inconvenience. Sometimes, expensive products are offered that are claimed to solve your security problems with no problems, and they do not deliver. However, there are a number of inexpensive measures that would seem to solve a lot of security problems that aren't being used.

http://www.linuxsecurity.com/articles/network_security_article-1480.html

August 30th, 2000 -- Attacking Linux -- Network scanning, password grabbing, trojaned software -- all are the bane of the righteous sysadmin. Craig Ozancin reveals how to beef up network security and ward off attackers at the LinuxWorld Expo, as reported by Rick Moen.

http://www.linuxsecurity.com/articles/hackscracks_article-1468.html

August 29th, 2000 -- Firewalls - Placement -- Security is no good if it isn't in the right place. Think about a modern office building - where are the doors with locks? The lobby doors can always be locked, and usually the doors on each floor have locks as well. If only the office doors had locks, the building would be less secure. More security guards would be needed to make sure no one is trying to force a door.

http://www.linuxsecurity.com/articles/firewalls_article-1460.html

Cryptography News:

August 31st, 2000 -- The Emotional Side of Cryptography -- Encrypting data before storage or transmission involves a bit of extra work. This often means that people who ought to be using encryption, instead of relying on the assumption that their data will not be intercepted, fail to do so. But it is also true that some of the people who use encryption are keenly aware of the importance of keeping their information secret.

http://www.linuxsecurity.com/articles/cryptography_article-1473.html

August 31st, 2000 -- Ain't no network strong enough -- Master cryptographer Bruce Schneier's "Secrets and Lies" explains why computer security is an oxymoron. Bruce Schneier, master cryptographer and idol of the computer underground, targets those short-attention-spanners in his latest book, "Secrets and Lies: Digital Security in a Networked World." Aiming straight for the vaunted "general audience," he peppers the 400-plus pages with Yogi Berra quotes, analogies drawn from "Star Wars" and trivia tidbits from Greek mythology.

http://www.linuxsecurity.com/articles/cryptography_article-1476.html

August 28th, 2000 -- Encryption Could Starve Carnivore -- Even as the FBI slowly releases details of its Carnivore e-mail wiretap technology, software developers are readying schemes to starve Carnivore of meaningful data. ChainMail and Sigaba are among the companies promoting encryption technology designed to render any captured e-mail meaningless to third parties.

http://www.linuxsecurity.com/articles/cryptography_article-1453.html

August 28th, 2000 -- The next era for Internet security -- Security insiders have had the date circled on their calendars for years. What's going to happen when RSA's encryption and decryption patents expire next month? A milestone in the history of technology is set to occur next month when RSA Security Inc. patents, fundamental to most Internet security, expire.

http://www.linuxsecurity.com/articles/general_article-1451.html

Vendor/Product/Tools News:

August 30th, 2000 -- Review of Debian 2.2 Security -- I wanted to write a really positive article about Debian 2.2, which was just released a few weeks ago. Unfortunately, I can't. While Debian itself is a reasonably well-done Linux distribution, it has some major security issues.

http://www.linuxsecurity.com/articles/host_security_article-1465.html

August 28th, 2000 -- Justice shops for Carnivore review -- The Justice Department has officially begun shopping for a university to conduct an independent technical review of Carnivore, the e-mail bugging system. The request for proposals was posted on the department's World Wide Web site Aug. 23, and Attorney General Janet Reno said proposals are due Sept. 6.

http://www.linuxsecurity.com/articles/government_article-1448.html

General News:

September 3rd, 2000 -- ICMP Usage in Scanning version 2.0 -- The Internet Control Message Protocol is one of the debate full protocols in the TCP/IP protocol suite regarding its security hazards. There is no consent between the experts in charge for securing Internet networks (Firewall Administrators, Network Administrators, System Administrators, Security Officers, etc.) regarding the actions that should be taken to secure their network infrastructure in order to prevent those risks. In this paper Ofir Arkin has tried to outline what can be done with the ICMP protocol regarding scanning.

http://www.linuxsecurity.com/articles/documentation_article-1485.html

September 1st, 2000 -- Justice shops for Carnivore review -- Since the public learned of Carnivore in early July, members of Congress, privacy advocates and civil liberties organizations have expressed serious concerns over its use and potential for abuse. The request for proposals notes some of the concerns, including that the system could provide investigators with more information than legally allowed by a court order or be used for unlawful invasions of privacy.

http://www.linuxsecurity.com/articles/privacy_article-1478.html

September 1st, 2000 -- Interview with Lance Spitzner -- Lance is a former officer in the Army's Rapid Deployment Force, and the author of numerous Whitepapers on computer security. In his own words: "I'm a geek who constantly plays with computers, especially network security. I love security because it is a constantly changing environment, your job is to do battle with the bad guys."

http://www.linuxsecurity.com/articles/forums_article-1481.html

August 30th, 2000 -- To Tell, or Not to Tell? -- Some "bug hunters" who uncover security flaws in computer software and rush to issue public warnings may be helping hackers more than consumers, industry officials worry. It's a thorny issue that divides security specialists. Many argue that fast, full disclosure of a vulnerability alerts computer users to take precautions and pushes software makers to provide a quick solution.

http://www.linuxsecurity.com/articles/hackscracks_article-1469.html