Linux Kernel 2.4 Firewalling Matures: netfilter In yet another set of advancements to the kernel IP packet filtering code, netfilter allows users to set up, maintain, and inspect the packet filtering rules in the new 2.4 kernel. This document explains those changes and tips on how to get started.

http://www.linuxsecurity.com/feature_stories/kernel-netfilter.html

This week, advisories were released for sysctl(), OpenSSH, proftpd, xfree86-1, libkrb, and bind. The vendors include Debian, FreeBSD, LinuxPPC, Mandrake, NetBSD, Red Hat, Smoothwall, and Trustix.

http://www.linuxsecurity.com/articles/forums_article-2519.html

FREE SECURITY BOOKS Guardian Digital has just announced an offer for free 2 free security books with the purchase of any secure Linux Lockbox. The Lockbox is an Open Source network server appliance engineered to be a complete secure e-business solution. It can be used as a commerce server, web server, DNS, mail, and database server. Please see Guardian Digital's website for details.

Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines.

Host Security News:

February 18th, 2001 -- Avoiding security holes when developing an application - Part 1 -- This article is the first one in a series about the main security holes that can usually to appear within an application. Along these articles, we'll show the ways to avoid them by changing a little the development habits. It doesn't take more than two weeks before a major application, part of most Linux distributions, presents a security hole, allowing, for instance, a local user to become root.

http://www.linuxsecurity.com/articles/server_security_article-2530.html

February 16th, 2001 -- Monitoring Unix Logins -- In today's article, I'd like to take a look at utmp, wtmp, and lastlog. These three files are read and updated whenever a user logs in to your FreeBSD system. However, you can't read these files directly, so we'll also look at the various utilities you can use to garner the information contained within these files.

http://www.linuxsecurity.com/articles/host_security_article-2520.html

February 15th, 2001 -- Netfilter for IP Masquerade -- As of 2.4, ipchains is a thing of the past. The replacement for ipchains is Netfilter's iptables. What does this mean to the end user? Typically it means little beyond the fact that suddenly their ipmasq script doesn't work. So, for starters let's get into setting up ipmasq under 2.4.x kernels. Connection tracking is a new feature of netfilter that allows you to accept or deny a packet based on the state of the connection rather than the strict allow/deny of ipchains. NAT of course stands for Network Address Translation, the key feature behind IP Masquerade. The other entries in this menu are optional, enable them as you please and recompile the kernel if needed.

http://www.linuxsecurity.com/articles/firewalls_article-2513.html

February 15th, 2001 -- Intrusion Detection Systems, Part IV: Logcheck -- The last in this four part series on IDS, looks at Logcheck: a software package that is designed to automatically run and check system log files for security violations and unusual activity. In the last three articles in this series, we looked at the concept of an Intrusion Detection System (IDS) and its implementation on your network. We discussed some of the top-notch tools like Tripwire and Snort, that you could use as your Swiss army knife in detecting intrusions into your network.

http://www.linuxsecurity.com/articles/intrusion_detection_article-2509.html

February 13th, 2001 -- Intrusion Detection Systems, Part IV: Logcheck -- The last in this four part series on IDS, looks at Logcheck: a software package that is designed to automatically run and check system log files for security violations and unusual activity. In the last three articles in this series, we looked at the concept of an Intrusion Detection System (IDS) and its implementation on your network.

http://www.linuxsecurity.com/articles/intrusion_detection_article-2488.html

February 13th, 2001 -- Securing BSD Daemons -- Let's continue where we left off by taking a closer look at /etc/inetd.conf. Remember that inetd is the internet super-server which listens for requests on behalf of other daemons; it reads /etc/inetd.conf to determine which ports you wish it to listen on.

http://www.linuxsecurity.com/articles/server_security_article-2490.html

Network Security News:

February 17th, 2001 -- Artificial Intelligence to detect Intrusions -- This site, in German, talks about an artificial intelligence project to detect intrusions. "Electronic intrusion detection is much trickier than human intrusion detection. Humans can search for the intruder by opening doors, looking into closets, etc. The intruder cannot turn into a company's General Manager or turn into a copy machine all of a sudden (spoofing or trojan horse).

http://www.linuxsecurity.com/articles/intrusion_detection_article-2529.html

February 16th, 2001 -- Jay Beale: Education Is Primary Defense for Secure Machines -- It was with no small amount of irony that Jay Beale, lead developer for Bastille Linux, was hired by MandrakeSoft last Fall to help the French Linux company bolster the security of its Linux-Mandrake distribution. Now, after a few months in the employ of MandrakeSoft, Beale has some definite ideas about how he will be securing Linux-Mandrake and all of the other Linux distributions as well.

http://www.linuxsecurity.com/articles/forums_article-2524.html

February 15th, 2001 -- monitord - Network Security Monitor -- A lightweight (distributed?) network security monitor for TCP/IP+Ethernet LANs. It will capture certain network events and record them in a relational database. The recorded data will be available for analysis through a CGI based interface. The main purpose of this project is to build a lightweight (and possibly distributed) network security monitor, designed for TCP/IP+Ethernet LANs.

http://www.linuxsecurity.com/articles/intrusion_detection_article-2510.html

February 14th, 2001 -- Secure Remote Log Servers Using SCP -- A few months ago, I challenged myself with a problem. I wanted to implement centralized system logging that would securely store logs in a location that would prevent any tampering or mischief.

http://www.linuxsecurity.com/articles/network_security_article-2501.html

February 14th, 2001 -- Linux Intrusion Detection Poster -- SysAdmin Magazine has the contents of their recent Linux Intrusion Detection Poster available online. "No matter how security minded you are, no matter how many updates and patches you apply, there's always a chance that someone will crack one of your systems. It's an unpleasant reality, but it's a fact: no system is 100% secure unless it's turned off, but how useful is that?

http://www.linuxsecurity.com/articles/intrusion_detection_article-2505.html

Cryptography News:

February 15th, 2001 -- Name change doesn't impress Carnivore's critics -- The FBI's name change for its Internet wiretapping program, from Carnivore to DCS1000, wasn't the alteration one of the application's most vocal critics wanted to see. "The only thing we've seen come out of the FBI or the Justice Department is the new name, which is a matter of public relations more than anything else," David Sobel, general counsel of the Electronic Privacy Information Center. "But I haven't seen any changes that are a response to the criticisms of Carnivore.

http://www.linuxsecurity.com/articles/privacy_article-2514.html

February 15th, 2001 -- Crypto-Gram February 15th, 2001 -- Though more smart cards are in use in the United States than ever before, experts now say the technology may take at least four years to permeate the business or consumer sectors here and attain similar status as the ever-popular credit card.

http://www.linuxsecurity.com/articles/cryptography_article-2515.html

General News:

February 17th, 2001 -- There's no going back after CPRM, warns Schneier -- CPRM copy control poses "a serious threat to civil liberties", writes cryptography expert Bruce Schneier. In an analysis of the CPRM specs that the 4C Entity has proposed for inclusion in the ATA hard drive specification in his latest Cryptogram newsletter, Schneier warns of their social cost. He also comprehensively debunks the spin that CPRM - as it was first thrown at the ATA committee - was only ever intended for removable media.

http://www.linuxsecurity.com/articles/cryptography_article-2527.html

February 16th, 2001 -- Intrusion detection rules drafted -- The National Institute of Standards and Technology released Monday new draft guidance on intrusion-detection systems, outlining all the factors agencies need to consider when integrating these security systems into their networks. The guidance is part of a series of special publications NIST has put out to assist agencies in the information security arena.

http://www.linuxsecurity.com/articles/government_article-2521.html

February 13th, 2001 -- Full Disclosure? Full Complicity! -- The term "full disclosure" is marvelously ambiguous, and therein lies much of the problem. It essentially means to "widely disseminate as much information about system vulnerabilities and attack tools as possible so that potential victims are as knowledgeable as those who attack them." Admittedly, this concept has a certain appeal.

http://www.linuxsecurity.com/articles/general_article-2492.html