A loopback device is a very special device that allows you to mount a normal file as it was a physical device. Loopback devices can be encrypted and these are called Crypto-Loops.
A good tutorial on Crypto-Loop is available here.
– Suramya
April 12, 2005
April 11, 2005
Ver 0.1 of IM2Email released
Ver 0.1 of IM2Email is a little perl script that connects to a AOL IM server, collects all IM’s sent to it and sends them to the specified email address. This program was developed on the request of Vinit Bhansali who seemed to think that something like this would be useful.
Check it out over here and let me know what you think of it.
Coming Soon: Email2IM, which will send all emails it recieves as an IM to a specified AIM account.
– Suramya
CollageGenerator is back up
I finally got my system completely back up and running so the CollageGenerator is back up. I haven’t completed the new version yet but I am hopeful that I should have it done by the end of the week.
Sorry about the downtime.
– Suramya
How to log idle users out of a Linux system?
Idle users are a big problem if the system doesn’t either log them out or lock the session. This is so because if a session is idle that means it might be unattended and could be used by an unauthorized person to gain access to restricted resources.
In windows idle the OS can be instructed to lock accounts after a specific idle time and in KDE/Gnome the screensaver’s allow us to the same thing. But this doesn’t cover the shell access. Users can remain logged in indefinetly unless they logout. Below are some programs that will log a user out if they exceed the specified idle time:
- Set TMOUT= in /etc/profile. (Only for bash, sh users)
- Use timeoutd
- Use porttime to control login times.
If you know of any other ways please let me know.
– Suramya
April 10, 2005
Audit user logon activity
These program(s) help you audit user logon activity to locate unusual activity:
Available as part of the Security Guide Scripts Download, this is a multi-threaded tool that will parse event logs from many servers at the same time.
Instructions on how to use EventCombMT are available over here.
Update (08th Aug 2007): Fixed the link to download the software and added the link to the instructions page
Tools to Audit a Windows Server
Here are some links to software/articles that will help you Audit your windows server(s):
Software:
- MS baseline security Analyzer
- Security audit/scanner
- NESSUS
- nmap Security Scanner
- Framework for Auditing
- Exploits for Testing
Articles:
– Suramya
New Knowledge @Suramya.com Blog started
Started keeping a new blog called Knowledge @Suramya.com. This blog will be a place for me to store all the interesting things/tips/resources I find and think are useful. It will contain everything from links to interesting articles to computer definitions to tutorials.
Since I am very interested in computer security there are links here to software/tutorials that explain how to test computer security. These are for informational purposes only and if you decide to use them to break into a system that you don’t own then you are doing it at your own risk, if you get into trouble don’t blame me.
Originally all this info was supposed to be in a KnowledgeBase but I didn’t find any KB software which I liked so I decided to keep a Blog instead.
Check it out and let me know what you think of it.
-Suramya
List of Datawipe Tools
Below are some software that allows you to delete data from disks securely. All of them are pretty efficent and make it difficult for someone to recover the data. However keep in mind that no data is 100% unrecoverable to those who have sufficient time and money.
So it you have some really sensitive data that you have to destroy look into purchasing a furnace and melt the disks down and then destroy the remains.
Software for Data Wiping:
DBAN:
Darik’s Boot and Nuke (’DBAN’) is a self-contained boot floppy that securely wipes the hard disks of most computers. DBAN will automatically and completely delete the contents of any hard disk that it can detect, which makes it an appropriate utility for bulk or emergency data destruction.
It’s a bootable floppy image that sterilizes IDE hard disks on x86 machines.
BCWipe software is designed to securely delete files from disks and other media
The utilities on this page allow you to destructively wipe/delete/erase a file, a disk (floppy disks, hard disks, etc), or a partition.
Active@ KillDisk is a powerful and compact DOS software that allows you to destroy all data on hard and floppy drives completely, excluding any possibility of future recovery of deleted files and folders.
Eraser is a powerful system security utility developed on the basis of advanced studies and research.
April 9, 2005
System log management Applications and Resources
Programs to monitor the Log files for multiple computers running Windows 2000/XP/NT/2003.
GFI LANguard S.E.L.M. can analyze application, system and other event logs. You can back up and clear event logs on all remote machines in your network automatically; and view, report and filter events network-wide, instead of just per machine. GFI LANguard S.E.L.M. collects all events in one central database, making it easy to create network-wide reports and custom filters. Using the custom rules, you can create your own event alerts based on event ID, condition and event contents.
syslogng provides a centralised, securely stored log of all devices on your network, whatever platform they run on. And syslog-ng also incorporates a host of powerful features, including filtering based on message content, as well as customisable data mining and analysis capabilities.
Kiwi Syslog Daemon is a freeware Syslog Daemon for Windows. It receives, filters, logs, displays and forwards Syslog messages and SNMP traps from hosts such as routers, switches, Unix hosts and any other syslog enabled device.
A site dedicated to pulling together a repository of useful information on log analysis for computer security
Implementing Central Logging Server
This document attempts to provide a practical guide for implementing a centralized syslog server at an Enterprise level. The document includes details on porting cross platform logs to a central syslog server, porting messages to a database and real time viewing and querying of the logs
Update (12th May 2005):
Log parser is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows® operating system such as the Event Log, the Registry, the file system, and Active Directory®.
SecurityFocus has a good article explaining how to use the logparser.