Forgot your password?
typodupeerror

Comment: Re:pfSense is a winner (Score 1) 238

by Ecks (#47893993) Attached to: Ask Slashdot: Advice On Building a Firewall With VPN Capabilities?
Another vote for pfSense on Soekris here. I'll admit that I prefer straight up OpenBSD but for quick and dirty, pfSense is the way to go. Which Soekris is the real question. If you don't mind the spend, the Net6501 is best. It's got well supported gigabit nics so it will handle full speed traffic from Verizon FIOS, Google Fiber, or the top speed of a Docsis 3 modem. Net5501's show up on eBay irregularly in the $150.00 range. It doesn't make sense to buy them new as they are not much cheaper than the big brother Net6501. You can put a multi-port intel Gigabit card in a Net5501 but it will run hot so you probably want to spring for the larger rack mount case or just get the Net6501. Both the 6501 and the 5501 have more grunt than you need for a firewall/VPN box provided that you don't need to run 5 or more concurrent VPN connections terminating on the soekris' CPU. The last advantage of the net5501 is the presence of a USB 2.0 connection on the front panel. The net4801 is actually a workable solution for pfSense as a firewall/VPN termination box. They commonly show up on eBay in the $60 ~ $100 range. I wouldn't bid more than $80.00. If you find that the lack of CPU horsepower is getting in your way, search for a soekris VPN1411 card, again on eBay. These are typically very cheap, $25.00 and do hardware crypto offload, allowing a Net4801 to handle multiple VPN streams if that's your fancy.

Comment: Re:Audit necessary (Score 1) 136

by Ecks (#34642210) Attached to: De Raadt Doubts Alleged Backdoors Made It Into OpenBSD
Anyone using ssh to it's maximum security potential isn't sending a password across the channel more than once. On new systems I use some variation of the following to push my key onto the remote system.

$ ssh-add
$ ssh -A myUser@remoteSystem "ssh-add -L >> ~/.ssh/authorized_keys; chmod 644 ~/.ssh/authorized_keys"

Anyone using ssh with passwords would do well to read up on public key authentication in ssh.

-- Ecks
News

+ - Deepwater Horizon had BSOD issues->

Submitted by Ecks
Ecks (52930) writes "The testimony has started in the Deepwater Horizon case and in addition to other problems it looks like they had major BSOD issues with their computer system. The whole thing article is an interesting read. It's on the NY Times site so registration is required.

"Problems existed from the beginning of drilling the well, Mr. Williams said. For months, the computer system had been locking up, producing what the crew deemed the “blue screen of death.”

“It would just turn blue,” he said. “You’d have no data coming through.”"

Link to Original Source
Microsoft

+ - BSOD on Deepwater Horizon

Submitted by ctdownunder
ctdownunder (816383) writes ""The emergency alarm on the Deepwater Horizon was not fully activated on the day the oil rig caught fire and exploded, triggering the massive spill in the Gulf of Mexico, a rig worker on Friday told a government panel investigating the accident...Problems existed from the beginning of drilling the well...[f]or months, the computer system had been locking up, producing what the crew deemed the blue screen of death." http://www.nytimes.com/2010/07/24/us/24hearings.html?hp"
Debian

+ - Which Is Faster: Debian Linux or FreeBSD?->

Submitted by Anonymous Coward
An anonymous reader writes "Phoronix has published a new article in which they look at the performance of Debian GNU/Linux, Debian GNU/kFreeBSD and FreeBSD itself. Debian GNU/kFreeBSD is the new port of Debian that includes the GNU Debian userland and GNU C library but replaces the Linux kernel with the FreeBSD kernel. The 7.3 and 8.0 releases of FreeBSD and its kernel were tested and 2.6.32 was the Linux kernel version used. Debian GNU/Linux won handsomely in a majority of the tests, but it was not the hands-down winner."
Link to Original Source

Comment: Re:China asks Slashdot how to catch hungry minds (Score 1) 403

by Ecks (#32776992) Attached to: Tunneling Under the Great Firewall?

All network admins operate in the political domain. Several people here have mentioned that SSH forwarding works in China as I'm sure it does in Iran and Pakistan. Standard SSH on port 22 may just be too useful a tool socially and economically to block. As a consultant I find it rare to visit a shop that blocks SSH anymore even though most of the security admins that I know are well aware that with Putty you can forward any port inside to any port outside as you wish. Of the admins that I meet, most shrug this off as a non-problem saying:I know that users can circumvent any block on my firewall using SSH and port forwarding but the vast majority of my users don't have the arcane knowledge to do that.

We might not be the right people to ask since anyone on Slashdot could find Putty and the right configurations to do this in 15 minutes of searching on Google. And that assumes that the person asking is stuck on MS Windows. In Linux or OS X it's built into the OS.

I'd disagree that SSH is the best way to do this. A VPN is better because using a VPN allows you to hide in a class of users that the attacker wants to court and curry the favor of. The Chinese government wants our business so they must consent to our business people using strong encryption on our communications back home. SSH forwarding is one way to do this but a VPN is a much more common part of corporate IT security policy. If SSH is socio/economically difficult to block, a VPN is even more so.

Media

Low-Level Format For a USB Flash Drive? 252

Posted by timothy
from the back-from-the-living-dead dept.
Luyseyal writes "I unwittingly bought one of these terrible flash cards at Fry's and have managed to nuke two of them, successively. I have a USB flash card reader that will read/write the current one at USB 1.0 speed, but it locks up every Ubuntu and XP machine I've come across in high-speed access mode. I have read that if I low-level format it that it could be fixed, though my current one doesn't support it. My Google-fu must be weak because I cannot seem to find a USB flash reader that specifies that it will do low-level formatting." Can anyone offer advice for resurrecting such drives?

Comment: Re:A measely 6k attempts over 4 days? Who cares? (Score 1) 391

by Ecks (#29642935) Attached to: Sloppy Linux Admins Enable Slow Brute-Force Attacks

Furthermore, since most of the methods that people use to discover brute forcing attempts rely on a high rate of attack, these slow attacks are immune. I'm not sure how the oft mentioned denyhosts works but the author of the original article is using FreeBSD and OpenBSD with the pf filewall which can blackhole brute forcers based on rate of attack. Using the pf method with settings aggressive enough to catch the latest round of attacks runs a high risk of blocking valid users. I'm seeing the same issue as the original article's author and I've noticed as he has that my OpenBSD boxes have not been targeted. FreeBSD, NetBSD, Ubuntu and Debian on the other hand.

My suggestion: Use Public Keys as much as possible. Systems allowing only Public Keys are immune to these attacks and you don't get the nasty log messages as well. If you must allow passwords disallow them for root. You can get root access by configuring sudo for users and via Public Keys for scripts.

# PasswordAuthentication no ## Best -- Public keys required for login
# PasswordAuthentication yes ## Only if you must.
# PermitRootLogin no ## Best -- root cannot login remotely.
# PermitRootLogin without-password ## Better -- root can login via key but not with a password.

Comment: Re:HP (Score 1) 557

by Ecks (#29612087) Attached to: Choosing a Personal Printer For the Long Haul

Not sure I agree on the predatory ink pricing but I solidly see your point if you are looking at their cheapest inkjet printer. For color output I have an HP 2250 that I've been happy with. Ink is $130 for all four cartridges but lasts about 2000 pages. The 2250 was marketed as a SOHO printer when I bought it in the late 1990s (perhaps 1999) I bought the postscript cartridge and maxed the memory later. It's okay but the cost to print is considerably higher than the laser but I expected that when I bought it. My experience with the 2250 led me to convince my father-in-law to buy an HP 7210 all-in-one. This was a solidly bad decision. The ink is expensive, and the networking is completely non-standard. I spent a week chasing network bugs with it before kicking it to static IP. Even after that the driver software basically hung up windows at shutdown or reboot.This was for lack of a routine to handle the UserDrivenShutdown() event.

-- Ecks

Comment: Re:HP (Score 1) 557

by Ecks (#29611963) Attached to: Choosing a Personal Printer For the Long Haul

Here here, I replaced a NEC Silentwriter II model 290 with an HP laserjet 4000. As far as Postscript goes your experience is the same as mine: getting postscript future proofed a printer that I purchased in 1994 and retired in 2003. I got my HP on eBay from a guy 10 miles from my house to save on shipping. I added some memory from an old laptop that I had to max it out, and bought a duplexer on eBay for about $50.00. All told it cost me $200.00. It's 2009 and this printer has given me no hassles in 6 years. Even better than the NEC, I can leave this one turned on 24/7 without worrying about my electric bill because it does power save. Any HP 4xxx printer should do the same.

-- Ecks

"Irrationality is the square root of all evil" -- Douglas Hofstadter

Working...