Linux Security Week, Nov 20th 2000

[newsletter-admins () linuxsecurity com]

+---------------------------------------------------------------------+
|  LinuxSecurity.com                         Weekly Newsletter        |
|  November 20, 2000                         Volume 1, Number 29n     |
|                                                                     |
|  Editorial Team:  Dave Wreski             dave () linuxsecurity com    |
|                   Benjamin Thomas         ben () linuxsecurity com     |
+---------------------------------------------------------------------+

Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.

This week during the election hooplah, a few good articles were released.
They include " Building Linux and OpenBSD Firewalls," "The ABCs of IDSs
(Intrusion Detection Systems)," and "SSL In The Driver's Seat."  Each
cover different aspects of security.  Also this week, various firms are
warning of possible DoS attacks occurring during the Christmas holidays.
It is never to early to begin preparing for this, or any other remote
attack.

This week, advisories were released for named, bind, gnupg, tcsh, ncurses,
telnetd, nss_ldap, openssh, cups, modutiles, pine, and imap.  The vendors
include Caldera, Debian, FreeBSD, Mandrake, Conectiva, Immunix, Trustix,
Red Hat, Slackware and SuSE. It is critical that you update all vulnerable
packages to reduce the risk of being compromised. Many of the
vulnerabilites described are root compromises.  Also, if you are running
bind/named, make sure that you upgrade so you are not vulnerable to DoS
attacks.

http://www.linuxsecurity.com/articles/forums_article-1952.html

Webmasters, our advisory and news feed is now available in RDF
format. We invite you to use and customize our feed to provide
up-to-date security content on your website.

http://www.linuxsecurity.com/linuxsecurity_articles.rdf
http://www.linuxsecurity.com/linuxsecurity_advisories.rdf


=====================================================================
** FREE Apache SSL Guide from Thawte **
Planning Web Server Security? Find out how to implement SSL! Get the
free Thawte Apache SSL Guide and find the answers to all your Apache
SSL security issues and more at:
http://www.thawte.com/ucgi/gothawte.cgi?a=n055017540018000
=====================================================================


HTML Version available:
http://www.linuxsecurity.com/newsletter.html



+---------------------+
| Host Security News: | <<-----[ Articles This Week ]-----------------+
+---------------------+


* Python: Security Aspects
November 16th, 2000

Python is a versatile programming language with many applications in
the Web environment. BYTE magazine comments that it is "a bridge
between Unix shell programming and C programming. That is, Python is
ideal for projects that are too complex for the normal shell tools to
handle, but not so complex that they are worth writing in C or C++."

http://www.linuxsecurity.com/articles/host_security_article-1947.html


* Where the Log Files Live
November 14th, 2000

In today's article, I'd like to tie together some of the concepts
we've learned so far from the previous articles in the series. Let's
apply our newfound skills to see what we can find out about FreeBSD
and system logs.

http://www.linuxsecurity.com/articles/host_security_article-1933.html


* Hackers' Tricks to Avoid Detection
November 14th, 2000

Hackers are not only clever in how they invade servers; they are also
devious in how they disguise their attacks. Malicious attackers use
a variety of evasive techniques,  which we will examine in this
column so that we, as administrators, can be better  prepared to
detect and respond to them.

http://www.linuxsecurity.com/articles/hackscracks_article-1938.html


* How Companies Can Enhance Web Security
November 14th, 2000

With the peak online holiday buying  season just around the corner,
Internet security experts  are urging U.S. companies to enhance their
security  posture in light of recent threats made by hacker groups
in the Middle East to launch an electronic holy war  against
companies with ties to Israel.

http://www.linuxsecurity.com/articles/server_security_article-1935.html


* SSL In The Driver's Seat
November 13th, 2000

E-commerce is driving the Internet  economy; e-commerce wouldn't be
driving  anything if users didn't purchase items  online; overcoming
users fears while  shopping online has been the major hurdle  in
growing e-commerce; a single Internet  protocol has almost single
handedly  increased e-commerce by making secured  transactions
possible. Introducing SSL

http://www.linuxsecurity.com/articles/cryptography_article-1925.html


+------------------------+
| Network Security News: |
+------------------------+

* Building Linux and OpenBSD Firewalls
November 18th, 2000

Just because your paranoid does not mean they are not really after
you. It is an old saying but one that applies  equally well to
network security, just because you have not been attacked does not
mean someone is not trying.  The subject of firewalls used to be the
domain of network security administrators running large networks
connected to the Internet.

http://www.linuxsecurity.com/articles/documentation_article-1963.html


* Paranoia Vs. Transparency And Their Effects On Internet Security
November 16th, 2000

Lately, reactions to non-intrusive probes and network activity that
is merely unexpected are becoming increasingly hostile; a result from
increasing amounts of incidents and security threats. From my
perspective of security, overreactions to activities not crossing
authorization and legal boundaries, are leading to a scenario where
anyone acquiring basic information about a system needs to be afraid
about potential consequences.

http://www.linuxsecurity.com/articles/network_security_article-1948.html


* The ABCs of IDSs (Intrusion Detection Systems)
November 14th, 2000

The basic function of an IDS is to record signs of intruders at work
inside and to  give alerts. Depending on the product, how it is
deployed and its network  configuration, an IDS may only scan for
attacks coming from outside one's  network or it may also monitor
activities inside the network.

http://www.linuxsecurity.com/articles/intrusion_detection_article-1932.html




+------------------------+
|   Cryptography News:   |
+------------------------+

* Will the Future Be Anonymous?
November 17th, 2000

The work of  David  Chaum and  Stefan  Brands on  protocols,  such as
blind signatures, that provide anonymity  has attracted a great deal
of interest among  people interested in cryptography.  In the RSA
algorithm, given a public key consisting  of an encryption exponent,
e, and a modulus M,  and a private key consisting of the decryption
exponent d:

http://www.linuxsecurity.com/articles/cryptography_article-1955.html


* Encryption system for govt bosses
November 15th, 2000

Top bureaucrats will be able to swap classified material on the Net
with the launch this week of a "Secure Electronic Environment"
linking Treasury, the State Services Commission and the Department of
Prime Minister and Cabinet.

http://www.linuxsecurity.com/articles/cryptography_article-1941.html


* Crypto-Gram November
November 15th, 2000

Crypto-gram is a free monthly newsletter providing summaries,
analyses, insights, and commentaries on computer security and
cryptography. This month's issue includes topics on digital
certificates, more on Secrets and Lies, the recent Microsoft hacks,
and just how meaningless the SDMI challenge really is. Must read.

http://www.linuxsecurity.com/articles/cryptography_article-1945.html


* US unlocks encryption market
November 14th, 2000

Australia is said to be at least two years behind  the United States
when it comes to the internet, so the two-year communication
blackout  between the US and Australian branches of  encryption
developer RSA Security seems  entirely appropriate.

http://www.linuxsecurity.com/articles/cryptography_article-1940.html




+-------------------------+
| Vendors/Tools/Products: |
+-------------------------+

* Freeware Port Scanners: Plug the Holes
November 17th, 2000

It doesn't take long to figure out the security problem with these
port technologies: If a port lets data flow out, it also lets data
flow in. A port is essentially an opening into your computer, and it
can be hacked. Someone can infect your machine with a Trojan horse in
this way, and that's only one of a host of distressing possibilities.

http://www.linuxsecurity.com/articles/network_security_article-1960.html




+------------------------+
|    General News:       |
+------------------------+

* Questions arise about access to personal data on Web
November 17th, 2000

As more individuals build their own Web sites, some privacy advocates
now question requirements that the site owners disclose their
personal contact information.  Names, e-mail addresses, postal
addresses and telephone numbers for more than 24 million domain names
are stored in databases called Whois. The information is available to
anyone with an Internet connection.  It's like a global phone
directory -- without the option for an unlisted number.

http://www.linuxsecurity.com/articles/privacy_article-1958.html


------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc.                LinuxSecurity.com

     To unsubscribe email newsletter-request () linuxsecurity com
         with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".