Linux Security Week - February 26th 2001

[newsletter-admins () linuxsecurity com]

+---------------------------------------------------------------------+
|  LinuxSecurity.com                         Weekly Newsletter        |
|  February 26th, 2001                       Volume 2, Number 9n      |
|                                                                     |
|  Editorial Team:  Dave Wreski             dave () linuxsecurity com    |
|                   Benjamin Thomas         ben () linuxsecurity com     |
+---------------------------------------------------------------------+

Thank you for reading the LinuxSecurity.com weekly security
newsletter. The purpose of this document is to provide our readers
with a quick summary of each week's most relevant Linux security
headlines.

This week, many good papers were released.  You should begin by reading
"Deploying the Squid proxy server on Linux," "Is your web server
running unnecessary software," and "The High Price of a Vulnerability."
This last article is particularly interesting.  The author, Greg Shipley,
states "IT managers can't get upper management to do anything about
security."  Security often comes second hand when it should be a primary
concern. I think it is merely a matter of time before many organizations
see its actual importance.

This week, advisories were released for pgp4pine, vixie-cron, ssh,
CUPS, glibc, bind, and sendmail.  The vendors include Immunix,
NetBSD, Mandrake, Red Hat, SuSE, TurboLinux.  It is critical that you
update all vulnerable packages.

http://www.linuxsecurity.com/articles/forums_article-2561.html

# FREE SECURITY BOOKS #
Guardian Digital has just announced an offer for free 2 free
security books with the purchase of any secure Linux Lockbox.
The Lockbox is an Open Source network server appliance engineered
to be a complete secure e-business solution. It can be used as
a commerce server, web server, DNS, mail, and database server.
Please see Guardian Digital's website for details.

http://www.guardiandigital.com/bookoffer.html


HTML Version available:
http://www.linuxsecurity.com/newsletter.html


+---------------------+
| Host Security News: | <<-----[ Articles This Week ]-----------------+
+---------------------+


* A Little Security in an Insecure World
February 25th, 2001

For my very first article for Canada Computes I reviewed Port Sentry
and I felt it was  worth touching on again since I would consider it
essential for any Linux machine with  an Internet connection,
particularly after reading about the above mentioned 280%  increase
in probes.

http://www.linuxsecurity.com/articles/host_security_article-2572.html


* Deploying the Squid proxy server on Linux
February 22nd, 2001

These servers run the Squid proxy server software; this software is
available under the GNU general public license. In brief, Squid
provides for caching and/or forwarding requests for internet objects
such as the data available via HTTP, FTP and gopher protocols. Web
browsers can then use the local Squid cache server as a proxy HTTP
server, reducing access time as well as bandwidth consumption.

http://www.linuxsecurity.com/articles/server_security_article-2559.html


* Securing your Solaris server
February 22nd, 2001

Systems administrators are often too busy with their day-to-day work
to concern themselves with system security. That means servers may
end up without the latest security patches or fixes, offering easy
ways for attackers to gain entry into their systems.

http://www.linuxsecurity.com/articles/host_security_article-2557.html


* Is your web server running unnecessary software?
February 21st, 2001

It is extremely simple and quick to install a BSD or Linux operating
system with Apache and to start serving webpages. You can usually
just boot from an installer CD, follow a few prompts and have a
working system in less than an hour.

http://www.linuxsecurity.com/articles/host_security_article-2552.html





+------------------------+
| Network Security News: |
+------------------------+

* Time to un-BIND your network!
February 23rd, 2001

System backups are the oft-forgotten step of system security.  This
Linux Journal article discusses using your CD-RW drive to make a
backup of your system.

http://www.linuxsecurity.com/articles/server_security_article-2566.html


* Eliminating IP Address Forgery - 5 Years Old and Going Strong
February 22nd, 2001

Networks dominate today's computing landscape and commercial
technical protection is lagging behind attack technology. As a
result, protection program success depends more on prudent management
decisions than on the selection of technical safeguards.

http://www.linuxsecurity.com/articles/network_security_article-2558.html


* IP Spoofing
February 19th, 2001

A spoofing attack involves forging one's source address. It is the
act of using one machine to impersonate another. Most of the
applications and tools in UNIX rely on the source IP address
authentication. Many developers have used the host based access
controls to secure their networks. Source IP address is a unique
identifier but not a reliable one.

http://www.linuxsecurity.com/articles/network_security_article-2536.html


* The High Price of a Vulnerability
February 19th, 2001

IT  managers and CxOs already understand the value of strong security
 practices, right?    Wrong. Apparently, the message isn't hitting
home. Even with the constant  barrage of security talk spewed by
media and marketers, IT managers can't get upper management to do
anything about security.

http://www.linuxsecurity.com/articles/server_security_article-2537.html


* Configuring a quick-and-dirty router and proxy
February 19th, 2001

Setting up an unsecured router and proxy using IP Masquerading; plus,
contrary to popular belief,  Linux can play nice with PCI modems.
Setting up a router and proxy is a huge subject, but I will give you
the basics and some pointers to get you  started.

http://www.linuxsecurity.com/articles/host_security_article-2538.html




+------------------------+
| Cryptography News:     |
+------------------------+

* Cyberdefense students using PKI
February 22nd, 2001

Students and alumni of the Defense Department's school to train
investigators in  computer crime techniques are using public-key
infrastructure technology to  communicate via a private Web site.

http://www.linuxsecurity.com/articles/cryptography_article-2556.html


* Cryptography in Your Pocket
February 21st, 2001

Palm-size organizers are essentially small computers--and now, you
can  encrypt your Palm Pilot data to protect it from prying eyes. But
there is a big advantage that personal organizers have when used for
encryption.   Unlike even a laptop, it is practical to carry your
personal organizer with you wherever  you go, never letting it out of
your sight.

http://www.linuxsecurity.com/articles/cryptography_article-2555.html




+------------------------+
| General News:          |
+------------------------+

* Security Best Practices Articles and White Papers
February 20th, 2001

Allaire is pleased to present 7 new documents in our Allaire Security
White Paper  Series. Among these documents, you can find Procedure
recommendation documents, and step-by-step walkthroughs of common
default configurations for  major platforms and web servers and how
to lock them down securely.

http://www.linuxsecurity.com/articles/documentation_article-2543.html


* Net anonymity firms seek their market
February 21st, 2001

As an Internet user and online shopper, you may have more in common
with your friendly neighborhood spook at the CIA than you think -
both you and the agents who look out for your national security are
concerned about remaining anonymous online.

http://www.linuxsecurity.com/articles/privacy_article-2551.html


------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc.                LinuxSecurity.com

     To unsubscribe email newsletter-request () linuxsecurity com
         with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".