Letters to the Editor
In the article “Designing and Using DMZ Networks ...” [March 2001] Mick Bauer covered ways of securing DMZ hosts. In my opinion he missed a simple but very efficient tool to detect intruders at DMZ hosts or firewalls: Tripwire. It calculates checksums for all files on the system and stores these fingerprints in a database. Doing a compare run against this database in regular intervals (cron), it is easy to detect changes. If somebody modified /bin/login, /etc/passwd or installed other back doors, you will realize it at least after the next compare run. The key is to store Tripwire itself and the initial database on read-only media (e.g., CD-ROM) to prevent modifications. There is no way in doing the same with diff, as mentioned in the article.
Tripwire is commercial software now, but there is a GNU GPL edition for Linux available at www.tripwire.org and www.tripwire.com/. There is another GPL'd software dealing with the same subject, but I never tried it. It is at www.cs.tut.fi/~rammer/aide.html.
Another issue is the design of the DMZ shown in Figure 2. I wouldn't recommend having all hosts in a single DMZ. If you are using three different boxes for doing the job, you should use three DMZs as well . If one of the machines is compromised by an intruder, he has to cross the firewall again to attack the others. So fill up your firewall with additional NICs and use crossed cables—you won't need a switch either.
I enjoyed Robin Rowes' article, “Debian Multiboot Installation” LJ, March 2001, but have a couple of points to make about it. In the part about running rawrite2.exe, it is implied that you can't run this program from a FAT32 partition. This is wrong; the versions of DOS that come with Win98 (and Win95 OSR2) know about FAT32 (but not long filenames); otherwise, they wouldn't be able to boot Windows from a FAT32 partition either. Perhaps the author had FIPS (the DOS repartitioning tool) in mind at the time, the original versions of which cannot handle FAT32.
A discussion of the problems with WindowsME would have been useful. This is basically Windows98 with a flashier GUI and other useless features, except Microsoft tried as hard as possible to stop you from running its DOS in “real” (16-bit) mode, mainly by nobbling the FORMAT and SYS commands and removing the options for starting or restarting in DOS mode.
To boot to DOS in WindowsME, create a startup floppy from Control Panel --> Add/Remove Programs --> Startup Disk. If you reboot the PC from this floppy and select the Minimal Boot option, you will end up at a DOS prompt from which you can change to drive C: and run the rawrite2.exe program as instructed in the article. Alternatively, you could get your own back on Microsoft by nobbling the startup floppy to get CD support and a DOS prompt without any of that Windows recovery malarkey. (The easiest way is just to rename the AUTOEXEC.BAT file.)
Also, a lot of the pathnames in the article use forwardslashes instead of backslashes.
Rowe replies: You are correct that covering WinME would have been nice. The only reason I didn't was I don't have a copy and didn't want to buy one. Thanks for the nice notes on how to use it. Another interesting approach that I haven't tried is using WinImage to create the Debian floppies. I think you are right about being able to see a FAT32 partition when booting from a newer DOS. I haven't tried that in a long time, since I generally prefer FAT16 or NTFS partitions. I should have created a FAT32 partition to test that, but was in a rush to complete the article and didn't. Thanks for the correction. I've never used FIPS. Forwardslashes are correct in UNIX or Windows, although Windows persists in defaulting to backslashes. Using forwardslashes everywhere is a habit I picked up in writing portable code. Unfortunately, that only works with UNIX and Windows. The Mac doesn't like slashes (forward or back). Darwin will, I hope, change that. If you go to the file search box in Win2k, for instance, and use forwardslashes, that works fine. The one place it won't accept forwardslashes is at the DOS command prompt.
|Dynamic DNS—an Object Lesson in Problem Solving||May 21, 2013|
|Using Salt Stack and Vagrant for Drupal Development||May 20, 2013|
|Making Linux and Android Get Along (It's Not as Hard as It Sounds)||May 16, 2013|
|Drupal Is a Framework: Why Everyone Needs to Understand This||May 15, 2013|
|Home, My Backup Data Center||May 13, 2013|
|Non-Linux FOSS: Seashore||May 10, 2013|
- RSS Feeds
- Making Linux and Android Get Along (It's Not as Hard as It Sounds)
- Using Salt Stack and Vagrant for Drupal Development
- Dynamic DNS—an Object Lesson in Problem Solving
- New Products
- Validate an E-Mail Address with PHP, the Right Way
- Drupal Is a Framework: Why Everyone Needs to Understand This
- A Topic for Discussion - Open Source Feature-Richness?
- Download the Free Red Hat White Paper "Using an Open Source Framework to Catch the Bad Guy"
- Tech Tip: Really Simple HTTP Server with Python
- Roll your own dynamic dns
3 hours 24 min ago
- Please correct the URL for Salt Stack's web site
6 hours 36 min ago
- Android is Linux -- why no better inter-operation
8 hours 51 min ago
- Connecting Android device to desktop Linux via USB
9 hours 20 min ago
- Find new cell phone and tablet pc
10 hours 18 min ago
11 hours 47 min ago
- Automatically updating Guest Additions
12 hours 55 min ago
- I like your topic on android
13 hours 42 min ago
- This is the easiest tutorial
20 hours 17 min ago
- Ahh, the Koolaid.
1 day 1 hour ago
Enter to Win an Adafruit Pi Cobbler Breakout Kit for Raspberry Pi
It's Raspberry Pi month at Linux Journal. Each week in May, Adafruit will be giving away a Pi-related prize to a lucky, randomly drawn LJ reader. Winners will be announced weekly.
Fill out the fields below to enter to win this week's prize-- a Pi Cobbler Breakout Kit for Raspberry Pi.
Congratulations to our winners so far:
- 5-8-13, Pi Starter Pack: Jack Davis
- 5-15-13, Pi Model B 512MB RAM: Patrick Dunn
- 5-21-13, Prototyping Pi Plate Kit: Philip Kirby
- Next winner announced on 5-27-13!
Free Webinar: Hadoop
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers
Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.
Some of key questions to be discussed are:
- What is the “typical” Hadoop cluster and what should be installed on the different machine types?
- Why should you consider the typical workload patterns when making your hardware decisions?
- Are all microservers created equal for Hadoop deployments?
- How do I plan for expansion if I require more compute, memory, storage or networking?