Here is a diagram of three servers: What we want to do is create a tunnel with SSH so that 10.50.101.100 can go directly to 10.50.100.72. There is no routing between the networks. The box in between is dual-homed and acting as a security buffer between the 10.50.100 and 10.50.101 networks. After we set up […]
Tunnelling Through a Gateway With SSH
Maximum Number of Sockets and FD_SETSIZE
There is a limit on the number of concurrent socket connections that an application can accept in BSD, Windows, and other operating systems. This is set at compile time, but it can be overridden. Here is a discussion of this limitation by Microsoft, and here is further discussion. One application that is sticking this on […]
Remote Console Server and Web Administration Tool for NT
Two very useful remote administration tools are the Remote Console Server and the Web Administration tool. Both of these tools come on the NT 4.0 Server resource kit CD. To install the Remote Console, go into control panel -> network -> services tab -> add -> remote access service, and point to the ..\..\netadmin\rconsole directory […]
Installing and Using Telnet Service for Windows NT
[Ed. Note: This is a wee bit dated. SSH is widely available for Windows now, and should be used instead of telnet for administration. Still, telnet can be handy for testing. For an updated version of this for Windows 2000, see this article.] We wrote a tip about using IIS and rconsole to remotely manage […]
Windows 2000 Terminal Services/Administration
With Windows 2000 terminal services, it is quite a bit easier to administer your servers remotely. Make sure you have terminal services installed. We chose the option to use terminal services for administration only. On the server side, format a couple of diskettes. Run Start>Programs>Administrative Tools>Terminal Services Client Creator. You will see a screen like […]
Using Rdesktop To Access Windows Terminal Services From A GNU/Linux Client
We usually use VNC to administer our Windows servers from our GNU/Linux workstations. Rdesktop allows you to access Terminal Services natively from GNU/Linux. This is a lot easier than running the Terminal Services client from Vmware like we did in this article. Sheeesh… 🙂 We grabbed version 1.2.0 of rdesktop from here. While you are […]
Fix Slow SSH Login Time
If your login times are really high, it may be that reverse DNS is not working correctly. We have an ISP whose DNS servers sometimes don’t respond to reverse DNS queries. It was a bit of a puzzle because it has worked for a long time. Our hunch is that the recent DOS attacks have […]
IPC$ Security Trick
It is possible to establish a security context with another domain by using the net use command. Syntax: net use \\<server name>\IPC$ /USER:<domain>\<account> Explanation: If you want to manage the Booky domain, with a PDC called Kooky, and you had an administrative account on Booky called bookadmin, you could use: net use \\kooky\IPC$ /USER:BOOKY\bookadmin you […]
TCPDump Lab
We picked up a DEC Alpha Multia cheap at auction a couple years ago. We will use this multia to dump the network traffic that NT creates on boot using TCPDump. The first problem we had was that our Multia is not Y2K compatible. Many of our files ended up with dates of 2019, and […]
NIMDA Scanner
Free NIMDA Scanner checks for known NIMDA worm files (admin.dll, load.exe, readme.exe, etc.), checks your system.ini, and remotely checks “Administrators” group for “Guest” account. Click here to download. [Beware of running free programs that scan for viruses… better look that gift horse in the mouth. 🙂 Ed.]
Nmap Port Scanner
Nmap is a free port scanner you can use to audit your own network and ensure the security of your hosts from outside your firewall as well. It is also entirely likely that your external interfaces are being scanned at this very moment with Nmap, or tools like it. One cool thing about Nmap, is […]
Baseline Security Analyzer
Do check out the Baseline Security Analyzer tool from Microsoft. Just download the MSI package from the page and install it with a shortcut on the Desktop (default). We ran it against a fresh Windows 2000 install with just SP2 installed. Here is a screenshot of the results. We are alerted to many security issues. […]
Quick and Dirty Host Block
If you are being attacked or abused by a particular host, just enter the following command to deny all access to the host: /sbin/route add -host <ip address> reject Replace with the IP address of the host you want to block. The address will stay blocked until you bounce the interface. Alternatively, you could allow […]
Virus Test File
Check out the European Institute for Computer Anti-Virus Research (eicar) Anti-Virus Test File page. EICAR provides test files you can send to your users to determine if their anti-virus software is functioning correctly. We’ve seen this work fine on Trend Micro and Norton Anti-Virus software, but most ant-virus software should correctly detect these files. To […]
A Trojan in Every Port
If you have any kind of intrusion detection set up like Psionic’s PortSentry or a personal firewall, you’ll see attempts to connect on ports you may not be familiar with. Even looking up the port in /etc/services doesn’t tell the whole story. To find all known network services, trojans, worms and exploits associated with a […]
Keylogging
Like anything else, keylogging can be used for good, or for evil. Here is a list of related links, including both hardware and software keyloggers. (Yow!) Regardless of the privacy issues, there are also security issues as well. Some trojans will install keylogger software as part of their kit. There are also keyloggers geared for […]
Block IP Addresses With IPtables
We wrote about blocking particular IP addresses with the route command here. If you are already using iptables, or want to start, a better way is to block particular hosts: iptables -I INPUT -s 25.55.55.55 -j DROP This command will simply drop any packet coming from the address 25.55.55.55. To list the chains: iptables -L […]
Encrypting Files Conventionally With GnuPG
Conventional encryption is where there are no keys involved. This can be done with the -c option on GnuPG. When you use this option you will be asked for a passphrase. To decrypt the file the same passphrase is needed. This is ideal for password lists, where you have the ability to share the passphrase […]
Windows Run At Logon Keys
One key to check on Windows boxen is the Run key. The run key is located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. When a user logs on, the programs specified in the run key also run. Many times a trojan will install itself here. A lesser evil is the hordes of small little apps that like to run some […]
Netcat and Hammurabi
When I was a kid in 1975, my dad brought home a terminal with an accoustical coupler on the top where I could put a standard phone handset in, and communicate with a Microdata minicomputer at his work. [Dick Pick developed the operating system for the Microdata. To make it fast, he programmed it using […]
