Domain: smoothwall.org
Stories and comments across the archive that link to smoothwall.org.
Stories · 7
-
SmoothWall 2.0 Linux-Based Firewall Released
thegraham writes "Despite some earlier server problems, SmoothWall 2.0 has been released this evening - there are also release notes available. SmoothWall is 'a firewall operating system distribution based on Linux, enabling a low-end, possibly otherwise redundant, Intel and compatible PC to become a hardened Internet firewall', and changes from version 1 include: 2.4 kernel, new web interface, improved networking and many bugs corrected through the Beta program." -
SmoothWall 2.0 Linux-Based Firewall Released
thegraham writes "Despite some earlier server problems, SmoothWall 2.0 has been released this evening - there are also release notes available. SmoothWall is 'a firewall operating system distribution based on Linux, enabling a low-end, possibly otherwise redundant, Intel and compatible PC to become a hardened Internet firewall', and changes from version 1 include: 2.4 kernel, new web interface, improved networking and many bugs corrected through the Beta program." -
IPCop 0.1.1 Review
Selanit writes "I just found a link on Distrowatch to a SecurityFocus Review of IP Cop 0.1.1. IP Cop is a fork of the GPL version of the Smoothwall Linux firewall distro, which had a review linked by Slashdot. Though it has a slick, easy install. and good features, a number of people had issues with Smoothwall.. IPCop has implemented shadow passwords to fix the security flaw, and their mission statement includes a provision that they will "Provide an enjoyable environment for the Public to discuss and request assistance." The to-do list of features for the upcoming 0.2 version is also interesting. " -
Slashback: Cheats, Entries, Loki
Slashback tonight brings you updates to previous stories on computer-class cheating, Smoothwall, AIBO hacking, the Open Source Directory, and the fate of Loki's CVS. Read on below for the details! Jon Masters was one of the many to write in after recent articles about automated cheat-detection employed in undergraduate CS classes to catch plagiarists. "Hi, cheat detection is hardly new. For example The University Of Nottingham have developed an automated marking/plagarism detection system as part of their CourseMaster software. Personally I don't agree with automated assessment in general, however plagarism detection can be useful."From the email I've gotten on it, it seems like a whole passel of schools have at least a homegrown solution to CS cheats.
Perhaps the cute dog will end up changing Sony's stance? CodeMonkey555 writes "Here is a story that chronicles Sony's little foray into the DMCA with a hacker who added software for the Aibo robot."
It's nice to see that publications like SciAm are following the results and consequences of the DMCA.
Care to help edit an online software reference? SteveMallett writes "We at Open Source Directory (OSD) have opened the directory to volunteer editors now that we've given app authors and maintainer's a good chance to start and/or maintain their own listings.
Those interested may wish to visit our volunteer page which outlines what we're looking for. Don't worry. We're not that picky. The outline includes guidelines and tips for being a volunteer. Unlike dmoz, which has volunteer editors, we _will_ delete unupdated or neglected editor work in accordance to our Social Contract.
We hope that editors will help fill in the missing apps, take over those listings that they can do a better job of or have become neglected, and find those diamonds in the rough."
See our earlier post about the project if you're not sure what this is about.
Yes, someone has to read all those emails. kcurtis writes "Boston.com's tech site has this AP article about the large response to the Court's request for comment on the MS case's proposed settlement."
Now all they need is a trowel with an emblazoned smiley. enigma48 writes "Looks like the C'T article a little while ago about Smoothwall prompted some changes after all. Juergen Schmidt even gets a little credit. Shadow passwords are now in, but it looks like the ppp secrets file is still open (they describe it as being a "non-vulnerability"). A-patchin' I will go, a-patchin' I will go..."
So you don't have to stop playing your games ... Scott Draeker of Loki has some encouraging words for those who thought the announced (upcoming) closure of Loki would mean the loss of Loki's code and community. Draeker sent word of this a few days ago, but here are more details.
He writes:
"We have prepared tarballs of the public CVS, FAQs, mailing list archives, demos and Loki_Update which will be available for people to host. That's exactly what's going on with icculus.org.
The official repository will be hosted by the SEUL group at MIT. Once that site is set up we'll point the loki domains that direction. They'll also be adding some Loki projects to public CVS which were never completed."
-
Slashback: Cheats, Entries, Loki
Slashback tonight brings you updates to previous stories on computer-class cheating, Smoothwall, AIBO hacking, the Open Source Directory, and the fate of Loki's CVS. Read on below for the details! Jon Masters was one of the many to write in after recent articles about automated cheat-detection employed in undergraduate CS classes to catch plagiarists. "Hi, cheat detection is hardly new. For example The University Of Nottingham have developed an automated marking/plagarism detection system as part of their CourseMaster software. Personally I don't agree with automated assessment in general, however plagarism detection can be useful."From the email I've gotten on it, it seems like a whole passel of schools have at least a homegrown solution to CS cheats.
Perhaps the cute dog will end up changing Sony's stance? CodeMonkey555 writes "Here is a story that chronicles Sony's little foray into the DMCA with a hacker who added software for the Aibo robot."
It's nice to see that publications like SciAm are following the results and consequences of the DMCA.
Care to help edit an online software reference? SteveMallett writes "We at Open Source Directory (OSD) have opened the directory to volunteer editors now that we've given app authors and maintainer's a good chance to start and/or maintain their own listings.
Those interested may wish to visit our volunteer page which outlines what we're looking for. Don't worry. We're not that picky. The outline includes guidelines and tips for being a volunteer. Unlike dmoz, which has volunteer editors, we _will_ delete unupdated or neglected editor work in accordance to our Social Contract.
We hope that editors will help fill in the missing apps, take over those listings that they can do a better job of or have become neglected, and find those diamonds in the rough."
See our earlier post about the project if you're not sure what this is about.
Yes, someone has to read all those emails. kcurtis writes "Boston.com's tech site has this AP article about the large response to the Court's request for comment on the MS case's proposed settlement."
Now all they need is a trowel with an emblazoned smiley. enigma48 writes "Looks like the C'T article a little while ago about Smoothwall prompted some changes after all. Juergen Schmidt even gets a little credit. Shadow passwords are now in, but it looks like the ppp secrets file is still open (they describe it as being a "non-vulnerability"). A-patchin' I will go, a-patchin' I will go..."
So you don't have to stop playing your games ... Scott Draeker of Loki has some encouraging words for those who thought the announced (upcoming) closure of Loki would mean the loss of Loki's code and community. Draeker sent word of this a few days ago, but here are more details.
He writes:
"We have prepared tarballs of the public CVS, FAQs, mailing list archives, demos and Loki_Update which will be available for people to host. That's exactly what's going on with icculus.org.
The official repository will be hosted by the SEUL group at MIT. Once that site is set up we'll point the loki domains that direction. They'll also be adding some Loki projects to public CVS which were never completed."
-
SmoothWall Firewall Review
ray-x sent in a pointer to a review by c't of the Smoothwall firewall product. c't's reviewer described several flaws in the firewall. We asked Smoothwall for their comments on the review, which are posted below.Daniel Goscomb, one of the lead developers of Smoothwall, responds:
In our opinion this article is extremely badly researched and written. Furthermore it shows a lack of knowledge on the author's part.
The main concern he has is that of people being able to log in to the firewall and read configuration files. This point is irrelevant as there is only a single user that can access the shell, root. This also removes the need of shadow password files, if you have access to the machine to get the passwd file, you are already in as root anyhow.
Secondly he complains of plain text passwords for the ppp passwords. This is not our doing. The passwords are stored in this format as pppd requires them to be in plain text in the two files. He also mentions that the permissions of these files are wrong. If he looked a little more closely he would have seen that they are in fact symlinks to the 2 real files, which do have the proper permissions on them.
He also mentions the same "problem" with the shared keys system in FreeSWAN. Again, they are stored like this as FreeSWAN requires them in this format to read them.
As to the part about user authentification of the CGI scripts. This is completely irrelevant. There is no authentication in the CGI scripts. The authentication is done via .htaccess files, and has no interaction with the CGI at all, other than when you change the passwords.
I also find it disturbing that the author gave us no room for comment in his article, nor did i see anything to suggest he had even asked us about these so called "problems". We would have been happy to answer any questions he had.
Sincerely,
Daniel Goscomb.
-
Vulnerability In SSH1
matt666 writes "Bindview released an advisory yesterday warning us that "[a]n integer-overflow problem is present in common code of recent ssh daemons, deattack.c, which was developed by CORE SDI to protect against cryptographic attacks on SSH protocol. [...] This effectively allows an attacker to overwrite arbitrary portions of memory". Practically all common versions of SSH1 are affected, except OpenSSH 2.3.0." A whole slew of people have written in regarding this - from the folks at SmoothWall advising of an update, to a bunch of people just saying "Oh No!". My understanding is that a fix is already in the works.