Slashdot Mirror
Missing Open Source Security Tools?
Kinetic writes "There are many great open source security tools out there, Nmap, Nessus, and DSniff, just to name a few. However, with the world of security constantly changing, this begs the question, what open source security tools are missing? What commercial security tools have no viable open source alternatives? When securing/testing/exploring networks (home or enterprise), what security tools/applications/functionality are lacking (or non-existent) in the open source world?"
I've yet to find an open source tool that can show a "matrix" graph of source and destination talkers by MAC/IP/IPX name in realtime as found in Sniffer. Other tools show some of this information, but do not render the same graphical display (chords of a circle) as Sniffer.
With ethereal there's to do this with snapshots using graphviz, but not realtime...
I do not deploy Linux. Ever.
If you are looking for a proven open standard methodology for performing security tests, then Open Source Security Testing Methodology Manual (OSSTMM) is the way to go.
In addition, there is the linux distro of Trinux, which includes most of the common linux open source security auditing tools.
LainTheWired = isgod( int Lain, int denial, float truth)
knoppix-std
Most every security tool a network admin (or script kiddie) could want in a convenient iso package.
Outside of a dog, a book is man's best friend. Inside a dog it's too dark to read. - Groucho Marx
Duh.
Dude, you should see clamav, a full opensource antivirus for Linux, FreeBSD and even Windows, which integrates nicely with virtually every mailer out there.
He is the Path, the Truth and the Life
You can do stuff like tcpdump -i xl0 src 10.0.0.1 and dst 10.0.0.2 and stuff like that.
Does what you're describing.
There are also a lot of integrity checkings tools, that if well don't count as "antivirus", at least they report changes that could mean something nasty running, and not to forget things like chkrootkit.
have you tried portsentry?
Um no. Ethereal was running about 1 remote-shell vuln a week for a long time. Snort has had a couple too. I guess you could argue that they're all fixed now, but you certainly can't be sure of that.
and don't forget sentinix
http://sentinix.org
defiance
Just in case you're not trolling (which I give about a 5% chance): you might try following the explanatory link.
"A great democracy must be progressive or it will soon cease to be a great democracy." --Theodore Roosevelt
Description: grep for network traffic ngrep strives to provide most of GNU grep's common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular expressions to match against data payloads of packets. It currently recognizes TCP, UDP and ICMP across Ethernet, PPP, SLIP and null interfaces, and understands bpf filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
I am unaware of open source software that meets the functionality of PWSEX or LC5.
Try installing snort and use ACID with it.
I have found this shows the infomation that you are looking for.
The above statement begs the question: "...what open source security tools are missing?"
No, it doesn't.
The truth of that statement does not depend on the fact that some open source tools missing. Therefore it is not an example of "question begging" (taking for granted exactly what you are trying to prove) at all.
find already does most of what you're looking for:
/var/www if that's where you want to look). If you run it as root (probably required for what you want to do), you can use -user or -uid to find all of the files owned by a particular user name or UID.
find . -perm u=xrw,g=xrw,o=xrw -print
finds all mode 777 files under the current directory (the initial ".", substitute a path like
Play with the -perm or +perm flags if need be to refine the result.
They that can give up essential liberty to obtain a little temporary safety deserve neither safety nor liberty.
Ben
sudo is probably the weakest link in all your setuid binaries. It has the newest code and he adds silly things to it.
Did sudo really need a customizable password prompt that led to a heap overflow?
ah, now some programmers, they get it.
Isn't that exactly what SELinux folks are trying to do. If they finish their policy based X server I think we might see a significant leap in desktop security. The basic idea is very simple: Applications should have access only to the data that belongs to them and only some "special" apps have access to other. ;)
FC2 with selinux on was a disaster for desktop mode though but as a server It's a really good idea. It's like chrooting all of Your services
That would be driftnet - it displays images in a window, and the site mentions that there is a screensaver derived from it.
I run it every now and again when I'm bored on the proxy server I maintain. Fun to see random imagees mixed together..
Ahhhh well there is a little thing called Prelude HyIDS. It has been narounnd since 1998 and has been mentioned on here: http://developers.slashdot.org/article.pl?sid=04/0 4/26/2133207&mode=thread&tid=126&tid=172&tid=1 85
Might be what you are looking for. . .
Not completely what you're asking for, but you might take a look at fwbuilder ( www.fwbuilder.org ). Not exactly plug and play, but at least it's drag and drop...
F-prot has a free version for Linux, BSD, and Solaris single-user workstations, which works very well and can be easily regularly updated via cron. You can find it here;
http://www.f-prot.com/download/home_user/
A more appropriate tool might be linux-vserver, which lets you assign each virtual server its own disk quota, process space and IP addresses.
I dont know what I should find most worrying:
- the darpa fantasy land
- or using (what appears like) racism to argue for it?
SSH uses an algorithm called RSA to protect the keys used for encrypting data. Each party has a private key and a public key (a key pair). Anyone can get the public keys.
If data is encrypted with a private key, it can only be decrypted using the public key from the same key pair. Likewise if it is encrypted with the public key, it can only be decrypted with the matching private key.
if A wants to send data to B, it first is encrypted with B's public key, then with A's private key.
B uses A's public key to decrypt it (guaranteeing it is from A) and then uses its own private key to decrypt it back to the original message.
Because it's a slow and complex process RSA is usually only used to exchange and agree on keys for a normal symetric encryption method (eg 3DES).
Read more here
Rob :)