User: deltron

How to check which processes need to be restarted

On: OpenSSL Bug Allows Attackers To Read Memory In 64k Chunks

Once you have upgraded your copy openssl you can determine which processes need to be restarted by running the following command (only tested on Linux):

sudo lsof +c0 |grep DEL |grep libssl |awk '{ print $1 }' |sort |uniq

Note that just because a process is listed here doesn't mean it is vulnerable to the leak, it just means that it is linked to the vulnerable version of libssl.

Re:Highly annoying

On: Rundown on SSH Brute Force Attacks

I use netfilter/iptables with the 'recent' and 'tarpit' modules to block SSH brute force attempts:

$IPTABLES -N SSH_ATTACK
$IPTABLES -A INPUT -i $EXT_IF -p tcp --dport 22 -m state --state NEW -m recent --name SSH --set --rsource -j SSH_ATTACK
$IPTABLES -A SSH_ATTACK -s $TRUSTED_HOST -j RETURN
$IPTABLES -A SSH_ATTACK -m recent ! --rcheck --seconds 60 --hitcount 3 --name SSH --rsource -j RETURN
$IPTABLES -A SSH_ATTACK -j LOG --log-level $LOGLEVEL --log-prefix "SSH Brute Force Attempt: "
$IPTABLES -A SSH_ATTACK -p tcp -j TARPIT

More info is available in this message on the Netfilter mailing list.

If possible, use the 'TARPIT' module because it significantly slows down the automated scanners that are being used to perpetrate these attacks.

Re:Knoppix Anti-Virus?

On: Windows Incident Forensics with Knoppix Helix

A piece of software which fulfils the requirements listed in the parent post, as well as enabling you to perform many other useful functions is available and has been for some time.
It is essentially a Windows version of Knoppix, i.e. a Windows boot cd, and is named Bart's Preinstalled Environment (BartPE) after the creator Bart (really?!) Lagerweij.
The software enables you to create a bootable cd from a Windows XP/Server 2003 setup disk. A very simple module functionality has been implemented, so that hundreds of third party modules are now available covering a huge scope of useful (and not so useful) programs including Ad-Aware and several anti-virus programs.

As the homepage so rightly says "being an Admin is hard enough...", and I can say from experience that this does make clearing up infected Windows computers a whole lot easier and safer. Especially with the prevalence of particularly evil spyware and viruses which are almost impossible to remove while the host system is actually running.

Just my £0.02...