From owner-freebsd-security Mon Apr 24 11:50:23 2000 Delivered-To: freebsd-security@freebsd.org Received: from bsdie.rwsystems.net (bsdie.rwsystems.net [209.197.223.2]) by hub.freebsd.org (Postfix) with ESMTP id 537DC37BB46 for ; Mon, 24 Apr 2000 11:50:20 -0700 (PDT) (envelope-from jwyatt@rwsystems.net) Received: from bsdie.rwsystems.net([209.197.223.2]) (1959 bytes) by bsdie.rwsystems.net via sendmail with P:esmtp/R:bind_hosts/T:inet_zone_bind_smtp (sender: ) id for ; Mon, 24 Apr 2000 13:44:42 -0500 (CDT) (Smail-3.2.0.106 1999-Mar-31 #1 built 1999-Aug-7) Date: Mon, 24 Apr 2000 13:44:41 -0500 (CDT) From: James Wyatt To: Cy Schubert - ITSD Open Systems Group Cc: Alex Michlin , freebsd-security@FreeBSD.ORG Subject: Re: egd vs /dev/random on FBSD In-Reply-To: <200004241509.IAA13292@cwsys.cwsent.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, 24 Apr 2000, Cy Schubert - ITSD Open Systems Group wrote: > In message e.com>, Alex Michlin writes: > > How can a hacker enable promiscious mode though an ftp connection? > > I did a `last` to see who, if anyone, logged on and the only logon I saw > > was an ftp connection from an @home machine. I don't see any extra > > programs running on the machine. Do I need to be concerned about telnet > > passwords, etc? > > > > Apr 20 13:10:12 hostname /kernel: xl0: promiscuous mode enabled > > Are you sure it's a hacker? Do these "events" coincide with other > events, e.g. system boot, an application starting, etc.? For example, > we use an application called egd (entropy gathering daemon) on our > servers on our raised floors, which puts the interfaces into > promiscuous mode, among other entropy gathering things done, just after > boot to initially set up its entropy pool. Therefore I can directly > correlate promiscuous mode with system boot. I thought that /dev/random was good enough on FreeBSD, given a reasonably busy IRQ (no problem around here!). I have to run egd on an AIX box to get a reasonable amount of entropy - and still can't get GPG to compile quite right on it... - Jy@ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message