From owner-freebsd-hackers Fri Apr 11 06:31:12 1997 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.5/8.8.5) id GAA18336 for hackers-outgoing; Fri, 11 Apr 1997 06:31:12 -0700 (PDT) Received: from thelab.hub.org (hal-ns1-20.netcom.ca [207.181.94.84]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id GAA18323; Fri, 11 Apr 1997 06:31:05 -0700 (PDT) Received: from thelab.hub.org (localhost [127.0.0.1]) by thelab.hub.org (8.8.5/8.8.2) with SMTP id KAA05599; Fri, 11 Apr 1997 10:26:27 -0300 (ADT) Date: Fri, 11 Apr 1997 10:26:27 -0300 (ADT) From: The Hermit Hacker To: "Serge A. Babkin" cc: khetan@iafrica.com, security@freebsd.org, hackers@freebsd.org Subject: Re: SATAN under FreeBSD In-Reply-To: <199704111311.TAA06060@hq.icb.chel.su> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-hackers@freebsd.org X-Loop: FreeBSD.org Precedence: bulk On Fri, 11 Apr 1997, Serge A. Babkin wrote: > > > Or just set in the options that the .pl suffix means a HTML file. > > > It worked great for me. The only problem is that I found > > > absolutely no usefulness in SATAN. The "holes" it reported > > > about were so idiotic. > > > > > Any useful resources that I can look through on how to debug > > things? For instance, one of the machines at the office is an old > > Altos machine running 'Sendmail 5.59/Altos-2.0 ready'...I'd like to be > > able to test that one for any holes. > > I awaited a like thing from SATAN too. But almost all it did was analysing > the NFS exports :-( Looking at the work on SATAN, and what it was trying to address, why isn't there a list compiled of 'how to break into an insecure system'? Something that a system adminstrator could sit down and go through, one by one, to test their systems? One of the 'papers' that I've come across through Yahoo is found at: http://www.geocities.com/SiliconValley/Lakes/6866/admin.html which details several different methods of cracking into a system, but its by no means complete, and all of them fail even on that old Altos machine, so, like SATAN, is practically useless. Does anyone else know of something similar? Maybe start up a 'Improving Security' section off of the FreeBSD web pages with links to *good* papers like the above? Marc G. Fournier Systems Administrator @ hub.org primary: scrappy@hub.org secondary: scrappy@{freebsd|postgresql}.org