KCLUG

8 participants
3271 discussions

Fw: Nessus closes source => How to help open source projects
by JARiley＠dstsystems.com 06 Oct '05

06 Oct '05

Fyodor <fyodor(a)insecure.org> Sent by: nmap-hackers-bounces(a)insecure.org 10/05/2005 04:43 PM To nmap-hackers(a)insecure.org cc Subject Nessus closes source => How to help open source projects Nmap Hackers, In the last Insecure.Org Security Tools survey, you guys proudly voted Nessus #1. It complements the functionality of Nmap by going further to detect application-level vulnerabilities. Then in February of this year, Tenable changed the Nessus license to further restrict the plugins and require that you fax them a permission request form before you use Nessus for any consulting engagements. Renaud wrote to this list on Feb 8 (http://seclists.org/lists/nmap-hackers/2005/Jan-Mar/0001.html), explaining that their new slogan ("the open-source vulnerability scanner") was accurate because the engine was still open source. Today, their slogan has changed to "the network vulnerability scanner", and you can probably guess what that means. In the announcement below, Renaud announces that Nessus 3 (due in a couple weeks) will be binary only and forbid redistribution. They say it will be free, for now, if you use the delayed plugin feed. They have also announced that Nessus 3 will be faster and contain various other improvements. They promise to maintain GPL Nessus 2 for a while, but I wouldn't count on that lasting long. I am not taking a position on this move, but I do feel it is worth noting for the many Nessus users on this list. Tenable argues that this move is necessary to further improve Nessus and/or make more money. Perhaps so, but the Nmap Project has no plans to follow suit. Nmap has been GPL since its creation more than 8 years ago and I am happy with that license. When asked why they are making this change, Renaud replied to the Nessus list today that open source hasn't really worked for Nessus because "virtually nobody has ever contributed anything to improve the scanning _engine_ over the last 6 years." This may be the most important and useful point we can take from this change. Open source really is a two-way street. The only way we (open source projects) can seriously compete with projects staffed by dozens or hundreds of paid full time developers is by having hundreds or thousands of volunteers each contributing a little bit part time. So if you are a heavy user of open source software, please think about how you can help out. Here are some ideas: o If you are feeling ambitious, write and distribute your own little program to solve a problem you are having or otherwise makes your life easier. It doesn't have to be anything big or fancy at first. Nmap started out as a little 2,000-line utility published in Phrack magazine. Post your creation to Freshmeat, or to nmap-dev if it relates to Nmap in some way. Hmm, I think there is a current vacuum in the open source vulnerability scanner field :). o Or take a more active coding role for an existing open source project. In the Nmap world, former Google SoC students are developing three promising projects: NmapGUI and UMIT are new GUIs and results viewers for large Nmap scans, and Ncat is a powerful reinterpretation of the venerable Netcat. Working code for all three of these is available if you join the Nmap-dev list (http://cgi.insecure.org/mailman/listinfo/nmap-dev) and I'm sure the respective authors (Ole Morten Grodaas, Adriano Monteiro, and Chris Gibson) would appreciate help, feedback, and testing. o Find a bug in some open source software? Try to reproduce it with the latest version of the software and do some web searching to see if it is already known/fixed. If not, report it with full details about how to reproduce it and the platform and software version of the software you are running. It is even better if you can submit a patch which fixes the problem. o Join the relevant mailing lists for the project and help out new users. Maybe you can write or translate some documentation, such as a tutorial for using the product or a HOWTO for using it to solve a common need. o The Nmap Project does not accept financial donations, but many other projects do. If some little project does exactly what you need and saves you half a day of work or makes it into your regular-usage arsenal of tools, consider kicking the author back $5 or $10. Not only will it help defray costs of the project, but it shows the author that users really appreciate his/her work and thus makes a newer version more likely. Similarly, if you see an ad on the project web site that interests you, click on it and spend a couple minutes checking the product out. o Spread the word! Commercial software houses pay to spread the word about their product in magazines, web sites, TV, conferences, etc. Open source projects such as Nmap can't. So if you find a project useful, don't hesitate to post a link on your web page and mention it (including the URL) on mailing list, newsgroup, and web forum posts. Those are a few ideas, and I'm sure you can think of more based on your experience, expertise, and available resources. Rather than mope over the loss of open source Nessus, we can treat this as a call to action and a reminder not to take valuable open source software such as Ethereal, DSniff, Ettercap, gcc, emacs, apache, OpenBSD, and Linux for granted. Cheers, Fyodor PS: Here is the Nessus announcement: ----- Forwarded message from Renaud Deraison <rderaison(a)tenablesecurity.com> ----- Date: Wed, 5 Oct 2005 12:16:45 -0400 X-Mailer: Apple Mail (2.734) From: Renaud Deraison <rderaison(a)tenablesecurity.com> To: nessus(a)list.nessus.org, nessus-announce(a)list.nessus.org Cc: Subject: [Nessus-announce] Nessus Roadmap / Nessus 3.0.0rc1 testers wanted Hi everyone, We are a few weeks away from releasing Nessus 3.0.0, and I'd like to take some time to explain our roadmap in this regard. Nessus 3 / Nessus 2 Roadmap ---------------------------- Nessus 3 is major enhancement of the key components of the Nessus engine - the NASL3 intepreter has been rewritten from scratch, the process management has changed to reduce the overhead of executing a plugin (instead of creating NxM processes, nessusd now only creates N processes), the way plugins are stored has been improved to reduce disk usage, etc... Nessus 3 also contains a lot of built-in features and checks to debug crashes and mis-behaving plugins more easily, and to catch inconsistencies early. As a result, Nessus 3 is much faster than Nessus 2 and less resource intensive. Your mileage may vary, but when scanning a local network, Nessus 3 is on average twice as fast as Nessus 2, with spikes going as high as 5 times faster when scanning desktop windows systems. Nessus 3 will be available free of charge, including on the Windows platform, but will not be released under the GPL. Nessus 3 will be available for many platforms, but do understand that we won't be able to support every distribution / operating system available. I also understand that some free software advocates won't want to use a binary-only Nessus 3. This is why Nessus 2 will continue to be maintained and will stay under the GPL. To make things simple : - Nessus 2 : GPL, will have regular releases containing bug fixes - Nessus 3 : free of charge, contains major improvements The two versions can share most of their plugins -- we intend to maintain backward compatibility whenever possible for most vulnerability checks. Some checks will only work on Nessus 3 (ie: we are about to release a set of plugins to determine policy compliance), but the huge majority will work on either platform likewise. Finally, the Nessus GUI has been split in a separate project (NessusClient) which is released under the GPL. The 'nessus' client in Nessus3 is CLI only, as it will be in Nessus 2.4.x. For a GUI, use NessusClient. Testers needed --------------- That being said, we are looking for experienced Nessus users who would want to try Nessus 3.0.0rc1. For the sake of simplicity, we would like users running on Red Hat ES3 or ES4 platforms or compatible. We are looking for people scanning big networks, mostly to collect performance information. Keep in mind that Nessus3 is CLI only, so you'll have to use NessusWX or be familiar with the CLI. If you are interested in testing Nessus 3.0.0rc1, please drop me a line at <deraison(a)nessus.org> (no @gmail/@hotmail/@anonymous accounts please). Thanks, -- Renaud _______________________________________________ Nessus-announce mailing list Nessus-announce(a)list.nessus.org http://mail.nessus.org/mailman/listinfo/nessus-announce ----- End forwarded message ----- _______________________________________________ Sent through the nmap-hackers mailing list http://cgi.insecure.org/mailman/listinfo/nmap-hackers ----------------------------------------- This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.

1 0

Semi-OT: Macintosh networking
by Leo Mauler 03 Oct '05

03 Oct '05

Anyone have any experience networking a PowerMac running OS 8.x and a MacMini running OSX? My brother-in-law needs to connect the two, and somehow connect a PC into the network as well. Been considering adding a fourth computer into the mix, a Linux server box, and using a shared Linux drive to share files between the computers. It would involve sharing a Linux directory as both an HFS share and a SMB share simultaneously. However, getting the Macs networked together is the most important bit. We'd be using an Ethernet switch to connect the two Macs together. Considered a crossover cable and discarded that idea early on. I've found some solutions but cheap and/or free is the order of the day here. The expensive solutions tend to be Ethernet and the cheap solutions tend to be weird (such as connecting the two via null modem cable). __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 5

[Fwd: ITEC speaking opps]
by Chris Bier 03 Oct '05

03 Oct '05

-------- Original Message -------- Subject: ITEC speaking opps Date: Wed, 28 Sep 2005 14:54:10 -0700 From: Jennifer Bell <Jennifer.Bell(a)centricevents.com> To: 'cbier(a)liberty.k12.mo.us' <cbier(a)liberty.k12.mo.us> Hi Chris - We have a couple of open slots in our on-floor theater sessions and the Event Director and I thought that the Linux Group might be interested in presenting in one of those. The times are in the afternoon and are 45 minute sessions. It can be on any topic that you feel appropriate for the audience as long as it isn't specifically about one company or vendor. These are normally paid slots, but we would not charge KCLUG for the session. Let me know if you are interested and I can get all the details for you - and then you have something extra special to promote to your member list! Thanks - Jennifer *Jennifer Bell* Marketing Projects Manager Centric Events Group Direct: 503.596.3632 Fax: 503.596.3680 Jennifer.Bell(a)CentricEvents.com www.goITEC.com

5 9

RE: OT: Mac OSX, Squirrelmail question
by Kelsay, Brian - Kansas City, MO 03 Oct '05

03 Oct '05

Why don't they like to type squirrel? I think they are prejudice against the letter Q. Q needs some love too. ******************************************* If the automobile had followed the same development cycle as the computer, a Rolls-Royce would today cost $100, get a million miles per gallon, and explode once a year, killing everyone inside. - Robert X. Cringely >-----Original Message----- >From: On Behalf Of Chris Bier > > ><snip> > I've found customers don't like typing in the word >squirrel, so I've added aliases called "webmail".

4 3

laptop HD?
by Jack 03 Oct '05

03 Oct '05

Greetings, I am in need of an HD for a older thinkpad. Currently, I have a 4GB in my 380Z, which is getting quite flaky. I managed to bring it up under an "init 1", mount the drives, selectly execute init scripts and transfer important data to a backup, but I'm afraid it may never boot unattended ever again without a replacement HD. Anyone have any they want to get rid of? Thanks, Brian JD

5 4

[Semi-OT] House
by Gene Dascher 01 Oct '05

01 Oct '05

If I'm overstepping my bounds by doing this, I'm sorry. I have been a subscriber to the list (under a different email address) for many years and have attended some meetings, but few people probably know me. My wife and I are going to be putting our house up for sale by owner soon, but I wanted to see if there was anyone on the list who was looking for a house in the KC area. More specifically, it is in Raymore, which is about 10 miles south of the Grandview Triangle on 71 Highway. I am in the process of putting together a web site with all of the information, but I do have PDF documents with that info, as well as average utility bills for the past couple of years, that I can provide to anyone who might be interested. To make this ON TOPIC, every room in the house, with the exception of the bathrooms and laundry room, have been wired for network access. Reply to this email address if you would like to receive more information or have any questions. Again, sorry if anyone is offended by this, but I thought that this would be a good place to start. Thanks, Gene Dascher

3 3

Laptop drive needed
by Kelsay, Brian - Kansas City, MO 01 Oct '05

01 Oct '05

Found one cheap. http://www.krex.com/index.asp?PageAction=VIEWPROD&ProdID=1244 refurb 20GB for $39.99 ******************************************* If the automobile had followed the same development cycle as the computer, a Rolls-Royce would today cost $100, get a million miles per gallon, and explode once a year, killing everyone inside. - Robert X. Cringely

2 1

OT: Mac OSX, Squirrelmail question
by Rob Becker 29 Sep '05

29 Sep '05

We have a mail server for our students that allows them webmail access using Squirrelmail. Our student email addresses are in the form of student(a)students.kcai.edu. We have appropriate DNS records for mail to get to the server, but due to some network constraints, we had to create an additional DNS name for the webmail access. The off campus address for this access is squirrelmail.kcai.edu. When students log in from off campus and send mail through Squirrelmail, their messages appear to be coming from squirrelmail.kcai.edu. For example a message sent from off campus would appear as student(a)squirrelmail.kcai.edu instead of student(a)students.kcai.edu. In the Mail configuration under Server Manager on the OSX server, the server name is specified as students.kcai.edu. Why is the domain portion of their addresses getting rewritten to match the external DNS name that they used to access the Squirrelmail page? Shouldn't the server sent mail from it's configured hostname? If anyone has any advice, resources, tips, tricks or answers, I'd love to hear them. Thanks in advance. Rob

4 3

ITEC eTickets
by Chris Bier 29 Sep '05

29 Sep '05

Hi All, Here is the URL for ITEC eTickets that get you a free conference pass: http://www.goitec.com/live/images/other/TCNKC502.htm Chris

1 0

revisiting VPNs
by hanasaki 26 Sep '05

26 Sep '05

what are folks thoughts on good VPN software with the following needs. Server runs on Linux, preferably both Lin/Win but at least LIN Server has solid win/lin clients opensource can auth against postgres, etc/passwd, ldap, mysql, text/flat files free what is the protocol of choice? L2TP? It would be CISCO VPN client worked with the specific server. thanks.

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG