Security: November 2005 Archives

There are some great tools available for Linux. Unfortunately, a lot of people don't use them for a variety of reasons. They don't understand Linux, and there's no standard interface on Linux, except for the über-powerful command line. (I'm still annoyed that most distributions set the default boot to the GUI.)

Nessus is one of those tools. It installs easily from the command line and it has a friendly setup script. Once you complete it, you can start the Nessus server on your Linux box. Someone has even written a friendly Windows client for Nessus, so you can control your scans from Windows.

What's the point? Nessus is a powerful security scanner/vulnerability finder that probably matches most of what's on the market. It stores results to a database (or databases), has a diff feature so you can easily track changes over time, and has a great number of options. It has nearly 10,000 plugins to run platform-specific attacks, and it does a good job of OS fingerprinting.

So I continue experimenting with Nessus, of course, on my own systems. I can have a Nessus scan against my firewall open in one window and I can watch my firewall logs in another. (Remote syslog is cool. Who knew that even cheap routers can log to syslog?)

Competing products have sexier interfaces and reports, but they cost a lot more.

I have put my Linux box to good use, installing MRTG and monitoring the bandwidth usage of my router. It turned out to be a little less simple than I thought, and I also bricked my old Linksys router. The Linksys BEFVP41 v.1 had SNMP and access log sending. Its first replacement, the BEFVP41 v.2 has access log sending but no SNMP. Thus I'm up to a Netopia R9100 that was lying around, which has SNMP, but remote syslog for router activity only.

I also bought a nice new Linksys WRT54GS v.3, which I have modded with a couple of different custom firmware developments. So far, the DD-WRT has some stability issues, so I'm still trying to choose.

What I really want is a complete access log that I can check for patterns. I want to be able to see all the traffic hitting my external interface. Do I really have to buy something like a Watchguard X5 to do this?

I also figured out how to do remote syslog after some vexation. There are actually two syslog configuration files, one in /etc and the other in /etc/sysconfig. (The man pages fail to mention the difference...) With the localx config in /etc and the -r option in /etc/sysconfig, my router (Netopia R9100) now logs all firewall violations to /var/log/router.log . Sweet. Now I just need something to parse it, although it's interesting to just keep a tail -f open.

With so many people using the Internet to look for new and better jobs, a new Internet scam has begun. I keep getting emails like this:

Your resume came to us through one of our partners and we would like to set an appointment to meet with you. Albert & Alexander Associates helps direct senior executives and managers to the best jobs in the Washington DC area. We steward our clients careers, maximizing their earning potential and job satisfaction.
If you are interested in learning more, please visit  (link) and complete our assessment. Someone will contact you shortly if we feel we can be of assistance.
Best Regards,
Albert & Alexander Associates

This is different from other, legitimate job emails from comanies and recruiters I would love to work with. These guys are like Bernard Haldane, who have been caught ripping job seekers off with the promise of uncovering the "secret job market." The saddest parts are the misspellings in the subject line: "We recieved your resume" and how the return address ( washingtoncareers@gmail.com ) doesn't work.So Monster-résumé-posters beware, there is a new way for scam artists to find you. What makes this suspicious?

•  There's no specific job listed.


• No pre-screen questions: US citizen, clearance, how much $ you want.


• The "assessment" requires your salary from every job on your résumé.
• Lack of specifics.


• Lack of contactibility of recruiters. The real recruiters I've spoken with are efficient, polite, and quick to respond.


• Return email is a gmail address, even though this outfit has its own domain.