10 October 2002

Question & Answer Sessions

Who are the security contacts for and

There are several at each place. want's to know why they were not at the security conference he was just at. Most of the other major midwest univerities had people there.

MJO will colloct info and post to the mailing list.

Does anyone know who the the IT person at AATA?

EMV wants to help them with their web presence.

Is Kip Dutch?

If you go back far enough.

In what context did the quote "do not meddle in the affairs of wizards/dragons, for you are crunchy and good with ketchup" originate?


Has anyone played with nstealth?

It does all the abusive web attacks in one package ... a great system stress-testing tool.

$300 digital camera (USB, Mac-friendly, 2Mpix, screen) -- what's the best bargain?

Check eBay -- new cameras are sometimes dumped there.

Woodward Camera or Huron Camera are good places to look at.

Any suggestions for dirt cheap single-board computers?

Check out Arise Computers.

What's the scoop on putting Linux on your Palm?

Google ... Linux ... Palm.

Syncing a Palm on RH7.3 -- how to?

Check out coldsync or J-Pilot.

Is the humongous computer sale (Washtenaw) worth $6?

Not if it's as good as the gun and knife show they had.

Is Becki's space key broken?

Ah ... oops.

Suggestions for solar power systems for a computer? (Have a garage root to work with.)

Expect 50 watts / 4 hours of charging on a decent day.

Jobs? (Got 'em?)

Keep posting new info to the mailing list, if you think it's promising.

Backup primary client of Linux -- must have ATL Jukebox control -- suggestions?

Amanda. Legato is good, but pricey.

Anyone used CyberSoft virus scanning software? (Or T-Scan or V-Scan?)

Not really. Look at Fprot for a possibility.

Bugbear -- any impact?

Lots of scrap paper after it tried to infect a printer. [sigh]

Experience with extreme networks? (Purple switches.)

Not a lot, it seems.

Any comercial companies writting c++ compiler code?

gcc has killed most commercial development.

... end of the universe?

To former SEMiSLUG members (Mimi and Alan) got married recently.


"Niels Provos:  What ever the heck he wants to talk about."

Systrace and its uses in security.

    There are no guaranees ... no real measurements
    Assume every system as some exploitable bugs
    Prevent malicius parties from gaining elevated privileges.
    Layers of different security mechanisms

    Network level:
        Normalizing gateway
    Application level:
        Compiler-based stack protection
        Previlege separation:  OpenSSH
    Operating system level:
        Non-executeable stack or heap
        Application confinement, sandboxing:  Systrace

    Running untrusted or complex applications may cause security compromise
        Evil web pages may cause browser to send or delete files
        Bugs in an irc client can be used to install back doors
    In unix, system calls are the cateway to privileged operations
    A successful system compromise possible only via system calls

    Confinement or sandboxing to restrict the system calls an application may perform

    Goldberg and Wagner's janus.
            Policy difficutle to define

    Systrace offers fine-grained confinement for multiple applications with multiple policies
    Systrace intercepts system calls
        Pernits or denies their execution

    Interactive policy generation
        Quick and easy generation of policy during ...
    Policy is specified iteratively

    Policy config is human readable and editable

    Very simple language

    Intrusion detection.
        Once policy has been generated, any operation not covered policy indicates a security problem
    Automatic Policy Generation
        Records all system calls an application executes and generates policy to cover them
    Automatic policy Enforcement
        Enforces the configured policies
        Denies and logs policy violations to syslog

    Kernal part small and simple:
        Plicies for system calls are deny, permit, or ask
        Information exported via /dev/systrace
    Deny and permit are handled in the kernel.
        Fast path -- no need to ask userland
    Several requests supported (via ioctl)

    If systrace process dies, all monotored processes receive a SIGKILL from the kernel
    Userland handles more complicate policies and ...

    [... and then the slides started moving faster than I could possibly type ...]

    System call aliasing prevents policy duplication by grouping "like"
    systems calls under one alias (e.g. stat, open, read)

    See for more info.

Rumor & Innuendo (No names, please)

[ Return to the SEMiSLUG minutes page ]