A truly great performance

... by not only Robert Spotswood but our happy colleagues from the Czech Republic and the Russian Federation was experienced by all at Saturday's meeting. I brought a pre-virused XP machine (infected basically by turning off all protection and heading for any address with .cz or .ru on the end) and technician Spotswood proceeded to examine it via a novel method I'd never seen demonstrated. As opposed to my earlier descriptions of the method (I didn't quite understand it), he indeed brought Linux into the picture but not via a second machine. He booted a Linux live CD (Knoppix? Mepis? I've forgotten) on the stricken machine and then used it to bring in (from a USB thumb drive) an application called Clam Antivirus. Clam is an open-source AV product maintained at http://www.clamav.org (we used the Linux version in this case, although I hear there's a somewhat limited Windows version as well).

Robert's writeup (current version) is located on his page:
http://www.spotswood-computer.net/
- and just scroll to the bottom and click on the title "Cleaning Windows With ClamAV"; it's PDF only last time I was there but HTML may be on the way.

Bottom line: assuming that your Windows machine is still OK hardware-wise, booting from the CD and using the antivirus app on the USB drive provides a protected point from which to first observe and control the internal drive (location of infections) and then from which to run the definitions comparison. Remember that this process indeed depends upon a definitions file (shit list of filenames or descriptions), so if somebody paid somebody to write a custom day-zero attack, this method wouldn't see it. It would, however, see common rootkits and malapps on which such an attack could depend.

Coming up next meeting (second Saturday of April) will be Robert Carlile's show that I've dubbed "A Trip Down Memory Lane", which exhumes various lost programs that still work today, either in Nix environments or something virtualized (he has a faster computer than me so he can do such things...)

Coming up for this Saturday, March 22nd!

Our HLUG program for this Saturday will involve the Return of Robert Spotswood, and he'll speak on a trick you may find useful if you have some sort of system administrator job. Suppose - JUST SUPPOSE - that a Microsoft Windows network develops a virus problem (actually, you could assume a Mac or even Linux or anything else network in theory here). Robert has a Linux machine set up to go out onto a network and delete all sorts of bad guys, and is pretty well locked down itself so as to be as attack-resistant as possible. The demonstration will be set up for this Linux machine to clean up a stricken Windows computer (the probable industry predicament), and right before our eyes. It'll be my job to bring the stricken Windows machine, and we'll see if I can properly virus one without sending it all the way to Davy Jones' Locker.

Also new this week: the opening feature we're calling "Favorite Flag", which will be presented by a different presenter than the main presenter. Since every Nix-world command has 26-ish potential "flags" or alterations to its functional behavior, we should have an almost infinite supply of new things to learn about a command every time we have a Saturday Presentation. Flag to be announced, and probably assigned to somebody at the Wednesday meet.

Foolishness Or Insanity? You Be The Judge

(This post was suggested by issues raised in the previous post...)
Offhand, I think I run the following distro's/OS's:

Windows XP
Windows 2000
Windows Server 2003
Windows 98
Mac OS 8.6
Mac OS 9.0
Mac OS 9.1
Mac OS 10.4.x
OpenSUSE Linux
LinuxMint Linux
CentOS Linux
FreeBSD Unix
NetBSD Unix

I have many more OS's, but all of the above are actually installed on hardware, about 90% of which works.

I think I've disabled comments on this post. At least I hope so.

HLUG happenings

Long time no post!! Well, the last two meetings that happened with HLUG concerned Robert Carlile's XML adventures, then Robert Spotswood's description of the GIMP (both the newest release changes and that image manipulation program in general). This last meeting (Saturday March 8th, was it?) featured myself with a lightly-prepared investigation of the LDAP - PAM relationship, plus a question/answer session widely reported to have been better than the presentation, particularly since the old reliable question came up from someone "What's your favorite OS?". My attempt not to answer forced me to expand on that attitude with an attempt to list every single OS I currently run at home. I gave up at 10 (it's actually 12, I later determined). My rationale for this situation was that all OS's do something well for some constituency, explaining their continuance in a competitive marketplace, plus it's good for an admin to be prepared for whatever they break and then ask you to fix. Carlile thinks I'm insane and that I should concentrate on fewer systems. Debate continues.

The LDAP-PAM subject is basically a can of worms. If you wish to use Pluggable Authentication Modules in a context of the Lightweight Directory Access Protocol, not only do you need general knowledge of the history and nature of these matters, but you need documentation regarding exactly how these matters are implemented. For example, I found good instructions as to how to set things up for Red Hat in the McGraw-Hill test study manual for the RHCE certification. If you want to use LDAP in your distro (Linux Distribution) and it's not in there, the easiest solution would be to get an updated or otherwise different distro that has it/uses it. In broad terms, PAM is a modular way to set up the login/password routine for a Nix OS (other than what's provided at default), and LDAP is one approach to setting up a network-enabled password database. Specifically (according to the Sun website), the precursor DAP was set up in Solaris 2.6 in the mid-1990's and then, as TCP/IP began to show up everywhere, the "lightweight" version appeared, which presumed the presence of TCP/IP, thus not having to bring such specific code into the situation.

The best resources about LDAP and your favorite login arrangement would probably be the stuff at http://www.openldap.org and then the .org that maintains your distro.

Site Design Issue

(also posted at hlug.org)

I haven't talked with previous presidents about this, but I actually like the fact that this site (hlug.org as well as this blog) does not operate as a forum (anymore...)

I've often remarked that not having forum (discussion) capability keeps down spam and bad feelings about flame wars, but there's another reason, and bigger. The material that would normally go to online boards were they available, in this situation must take place at the meetings. Bad punctuation, but you understand.

Users' groups have been in decline for ten years. Restricting most of our activity from the net, from IRC and from any other remote methods requires the interested individual to show up, and that improves our attendance, as well as Hal-PC numbers. Some theorize that the internet is killing users' groups due to the convenience of getting information remotely rather than in person. It's certainly cited as hurting technical print media in the case of the recently departed SYSADMIN Magazine.

So regardless of the condition of this site, my blog, the twiki, or anybody else's pages, I'm in favor of continuing the blackout on forum activity. Besides, not only do you get more info faster (potentially) in a human conversation, but it's not possible to rummage through our give-away pile over the net. It's also a lot easier to get six people to comment on your machine that you're rebuilding when you drag it into the Wednesday night workshop. Long live the blackout!!

(crossposted with hlug.org)

Yet more info on January and February
-------------------------------------------------------

On my (PJ's) upcoming January 12th Security Topics show, note that I am no expert in the field of computer security but perhaps you can benefit from my recent research in the area, namely regarding three matters:

INSECURE.ORG's current activities and their maintenance of the Nmap scanner
CERT's First Responders Guides to Computer Forensics (both sections)
SECURITY + ("plus") certification and one or two problems with the current official manual

And after that, Jan. 26th is a large general meeting that will take up our regular meeting space. So the above's a formative agenda for the Jan. 12th meeting.

Moving right along, last time I did an in-meeting survey of what future topics people were interested in, the list looked like this:

DenyHosts
TCP Wrappers
Routing Protocols and OSPF RIP
Gimp 2.4
LDAP and PAM
IP v6

And as January is mapped out but February is approaching, Robert Spotswood will be the next person I start pestering (due to his known familiarity with the new Gimp version) as well as former president Aaron Estrada for a presentation on a subject dealing with Linux in audio/video (which is something he actually does weekly if not daily on the job). Such a presentation was scheduled not long ago but cancelled due to interference by inclement weather, stock market fluctuations and the Loch Ness monster.

P.S. - great December show with Steve on the Linux STANDARD Base, not "standards" as I'd earlier blundered. This set of rules is maintained in several places:

http://www.linux-foundation.org
http://www.opengroup.org
http://www.linuxbase.org

- and incorporates the earlier mentioned Filesystem Hierarchy Standard.

"Welcome back; your dreams were your ticket out..."

Long time no post! OK, here's the even REALER real schedule:

Dec. 8th - Steve Mussachia on the Linux Standards Base
Dec. 22nd - probably Hal-PC closed, so definitely no meeting.
January 12 - Pete Jamison on selected security topics (plus another thingie)
January 26 - Hal-PC general meeting (rather than Linux Presentation only)

Now, here's the longer explanation...

Coming up soonest is Steve's picture of how the Filesystem Hierarchy Standard and other such benchmarks fit into the larger Standards Base, and the current state of affairs with that. Then, the next thing will be me on topics like the tools and stats of insecure.org, oddities in Security+ training, and just for the heck of it, how a recently published article on Ndiswrapper promises to bail me out of that continuing mess.

On Jan. 26th we won't have a normal meeting (more from Rick on that general thing later) but I'll probably be reprising my um, Hard Drive Retirement speech, which involves mass realtime destructive testing before your very eyes. Many general members unconnected with Linux within Hal-PC haven't seen that yet, so expect several 911 calls and general bedlam.

As the great triad of Johnny, Doc and Ed often intoned, "more to come"...