I continually discover how many simple things that we in tech always tell other people to do... are still undone by us. So yet again, I am spurred to do another 'best practices' post. But this time, the inspiration came from within the ranks of the techies. I will mention no name in connection to any such foolishness exept my own. If we have good advice, we should take it ourselves.
BEST PRACTICES, version 34.09?
Change passwords regularly and keep a secure master list offline.
Don't use the same password for everything.
Don't be needlessly repititious in other areas, like calling a host the same thing as a domain name. That can confuse people as well as systems.
Do backups of all unique data regularly either offline or on an additional disk.
Don't do "secure" work from public sources like schools, libraries, restaurants or coffee shops. If you need to do that, use encryption on an additional computer that's cleaned often.
Run rootkit hunters, antivirus, antimalware, etc. regularly.
Update the operating system and all APPLICATIONS regularly.
If your activities are tied to a particular OS that's dependent on a particular set of hardware, keep important spare parts around.
Don't get rid of your laptop and desktop, attempting to do everything on your phone. It only takes one drop to the concrete, loss/theft or accidental dive into a public toilet to ruin your whole week. Particularly when there were no backups for 6 months.
Be discreet on social media; delete unused accounts.
Keep webmail accounts lean and backed up. Use more secure options when possible - like paid as opposed to free.
Turn off communications capability when not in use. This can include computers, routers, modems, terminal units, repeaters, gaming devices, etc. To leave everything on for two weeks is a prescription for trouble.
Don't click on a link if you don't know where it's going. And never respond to bank emails; call the bank.
Check your own history. Do web searches on yourself, and for old sites, see what archive.org has on you.
Sunday, October 7, 2012
Sunday, September 30, 2012
How to say lots without revealing sensitive details...?
Hmm. Let's see if I can indicate what I'm working on without violating any agreements...
Coming back into an actual, real Unix job after so long, I'm having to review Windows Server 03 and 08... yes, right. And for which there's actually a good rationale. Not only are many customers flying that product (although not as many as CentOS plus RHEL at our shop), but many server problems are conceptually the same. A reboot's a reboot, a password change is a password change, and a brute force annoyance is the same as well in all camps.
And another thing's the same: the support surprise. I found out that we were supporting WinServer 2012 when we went into somebody's new build and saw that our build technician had provisioned it. NOBODY TOLD SUPPORT ABOUT IT. We just kinda found out. One or two other products have recently "appeared" on our plate like that.
But there's all the things that aren't a surprise, and that the average tech should keep up with anyway: DNS, shell, awk, log locations for server OS's and control panel products, plus networking (and internally constructed "custom" networking).
And one surprise is how useful nmap has become. It's almost a whole command family of its own and doesn't any longer have the reputation for instability that it shook during the last decade. It can do much more than find a port; their documentation book is on my buy list.
Monday, August 27, 2012
SOME Customers Say The Darndest Things
So I have a new job at a help desk to be named later. It's good to be back in the swing of things and most customers are actually my teachers in a way, since they know far more about their systems than do I (being tech support on rented systems in a physical sense but not being an admin since I have no idea what they're doing, in an applications/productivity sense).
And not only can they be teachers. Every so often there's that provider of the unexpected request...
"Have you got the log of the file system check?"
I'll give you a minute for that one to sink in.
Actually, I'll give you three weeks.
Friday, December 23, 2011
FOR MINT NEWBIES
I just turned a Windows guy onto Linux Mint and he's having considerable success with it, in spite of being a total novice at Linux. I just came up with a very few things that it might be helpful for a new Linux user to know, regardless of how easy recent distros have made things:
1. Watch the update symbol and do updates every time they're noted in the word balloon notice thingie. Updates are how security holes are controlled in the *nix world, both for the OS and for many applications.
2. Read the manual pages (man command in Terminal) on the commands su and sudo (super user). Some distributions restrict the root account, preferring that you operate as a regular user most of the time. When needed, elevate yourself using su or sudo, then giving the password requested, which will be either the user password or a separate one for 'root'.
3. Use the locate command to do really quick searches in case you lose a file. Remember that it uses a database, which is freshened up (as root) by invoking 'updatedb'.
4. Use apt-get to do fast updates from Terminal. The sequence is
apt-get update
apt-get upgrade
(y for yes to continue or to accept additional required updates)
Of course, the software updater app is there for you as well.
5. If an app, game, utility or other program is present in the distribution's software repository, apt-get is the command to use. It's simply
apt-get install (name of file)
6. Grab an outboard hard drive for backups. Remember that you'll need to reformat it in whatever file system your distro uses; the "format" command is easy to find in the GUI.
7. Speaking of GUI issues, you have choices that outfits like Mac and Windows don't give you. They only have one desktop environment, whereas Linux offers bushels of them. Gnome and KDE are the most common full-featured ones, while there are others like Enlightenment and FluxBox that cater to older and slower systems (requiring less resources to run).
Hope this helps!
1. Watch the update symbol and do updates every time they're noted in the word balloon notice thingie. Updates are how security holes are controlled in the *nix world, both for the OS and for many applications.
2. Read the manual pages (man command in Terminal) on the commands su and sudo (super user). Some distributions restrict the root account, preferring that you operate as a regular user most of the time. When needed, elevate yourself using su or sudo, then giving the password requested, which will be either the user password or a separate one for 'root'.
3. Use the locate command to do really quick searches in case you lose a file. Remember that it uses a database, which is freshened up (as root) by invoking 'updatedb'.
4. Use apt-get to do fast updates from Terminal. The sequence is
apt-get update
apt-get upgrade
(y for yes to continue or to accept additional required updates)
Of course, the software updater app is there for you as well.
5. If an app, game, utility or other program is present in the distribution's software repository, apt-get is the command to use. It's simply
apt-get install (name of file)
6. Grab an outboard hard drive for backups. Remember that you'll need to reformat it in whatever file system your distro uses; the "format" command is easy to find in the GUI.
7. Speaking of GUI issues, you have choices that outfits like Mac and Windows don't give you. They only have one desktop environment, whereas Linux offers bushels of them. Gnome and KDE are the most common full-featured ones, while there are others like Enlightenment and FluxBox that cater to older and slower systems (requiring less resources to run).
Hope this helps!
Thursday, December 1, 2011
HOLY CRAP 2.0
So my buddy gets his computer broken into (not hacked - the attacker wasn't that capable) by someone we'll call The Bad Guy. The Bad Guy got a keystroke logger somewhere and sent it to my buddy as an email attachment, which was opened in Outlook (see alternative app/OS suggestions below). Then the Bad Guy spends the next three or four weeks getting info from the logger, collecting passwords, user names, account names and such. Then the Bad Guy hits my buddy all at once (probably during hours when my buddy was known to be off shift and sleeping). My buddy's websites are trashed, his email accounts are hijacked and deleted, and many subscriptions and memberships were cancelled since the attacker could now pose as the membership-holder.
If we leave out online banking fraud (which apparently has not occurred), this situation would be about as bad as it gets. Let's make a list of everything that the victim now has to do to pick up the pieces of his online presence and certain aspects of his personal life.
0. Obtain a different, non-compromised computer.
1. Set up new personal and business email accounts (probably at a paid provider as opposed to at some free service), then inform important contacts via telephone or web forms on their sites.
2. Set up new Facebook, MySpace, LinkdIn, Classmates.com or whatever pages and rebuild all contacts lists.
3. Find account numbers, financial transaction records or bills that prove my buddy's identity to the website hosting company. Re-establish access to the website and rebuild it from scratch (all files deleted and replaced by garbage).
4. Image the hard drive of the compromised computer for later reference and/or legal action if desired and possible. Wipe the compromised computer and rebuild from backups, from OS/driver CDs/DVDs if such exist, or by paying the computer maker or authorized repair place to do it.
5. Bring back all personally created documents and work from backups if such were done. Bring back all application programs from install CDs if possessed.
My readers know me as a Linux guy and will anticipate certain suggestions of mine, but let me think like a Windows guy for a bit. I'm confident that I can do this, and am motivated to do so since many of my colleagues spend most of their time in that world. Now, if I'm a Windows person, I would still need to change my ways somewhat. Let's see how adaptation is possible. My buddy is like most people in that he's only concerned with the work that he needs a computer to do, not with security issues on the machine itself. That's how the problem starts and here's a proposed new strategy:
1. Use the original desktop or laptop as the general use/everyday/casual computer. Get another computer for important stuff. And consider a third one, properly Frankensteined for gaming (let's be realistic here).
2. On the general use computer (and the other ones if they're Windows boxes) load an antivirus product like Norton, McAfee, free AVG or such. Load an anti-crapware product like Malwarebytes, AdAware or such. Load a third party cleanup program like Window Washer or the free CCleaner.
3. Update and manually run on a minimum weekly basis all of the programs I mentioned above. In many senses these programs are not automatic; they have to be operated by the user. Various automatic settings are sometimes included but when viruses are automatically found, they must then be deleted by user action (usually prompted by instructions that pop up - they're easy - follow them!) Windows Update also prompts you. Do all updates - they're free bugfixes and don't take much time.
4. If any of these antivirus or anti-crapware products find anything, get onto the other (Important Stuff) computer and see if you can still get into your accounts. If so, change the passwords, going down a roster of accounts that you've stashed for just such an emergency. You may not be acting in time unless you only log onto important stuff with the Important Stuff computer.
5. OPTIONAL - If you wish to investigate, keep the compromised computer in its compromised condition to be examined or for the hard drive to be copied (imaged) for future reference.
6. Rebuild the compromised computer from operating system and driver CDs/DVDs that you've archived in advance, either from the computer purchase or some backup scheme like Norton Ghost or a competitor of that product, or one of the Windows open source (free) backup products.
7. Consider making the Important Stuff computer an Apple Macintosh, or loading a box up with an easy Linux system like openSuse or Linux Mint, which is now available for free, fast download at
LINUXMINT.COM
You knew that was coming.
I understand that if you require Windows for work files or development, then you might not have the open source option. But just about anything web-based is child's play for a *NIX box. And the two Linux distributions I mentioned above have good, bright update indicators on their desktops (updates are how most security holes are dealt with in Linux) that'll make you pretty safe. Unless you've pissed off the Defense Intelligence Agency or the Russian mafia.
If we leave out online banking fraud (which apparently has not occurred), this situation would be about as bad as it gets. Let's make a list of everything that the victim now has to do to pick up the pieces of his online presence and certain aspects of his personal life.
0. Obtain a different, non-compromised computer.
1. Set up new personal and business email accounts (probably at a paid provider as opposed to at some free service), then inform important contacts via telephone or web forms on their sites.
2. Set up new Facebook, MySpace, LinkdIn, Classmates.com or whatever pages and rebuild all contacts lists.
3. Find account numbers, financial transaction records or bills that prove my buddy's identity to the website hosting company. Re-establish access to the website and rebuild it from scratch (all files deleted and replaced by garbage).
4. Image the hard drive of the compromised computer for later reference and/or legal action if desired and possible. Wipe the compromised computer and rebuild from backups, from OS/driver CDs/DVDs if such exist, or by paying the computer maker or authorized repair place to do it.
5. Bring back all personally created documents and work from backups if such were done. Bring back all application programs from install CDs if possessed.
My readers know me as a Linux guy and will anticipate certain suggestions of mine, but let me think like a Windows guy for a bit. I'm confident that I can do this, and am motivated to do so since many of my colleagues spend most of their time in that world. Now, if I'm a Windows person, I would still need to change my ways somewhat. Let's see how adaptation is possible. My buddy is like most people in that he's only concerned with the work that he needs a computer to do, not with security issues on the machine itself. That's how the problem starts and here's a proposed new strategy:
1. Use the original desktop or laptop as the general use/everyday/casual computer. Get another computer for important stuff. And consider a third one, properly Frankensteined for gaming (let's be realistic here).
2. On the general use computer (and the other ones if they're Windows boxes) load an antivirus product like Norton, McAfee, free AVG or such. Load an anti-crapware product like Malwarebytes, AdAware or such. Load a third party cleanup program like Window Washer or the free CCleaner.
3. Update and manually run on a minimum weekly basis all of the programs I mentioned above. In many senses these programs are not automatic; they have to be operated by the user. Various automatic settings are sometimes included but when viruses are automatically found, they must then be deleted by user action (usually prompted by instructions that pop up - they're easy - follow them!) Windows Update also prompts you. Do all updates - they're free bugfixes and don't take much time.
4. If any of these antivirus or anti-crapware products find anything, get onto the other (Important Stuff) computer and see if you can still get into your accounts. If so, change the passwords, going down a roster of accounts that you've stashed for just such an emergency. You may not be acting in time unless you only log onto important stuff with the Important Stuff computer.
5. OPTIONAL - If you wish to investigate, keep the compromised computer in its compromised condition to be examined or for the hard drive to be copied (imaged) for future reference.
6. Rebuild the compromised computer from operating system and driver CDs/DVDs that you've archived in advance, either from the computer purchase or some backup scheme like Norton Ghost or a competitor of that product, or one of the Windows open source (free) backup products.
7. Consider making the Important Stuff computer an Apple Macintosh, or loading a box up with an easy Linux system like openSuse or Linux Mint, which is now available for free, fast download at
LINUXMINT.COM
You knew that was coming.
I understand that if you require Windows for work files or development, then you might not have the open source option. But just about anything web-based is child's play for a *NIX box. And the two Linux distributions I mentioned above have good, bright update indicators on their desktops (updates are how most security holes are dealt with in Linux) that'll make you pretty safe. Unless you've pissed off the Defense Intelligence Agency or the Russian mafia.
Friday, September 30, 2011
Book Review: THE CUCKOO'S EGG by Clifford Stoll
It's the Reagan administration and although your government research job is unrelated to computer desktop and network maintenance, you've had several such duties deposited into your lap, which became several more. Now you're responsible for solving a summation problem in the accounting program that charges other departments for using time on your system (remember the earliest incarnations of 'time sharing'?). The issue is that there's a bit of time that's been used and no one's paid for it. Digging into the relevant sessions, you notice an account that's been used recently, but was set up for someone who departed for another job two years ago. Questioning of that person and others around him or her deletes the original owner from suspicion. You begin attempting to find out how the current user of that account figured out how to use it - and from where...
Clifford Stoll's classic story of involvement in serious espionage messes begins in this massively plausible way. It was recommended to me by an NT-era MCSE; I proceeded to enjoy the book in spite of myself. But although I'd heard from various (inaccurate) sources that it involved "viruses", I was at least a little surprised to read the following lines early in the story:
echo -n "WELCOME TO THE LBL UNIX-4 COMPUTER"
echo -n "PLEASE LOG IN NOW"
echo -n "LOGIN:"
read account_name
echo -n "ENTER YOUR PASSWORD:"
(stty -echo; \
read password; \
stty echo;\
echo "";\
echo $account_name $password >> /tmp/.pub)
echo "SORRY, TRY AGAIN."
This isn't a random vandalism attempt and not a program that's attempting to replicate over adjacent machines. Somewhat obviously, it's a password grabber that appends the grabbed string to a file and then allows the user to proceed to the real logger-inner. It's a purpose-built program to harvest logins for the sneak thief that's arrogated control of an old account to him, her or its self. It was placed there by whoever broke and entered.
Stoll made the commendable decision not to interfere with the sneak, but to observe the sneak's actions over time. Time revealed that although root was attained, backdoors were installed and files were read, not much time was spent actually reading the files. The sneak proceeded over the LAN to other computers and did the same. The sneak wasn't so much interested in the data (which was downloaded by him) but in the network - the connections over which he could travel to other destinations. And they weren't just unclassified science projects like Stoll's astronomy research post; they mostly included sensitive stuff. Stoll began consulting with the three-letter agencies and the plot thickened.
What follows is not only a story of network research in the days before the consumer internet (which is not a terribly large part of the story) but a common litany of woes regarding having to deal not only with spooks that aren't at liberty to say whether you're full of baloney or not, but with layers and layers of middle management that have no power to say 'yes', but plenty to say 'no'. Without giving much away, I'll say that Stoll laboriously traces the sneak out of the building, out of the organization, away from the West coast to New Jersey, over the transatlantic cable and, modem by modem (that's Modulator/DeModulator, junior) into a situation that begins to address diplomatic issues among countries both allied to us and... perhaps not.
There would be many morals here. The first one that occurs to me is not to let responsibility creep get you thrown into prison, let alone rooked out of a fair paycheck. Five stars out of four.
Clifford Stoll's classic story of involvement in serious espionage messes begins in this massively plausible way. It was recommended to me by an NT-era MCSE; I proceeded to enjoy the book in spite of myself. But although I'd heard from various (inaccurate) sources that it involved "viruses", I was at least a little surprised to read the following lines early in the story:
echo -n "WELCOME TO THE LBL UNIX-4 COMPUTER"
echo -n "PLEASE LOG IN NOW"
echo -n "LOGIN:"
read account_name
echo -n "ENTER YOUR PASSWORD:"
(stty -echo; \
read password; \
stty echo;\
echo "";\
echo $account_name $password >> /tmp/.pub)
echo "SORRY, TRY AGAIN."
This isn't a random vandalism attempt and not a program that's attempting to replicate over adjacent machines. Somewhat obviously, it's a password grabber that appends the grabbed string to a file and then allows the user to proceed to the real logger-inner. It's a purpose-built program to harvest logins for the sneak thief that's arrogated control of an old account to him, her or its self. It was placed there by whoever broke and entered.
Stoll made the commendable decision not to interfere with the sneak, but to observe the sneak's actions over time. Time revealed that although root was attained, backdoors were installed and files were read, not much time was spent actually reading the files. The sneak proceeded over the LAN to other computers and did the same. The sneak wasn't so much interested in the data (which was downloaded by him) but in the network - the connections over which he could travel to other destinations. And they weren't just unclassified science projects like Stoll's astronomy research post; they mostly included sensitive stuff. Stoll began consulting with the three-letter agencies and the plot thickened.
What follows is not only a story of network research in the days before the consumer internet (which is not a terribly large part of the story) but a common litany of woes regarding having to deal not only with spooks that aren't at liberty to say whether you're full of baloney or not, but with layers and layers of middle management that have no power to say 'yes', but plenty to say 'no'. Without giving much away, I'll say that Stoll laboriously traces the sneak out of the building, out of the organization, away from the West coast to New Jersey, over the transatlantic cable and, modem by modem (that's Modulator/DeModulator, junior) into a situation that begins to address diplomatic issues among countries both allied to us and... perhaps not.
There would be many morals here. The first one that occurs to me is not to let responsibility creep get you thrown into prison, let alone rooked out of a fair paycheck. Five stars out of four.
Wednesday, June 8, 2011
Here's a quote...
...that may express some of my thoughts on programming and on Linux well:
“It is not the strongest of the species that survives, nor the most intelligent that survives. It is the one that is the most adaptable to change.”
- Charles Darwin
“It is not the strongest of the species that survives, nor the most intelligent that survives. It is the one that is the most adaptable to change.”
- Charles Darwin
Subscribe to:
Posts (Atom)