From owner-freebsd-security Mon Nov 1 14: 2:23 1999 Delivered-To: freebsd-security@freebsd.org Received: from smtp.interact.se (smtp1.interact.se [193.15.98.9]) by hub.freebsd.org (Postfix) with ESMTP id 59CFF14E2A for ; Mon, 1 Nov 1999 14:02:16 -0800 (PST) (envelope-from je@interact.se) Received: from wolfie.interact.se (wolfie.interact.se [193.15.98.202]) by smtp.interact.se (InterACT Mailer) with ESMTP id XAA09886; Mon, 1 Nov 1999 23:02:56 +0100 (CET) Date: Mon, 1 Nov 1999 23:02:04 +0100 (CET) From: Jonas Eriksson To: "Dr. Dave" Cc: "Jean-Pierre H. Dumas" , FreeBSD-Security@FreeBSD.ORG Subject: Re: Security tests In-Reply-To: <19991026223218.B8498@sneakerz.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=ISO-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Try The Nessus remote security scanner, located at: http://www.nessus.org Regards Jonas Eriksson -- InterACT Lule=E5 Network & Security Administrator Tel: +46 (0)920 88803 - Fax: +46 (0)920 88399 Current temp in Lulea/Sweden is 4.6C (40.3F) On Tue, 26 Oct 1999, Dr. Dave wrote: > On Tue, Oct 26, 1999 at 04:36:35PM +0200, Jean-Pierre H. Dumas wrote: > > This is to verify the security of a FreeBSD 3.2 > > server I am installing. To be used as a POP3 toaster, > > with qmail and vmailmgr. > >=20 > > I installed and ran COPS (a really old one). > > It screamed at me about the /var/spool/uucppublic > > directory as beeing *world* writable. > > It barfed on the passwd and group having the wrong > > number of fields (I assume this is because of the > > use of perl 5 vs perl 3 at the time of creation > > of COPS, something like @_ changed meaning ?) > > Question: is the permission of /var/spool/uucppublic > > correct once in drwxrwxr-x ? (I do not use uucp, > > but...) >=20 > Cops is VERY old and outdated. If you would like some more recent securi= ty tools, visit http://www.securityfocus.com, they also have a bug tracking= archive that you can search through by OS. Keeping security on a system i= s alot more than installing the packages from /usr/ports/security. >=20 > > Question: What can I do more to have a realistic > > report about this server's security ? >=20 > If this is a corporate environment you may want to look into a site licen= ce for IIS, internet security scanner, http://www.iss.net >=20 > =20 > > Is there any other scanners or whatever that I can get > > and run, either from within the server, or from > > outside (I have a FreeBSD 3.2, Linux and Windows 95 > > machine on the Ethernet) >=20 > If you are looking for portscanners, you may want to look at nmap, http:/= /www.insecure.org/nmap >=20 > --=20 > -------------------------------------------------------------------------= - > Dave McKay dave@sneakerz.org = =20 > MSN Hotmail http://www.hotmail.com > -------------------------------------------------------------------------= - >=20 >=20 > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message >=20 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message