static_cast

I remember around 2001 - when he started his digital "Jihad" against Bin Laden - his web server was hacked several times with a public FreeBSD telnetd remote root exploit.

I won't deny that you have to give him some respect for being able to pull all these stunts and acquiring the money from investors, however as it seems most if not all projects where at least partly illegal.

I'd love to see up to date stable grsecurity kernel repositories for the major distributions (ubuntu, debian, rhel/centos) that provide patched versions of the distribution kernel. You can configure most of grsecurity via the sysctl interface. At the moment it is always a bit of hassle to patch & compile a kernel from hand even with the great debian/ubuntu kernel-package.

I don't think I'll use an extra distribution. But something like a hardened LAMP/LAPP stack for shared hosting out of the box in a distribution would be great (I think in terms of easy chrooting of users and php, secure permissions, etc.pp) However, I guess everyone has different needs and there is no one size that fits for all.

Thanks. I guess It's finally time for me to move every machine to a grsecurity kernel.

I know. I want to know if someone with a kernel >=2.6.39 and applied grsecurity patch can successfully use this exploit or if grsecurity protects from this exploit.

I know exactly what you are talking about. Following a plan can be hard. If you don't have clean socks anymore try to include that into your plan. Say 30min household stuff... nobody will ever see my plan. It is personal, full of probably questionable content for other people, but it is realistic and only when it is realistic you even have a chance to fullfill it.

Also: Iterate. Make a plan for tomorrow, realize tomorrow you are 50% off, ask yourself why...iterate till you can fullfill the plan. Include the stuff that stopped you from fullfilling your original plan, spot problems, experiment with solutions. Beeing honest with yourself can be hard.

And: Only do this for 50-70% of your time. If you plan everything you'll go nuts very soon (At least I do) but don't omit personal goals or problems.

As for the problem of acting on the plan: Think about binary sort... split the problem till you can handle it, then merge the parts. If you don't know how to handle it you can always think about splitting it up.

</endofpseusoselfhelp>

good luck!

> It stops our mail server from being used as an open relay though?

From outside of your network yes. If one of the computers inside your network is infected your mail-server will happily deliver the spam mails.

> How does blocking 1 specific port stop the issue anyway? > They can just change the port they connect on?

I don't know of any SMTP-Server that accepts E-Mail on Ports other than 25. Port 587 requires authentification before sending an E-Mail.

I thought most poeple don't accept E-Mails sent from isp-networks with dynamic ip adresseses. Maybe that's not the case and they try to reduce spam this way.

> I was offering an opinion on how to resolve those issues. > Changing which port accepts the mail is in my opinion pointless.

Nobody changed any ports. E-Mail is still send to port 25 from mail-servers. But if you are a not a mail-server (e.g. a client in a network) you have to use the submission port and authentificate against your isp/comapany mail-server.

you can still use port 25 on your isp mail gateway but now they can filter and rate-limit your emails.

> It's like saying that most burglars come in through the back door so the government blocks everyones back door, they will just come in the front.

not really. it is good practive to only act as mailserver if you are on a static ip and mx records point to your server. none of this is fullfilled by dynamic isp ip adresses. So this just stops the unwanted practice for good.

I'm quite new to Steve Pavlina writings. So I've checked with Wikipedia to get an idea on his claims.

He already got college credits from high school and studying at Berkeley, this important detail is nowhere found in the article.

I've also found that most of the advice sounds great but is hard to impossible to apply.

He appears to be exceptionally clever but a term paper on math and engineering problems are not written with a 12h marathon on the weekend, at least not on my university.

Can anyone recommend serious advice?

That's pretty sound advice. However a lot of scripts won't work if you disable exec and co.

some other random ideas for php-security:

If you have to enable some form of option to exec binaries be aware that open_basedir is useless now, because the attacker can just start a python instance and operate under apache user if you are using mod_php

using fastcgi (mod_fcgid or nginx+php-fpm) and restrictive permissions on your directories should at least protect your other users home directories.

another idea is prevent malicous scripts is to firewall apache and php from iptables. there is an iptables module for restricting uid and gid ranges to have access to the outside world. this could at least prevent a trojan dropped in /tmp to connect to their irc-server. but you can also disallow outgoing traffic to port 80, this breaks however all the auto-update features of e.g. wordpress.

A lot of script-kiddie toolkits can also be stopped by not having gcc,wget,python etc.pp available to the user running php.

if you have to host sensitive data on the same host as the php application it's wise to use a jail or at least chroot for php, there are some guides to put a mod_fcgid php into a chroot

and: never ever use the mysql root user for database connectivity!

Thanks for your great reply. I've looked into mediation and I should start now doing it. Nice to hear that it helps you.

I really guess I have to look after my feelings. Something went wrong along the way and now I'm struggling.

> The insidious thing about this is just how effective it is (if you are good at it)

Yes, but not if you want to learn something. Then it is disastrous because you skip the "actually solving something" part.