Carolyn's most popular book, in 4th edition now!
For advanced hacker studies, read Carolyn's
|
| Subscribe to Happy Hacker |
| Visit this group |
Better living... through (mostly) Harmless Hacking
Unix Edition
Jan. 4, 2000
_______________________________________________________________________
See the Happy Hacker web site at http://www.happyhacker.org
_______________________________________________________________________***********************************************************************
*** Editor's Comments
***********************************************************************Hi again. Sorry this digest was a little late... I've been pretty swamped
with finals. I'm afraid I don't have time to write the Perl 101 column this
week, but I promise, it will be back next week. A reader was kind enough to
point out a mistake I'd made-- I will correct that. Oh, how could I forget?
Welcome to our windows editor... great to have both digests back!***********************************************************************
*** Readers' Submissions
***********************************************************************enigma 3 <free_knowledge@hotmail.com> wrote:
in response to Edwin...
The 1024 cylinder problem is for lilo not for Linux. Lilo cannot process
data past the 1024th cylinder. So I guess what your question is how do I
make the lilo boot partition under the 1024th cylinder.
Oh by the way, I use SuSE 6.2 and I am referencing from the wonderful
reference manual that it comes with.
first:
create the Linux partition first and install lilo in that partition, and
make sure that partition is under the 1024 limit.
A more advanced and efficient way to help this is to make one
partition, the root partition, first and make it a few hundred megs, then
make another partition and assign it to /usr, give /usr a lot, because lots
of stuff is put there, if you program or need quick access to the libraries
and log files assign some space to /var, and if you have a network, maybe
/home. and remember when you want to find something you have to specify what
partition you want to search in ex:
find / -name something would find in /
just as
find /var -name something would find in the /var partitionso anyways
Patrick
Ps:
Could you make a practical c++ section, because I am trying to find books on
c++, I already know the basics from the typical learn c++ in x amount of
days and a few others, but what I want to learn is how do I make a dial up
program, or a directory listing, just a book of examples, the closest thing
I found was Linux multimedia guide, which has a lot of examples about how to
access various multimedia devices, which I could then build upon and do my
own stuff. And I haven't yet looked at the pearl corner, which I know is the
quick programming language for c++ people, so should I learn pearl. I have
the SuSE disks, would the source code for like wvdial be on there?anyway, any help/advice would be appreciated
[Editor: Thanks for the LILO write-up. As far as C++ goes, I could try,
although I'm not sure if this is the best place to get into long and
detailed source code... I think a dial up program might be a _little_ too
long for this newsletter. I haven't looked lately-- is there a C++ analog to
the "Perl Cookbook" or a similar title? I'd suggest you try examining some
source code, to see what you can get from that. On the topic, I'd like to
recommend an excellent book for C programmers who want to learn C++: "On to
C++" by P. H. Winston from MIT. It's short, concise, with no irrelevant
information. It teaches C++ to serious programmers and hackers (not the "For
Dummies" crowd) very well. I used it, and it's a great book. (And it was
actually written, by the author, in TeX, which is pretty cool). As far as
source code goes-- I don't use SuSE (when I can get my hands on another 486
or so I plan to install it (anyone in NYC have one they want to unload?)...
but I'd imagine the source should be on one of the CD's. If not, you can
always d/l it.]-----------------------------------------------------------------------
Chris freeman <cfreeman@swift.net.au> sent in:
regarding this question
>Coming to the topic, I want to know about the passwords in Cisco and
>Digital Unix. I got a Cisco router config file, from which I could get some
info about the >router and all. I found a line like "enable password 7
234E2123". Is this the password for >the router ? If not, else what ? I
think it is encrypted too... How do I decrypt it.would need to see the full configuration file to know, but basically,
enable password dragon
would set the password to dragon. looking at the config would show this
password in plain text. This password can be encrypted with
the lineservice password encryption
which will show the password in encrypted form in the config. this is a
weak encryption, however.using the line
enable secret cattleprod
would set the password to cattleprod encrypt it using a strong encryption.
this will override our previously entered enable password dragon, if we had
both lines in the same file. Obvious question, why not just always use
enable secret. fine in most cases, but how about if your OS version in
Flash becomes corrupt, and your router reboots using an older version of the
Cisco operating system from ROM, which doesn't support the strong encryption
(strong encryption uses 'MD5' encryption algorithm memory, but don't quote
me on that). If you didn't also have an 'enable password ....' line in your
config to fall back on, you would be stuffed -- locked out of the router.
therefore best optionenable password pass1
service password encryption
enable secret pass2provided everything goes fine pass one will never need to be used.
now you will get into your router with pass2, but if your OS on flash or
tftp or whatever becomes corrupt, and an older version of OS loads from ROM
which doesn't support enable secret command, you can get into your router
with pass one. Pass1 and pass2 should be different, for obvious reasons.the best site for router info. www.cisco.com is a good site. I'm doing a
CCNA, which is a good option to learn if you don't have access to a router
to practice on, which most of us don't.cheers
fleeceoh ps, as far as decrypting weakly encrypted password, easy to find on net.
use a search engine....[Editor: Ok, I'll take your word on that. Thanks!]
-----------------------------------------------------------------------
ozone@ucsd.com replied:
Hi Unix-edi,
Thanks for including my question in the mailing list....
I found myself some answers to my question. Cisco passwds can be decrypted
(even from the web!), there are lot of utils for that. Even I found a
website, which would crack you the passwd (not manually, but with script...
I don't remember the link... some co.uk).Reg DGUX passwd file, the passwords which are shadowed could be easily
decrypted in most other OS'es
*I have worked*. But in DGUX, I found it difficult, coz the shadowed passwd
file were nowhere to be found. But I knew of a util for v4.x of DGUX
(dushad.c), which can actually create a shadow file, which could be cracked
with john and all.. But the author of the program says that it is for v4.x.These doubts were asked in order to my systems secure, because I doubted
whether my server was being hacked and the passwd were being constantly
changed. So wanted to try cracking the passwd file myself and to make it
more secure.With Best Regardz,
de 0z0ne
[Editor: For those who don't pay attention to email addr's, this was the
original poster. And you don't have to justify yourself to me... although
you do sound a little bit defensive :) ]-----------------------------------------------------------------------
Brian 'Astrolox' Wojtczak <astrolox@innocent.com> wrote:
Normally I do not post to lists, just read them but I would like to make
some comments to the list about the following digest.>Maurice E Johnson (zuesse@orotech.net) wrote:
>
>For running windows and Linux together on the same machine, read,
>read, read. Running the two together is a good thing. For one , my Linux side
>has saved my windows side more than...you get the idea. Time saving tip,
>Install windows first then install Linux. If you want to run NT and Linux
>you will have to use the NT boot loader since NT will own the MBR.
>You do not ** have ** to use the NT boot loader. It is very easy to set up
LILO to pop up before the NT boot loader does, that is it will still be
there but you don't have to go through it to Linux. The reason I mention
this is because LILO gives you more options than the NT boot loader.It's easy enough to figure out how to do it and there are plenty of
tutorials so I wont go in to it. However be careful if you are trying to
load Windows 95, NT and Linux on the same machine. I did this and ended up
with LILO giving me the option of Linux or Windows and then the NT boot
loader giving me the option of NT or 95. It worked but wasn't what I
wanted. The LILO Man page gives enough information on how to set it up
correctly however.-
>Alex Harrington (fastkeys@btinternet.com) explained:
>
>:Eric (eanders@phayze.com) desires to know:
>:
>:Hello, I have been having some trouble with the Apache web server
:running on Linux Mandrake 6.0. I can't seem to make it an intranet
:server, it always broadcasts to the whole web. I know Apache has an
:access.conf file that supposedly allows you to change who can access :it,
but I haven't gotten it to work yet. Any advice?
>:
>: Thanks,
>: Kraphty
>:
>:[Editor: Are you asking how to only have apache respond to requests
>:from certain machines/certain subnets? I'm not sure offhand as to the
>:exact syntax of the conf files for apache, and my Linux box is having
>:some problems today, so I'll leave this one open ended. Aspiring
>:editors... here's a chance...]
>
>Here are some thoughts - not necessarily solutions to the problem:
>
>The access.conf file was obsoleted with the release of Apache 1.3.6?? and
>by default is distributed empty. You should be able to make the changes you
>need in the main httpd.conf file. If you do decide to use the access.conf
>file, be sure to enable parsing of that file in httpd.conf.
>
>To make apache only listen to 192.168.1.* , the following may work - I did
>not check!
>
>BindAddress 192.168.1.*
>
>The * is the unknown. From Apache Docs:
>BindAddress - Makes server listen to just the specified address. If the
>argument is *, the server listens to all addresses. Maybe you could try
>the allow from directive for / (root of the webserver) and restricting it
>to your home domain.
>
>How about setting up a Virtual Server to be the Intranet Server and then
>deny access to the standard server from all?
>
>Hope this may be of some use
>This is actually incorrect.
BindAddress is a directive for where to server is. That is for every
winsock connection there is a listening server and a connecting client.
This directive is only good for computers which have more than one IP
address and you want all incoming Apache traffic to go through one address.-
>
>z (zee180@lebhost.lb) asks:
>
>Hi man, thanks for the time and effort you're putting in this digest.
>
>Is there a way to impose CPU quotas on users, using Linux ?
>
>[Editor: I hear there are several ways to accomplish this, though I
>haven't tried any of them out. It seemed from my last Internet search that
>it's a feature in Linux, at least, that everyone want's, but no one's coded>yet. Reportedly, you can set a default value for nice, which will give
>luser's programs a lower priority. I hear you can also set process quotas,
>but I don't know how. Supposedly on the BSD's (FreeBSD in particular), it's
>an easier task.]
>I have seen this on FreeBSD, however I have never heard of it for Linux.
>
>Adam Nolan (teknoduke@hotmail.com) writes:
>
>Hi ...
>I've been using windows all my life and I've been reading the guides to
>mostly harmless hacking . You said in one of the articles that you can get
>Linux with as little as 20 megs . Is that with an X-window . Where could I
>find it , I've looked all over the net and they're all upwards of 300 megs .
>I Just don't have that much room on my computer . Also can you tell me
>where I can get some good guides on Installing Linux . What's the
>difference between Linux and Unix ...
>Thanks a lot for you time .
>
>[Editor: I'll answer your questions in reverse order. Linux is a GPL
>(limited free) kernel that works like Unix. So it's a type of Unix. There
>are several different distributions of Linux, each that packages the
>software differently. Next week I'll write about some of them. The 300 meg
>is probably for a realistic set of tools, you don't need to install it
>all. However, to run X, you will need 300 (realistically... you can
>probably run X on 100 meg, just without any programs :) ). For guides to
>installing Linux... most distro's come with very good documentation, in
>particular, red hat. The 20 meg figure is for the bare bones system... it
>wouldn't be a lot of fun to play with.]
>There is a version of Linux called Mini Linux, a friend sent me a copy in a
zip file. The idea of it is that you unzip the file in to a directory on
your dos computer and then run the batch file ( which calls loadlin ). It
uses a UMSDOS file system ( alpha version ), has a few programs and has an
X terminal that is pre-configured to work on most computers. The good
thing about it is it's under 10 mb.>
>Joe Capka (jcapka@uwaterloo.ca) emailed:
>
>I have a question someone on the mailing list might be able to answer. I
>have a Logitech "mouseman wheel" mouse, and I got the wheel to work in some
>applications, but it doesn't work in Netscape. I can't use it to scroll
>web pages.
>
>I've looked on the web but found very little on how to set up this mouse
>in Linux, except a page in French which I'm not that good at.
>
>If anyone uses this mouse's wheel to scroll in Netscape, I would like to
ask them a few things.
>
>[Editor: I still haven't bought one... don't know. I know how to set up
GPM to use a wheel, but as for X...?]
>There is a web page at altavista ( is that spelt right?) the search engine
which allows to you automatically translate French to English pages on the
fly - if that is any help?-- Astrolox, Brian Wojtczak. http://i.am/astrolox/
[Editor: Whoa... I think you might've written more than me this issue. Just
two comments: a. Based on this last post, we'd welcome more input from you,
and b., thanks for pointing out altavista... I'd forgotten about that.
Having used it, I can say it works pretty well, assuming it's given an input
that conforms to standard grammatical rules. On slang and dialects, it
chokes, but for a well written page, the result is usually quite
understandable.]-----------------------------------------------------------------------
Ed Padin <epadin@wagweb.com> wrote (to the AntiOnline Digest):
Yo, wassup?
In response to the article entry below I offer the following useful links:
This is the best article I've ever read about securing Cisco routers, from
the geniuses at Phrack:http://www.phrack.com/search.phtml?view&article=p55-10
In the article are the following links that show what you're after.
Apparently, it's trivial. There's a simple shell script to do it and the
author claims you can do the necessary steps on a napkin.[1] Decoding type 7 passwords
http://geek-girl.com/bugtraq/1997_4/0156.html[2] Password Recovery Techniques
http://www.cisco.com/warp/public/701/22.html
BTW: The writer sounds like some kid trying to break into his school's
mainframe....[Editor: I haven't had a chance to read Phrack 55 yet. For those unfamiliar
with Phrack, it's a pretty technical 'zine about hacking, phreaking, and
general "trouble-making". Their info is very accurate (except for a few
deliberate errors, but those were intentional), written to a slightly
less-then-licit tone. But beggars can't be choosers.]-----------------------------------------------------------------------
Matthew <maslett@dial.pipex.com> writes:
Hi, firstly I'd like to say thanks - the guide to happy hacking led me
to getting Linux (a 10 hr download!) and a fistful of books - me and my
PC have a new lease of life. I've sent my first anon email and have
found a few interesting ports.....Problem is this (I'm running X windows - version ? - quite modern) - my
/etc/resolv.conf file gets rewritten every time I boot into Linux - I
have written a script to sort this out but it's bugging me (I'm a 'want
to know' type of person). A guy down the pub suggested .rhost files but
I've grep'd my whole system and am still none the wiser.Any info greatly appreciated.
Thanks,
Matthew A[Editor: First, you're welcome. When you say resolv.conf gets rewritten,
what does it get rewritten with? I can't imagine why that would happen...
can you help us out with some more detail?]***********************************************************************
*** Perl 101, Lesson 2.1
***********************************************************************
Gonzalo Merayo <Merayo@movi.com.ar> wrote:>unix editor,
>
> Reading the Pearl sample program of the planets I had some trouble
> understanding this lines:
>
>$index=0;
>if ($planetname eq $planetarray[$index])
>
> In any language this would return true only if the planet the user
> typed is Mercury.
> But instead in the program is used as if eq did a search through the
> string and returned true if found a match and false if didn't find
> any. If it wasn't strange enough index returns the position in the
> string where the matching element is.
>
> If the correct is the second option and eq does all that, how can I
> compare a variable with a particular element of the string. I mean,
> what if I was searching for Mercury and I want it to return false in
> all other possibilities?
>
> I would have to do this:
>$temp=$index;
>if ($planetname eq $planetarray[$index])
> if ($temp eq $index)
>
> Too complicated for my taste.I can't believe I did that. His solution is, I don't think, the most
effective way-- the normal way is just by simply putting an increment
statement somewhere inside the loop. Argh. I guess that's what happens at
2:00am... hopefully I won't do anything quite as dumb in the future. But
thanks a lot, Gonzalo, for pointing it out :).-----------------------------------------------------------------------
This is a list devoted to *legal* hacking! If anyone plans to use any
information in this Digest or at our Web site to commit crime, go away! We
like to put computer criminals behind bars where they belong!Email addresses:
Unix Editor Mike Miller unixeditor@techbroker.com
Windows Editor WinEditor wineditor@happyhacker.org
Hacker Wargame Directors Vincent Larsen vincent@sage-inc.com
John Vranesevich jp@antionline.com
Clown Princess Carolyn Meinel To subscribe to the Happy Hacker email list, email with message "subscribe hh"
To unsubscribe to the Happy Hacker email list, email with message "unsubscribe hh"Happy Hacker is part of a 501 (c) (3) tax deductible organization