BigSmoke » security

PHP include exploits

Rowan Rodrik — Sun, 14 Nov 2010 17:19:10 +0000

A year ago, my web host thoroughly explained how PHP include vulnerabilities can be exploited, hoping that better user education would leave less member-sites vulnerable to automated attacks by spammer scum.

Gentoo auto-login and startx

Rowan Rodrik — Sat, 19 Jun 2010 22:32:09 +0000

I don’t believe in system passwords if they’re not backup by some type of disk encryption. It’s simply too easy to circumvent by changing a few boot parameters or by inserting a good boot disk. For performance reasons, I’ve decided against using full-disk encryption for my laptop and even against encryption for my home folder. This makes typing in a password to login a mere annoyance. Admittedly, my laptop features a fingerprint reader, but at the time I couldn’t get it to work and it still requires me to type in my username, which I find just as superfluous. Also, fingerprints aren’t that secure either.

For ages now, I’ve just wanted to be automatically logged in and greeted by an X session when I boot, especially since my xdm died after some upgrade about a year ago or so ago. For how much time I spend with this machine, I’m amazed how long it takes me before deciding that logging in in the console and typing startx might be not such a good idea.

(It probably has everything to do with “conditionality”. I tell myself, for example, that before ditching xdm (which is one of the few X login managers which doesn’t support auto login), I first need to get it to work again to make a screenshot of my “cute” configuration. Can’t kill my darlings; never could.)

So fuck all that. I’m too lazy to resurrect my darling, no matter how cute, so I took a look at this and added to following to /etc/conf.d/local.start:

# Start X as user if tty7 is free
if ! fuser /dev/tty7 >& /dev/null; then
    su - bigsmoke -l -c 'exec startx -- vt7 >& ~/.xsession-errors' &
fi

Done. Maybe I’ll also decide to make all my console sessions auto-login, if I can be arsed, that is.

Matriux, a penetration testing and security analysis LiveCD

Rowan Rodrik — Sun, 31 Jan 2010 22:35:33 +0000

Last December, someone pointed me to Matriux. In their own words:

It is a fully featured security distribution consisting of a bunch of powerful, open source and free tools that can be used for various purposes including, but not limited to, penetration testing, ethical hacking, system and network administration, cyber forensics investigations, security testing, vulnerability analysis, and much more. It is a distribution designed for security enthusiasts and professionals, although it can be used normally as your default desktop system.

It comes with a wide arsenal of free software tools to do naughty things to your network. I think I should give it a swing and download it some time.