Yikes

We had some good ones a few summers ago - I wish I could pretend they were politically motivated in some way but while the catalyst may have been the Police shooting dead a guy*, ultimately it seemed to descend into an excuse to go looting and setting things on fire. Ridiculous situation

@Dan The thing is that even if it starts with a few people genuinely upset about an event (or, more likely, a lot of things during a long time that culminate in an event), they will be joined by a lot of people who are only interested in having the kind of fun that includes destruction of other people's property.

Seriously...

@JennyD Exactly - it spread across the country and people of all colours, beliefs and social classes wound up involving themselves. I'm sure they're rare-ish, but we had stories of white,middle class, law school graduates going to jail after looting shops for TV's and the like

@Dan During the past week or so there were a lot of issues in one of our suburbs. More than half the people arrested weren't even from that area, they'd gone there to join in the "fun", fuelled by media who were actually paying people to burn cars and take pictures of the burning car...

...doing things that would make @MichaelHampton cringe...

# default: on
# description: The telnet server serves telnet sessions; it uses \
#       unencrypted username/password pairs for authentication.
service telnet
{
        disable = no
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/sbin/in.telnetd
        log_on_failure  += USERID
        instances       = unlimited
        per_source = UNLIMITED
}

@JennyD :(

@ewwhite I should report that for offensiveness

xinetd[5119]: FAIL: telnet per_source_limit from=::ffff:172.20.3.35

Is...is telnet running as root?

@NathanC it's under xinetd.

Okay, a bit better. But still...*telnet*.

@ewwhite Does xinetd reread service configs on each connection?

You might want to hup it.

anyone ever use elance.com?

@Travis Years ago

Did you get paid?

Most of my time was spent being undercut by Eastern developers, but yes I did

Thought about doing some of the jobs...or at least trying. Maybe even sub one out for a mobile app idea I had

May aswell give it a sho

t

@JennyD No, I have to restart the service... But by default in RHEL, only 10 telnet sessions are allowed from a single source. So if you have a Citrix server full of people connecting to your Linux system via telnet...

@ewwhite kill them with fire?

Fire is a decent answer to everything telnet.

@NathanC Or nuke it from orbit. It's the only way to be sure.

thinkgeek.com/product/e95e

Oh, you're all SSH snobs!!

@ewwhite Please. Elitists. Not snobs.

Morning

@ewwhite Everyone likes plaintext!

Morning cole

It's Monday /sigh

@NathanC you fix your Debian server?

So, it turns out that some DNS providers allow you to put CNAMEs in at the root of your domain and then return broken results when anyone queries that domain rather than throwing an error and not allowing the broken configuration in the first place.

@ewwhite finally getting around to getting back up to speed with HP kit - 1.2TB 10k 2.5"ers are nice, so are the 1.2TB FusionIO mezz's

@Chopper3 I tried to push for the FusionIO... they are cheap-ish through certain channels... but the RAID situation is a deal-breaker for most clients.

@ewwhite understood - oh and go to bed

Lady. Gentlemen.

@Ward I've done a couple of answers like that over on IT Security in the destruction tag. I'd be wiling to copy them over to get that done.

@ewwhite Real men use netcat for their remote administration needs.

What a craptastic day, rainy. The weekend was beautiful, but very hot. I have a funeral today :(

@Cole apparently when i rebooted it, it dumped into recovery mode...filesystem errors.

I have no idea why.

Yikes.

@ScottPack So, shredding SSD's is the future if you're paranoid and specialist equipment is needed for recovery if you're forensics

@Cole It told me to run fsck manually so I did. Fixed some missing blocks (?) and it rebooted happily. Of course, since it mounted read-only no logs to be found.

@NathanC well hopefully it doesn't do it again.

I hope not. I'm going to reboot it a couple times to see if it keeps occuring. Strange since they're 1) new disks, and 2) the OS is basically 2 weeks old.

@Dan we shred

@Dan Uncontested. The whole wear leveling thing is really screwing with us, both from a media disposition standpoint and forensics.

@ScottPack Yeah, it's most difficult

And it fucks with my "SINGLE PASS FROM DBAN IS ALL YOU NEED" ranting

@Dan Yeah. I gave an hour talk last fall about media retirement. I wish I had had more time. It's hard to talk about records retention as well as retirement for all media types in that length of time.

@Dan It was pretty fun to get to talk about handling both microfiche and SSD in the same presentation, tough.

@ScottPack Haha, that's quite awesome. But yeah, you could spend a lot of hours discussing that topic

@NathanC Could just be shit disk on arrival.

@NathanC better to find out now then 3 months into production and the server is like "lol dead disks"

True enough ...waiting for the reboot now.

It takes a little while for the RAID controller to do its thing

New RAID controller?

@ScottPack We encrypt - if someone can recover the data 50 years from now the client is half likely to be dead.

It's a "compaq smart array" ...the server's a few years old. :P

@NathanC Oooh... which server/which controller?

@ChrisS See, I still think is risky. What if your encryption algorithm has a flaw and it's cracked in 5 years?

I've worked with Compaq equipment once or twice!

HP ProLiant ML350

@Dan Then shred and burn the disks?

@ewwhite That's my point, though, if you dispose of them relying on the encryption then you're screwed

@NathanC So E200 controller?

Or P410?

@Dan AES-256... It could happen.... But it'd still be much easier to social engineer the info out of our clients than to recover it from one of our HDs that you would have to find in the first place... All drives are zero'd too, though I know there's ~20% under-commit.

@ewwhite I don't remember exactly ...and it looks like something's not coming up. To the server room!

@NathanC press "F2"

@ewwhite Realists! Sensibilists!

@ChrisS That's fair enough, and yeah I was going to post that it's "reasonable steps" when all said and done.

Our backup media does get shredded (I tend to prefer the word pulverized as the result is pieces about 2x the size of a grain of sand, but point is you wont be reassembling that anytime soon)

pfSense 2.1RC0 support for IPv6 is niiiiice.

nice of pfSense to finally include that stuff....

@ewwhite 09:02.0 RAID bus controller: Compaq Computer Corporation Smart Array 64xx (rev 01)

I always want to use pfSense more - and get annoyed that they're using FreeBSD from 2 years ago every time I look.

it booted properly ...but the interface didn't apply its IP address....which is weird since it's static.

I'm so confused.

Holy moly a SA6400?? What year is that from?

@NathanC Oh, old... parallel SCSI. Smart Array 6402 or 6404. Bummer.

2002-2004...

It's old ...that's no contest lol

Ultra 320 card... I still have ~3 in production right now.

Christ, we've got a ML350 here, I think it's a G3 or G4. Not in use, though, we brought it across from the old place.

This one's a G4. We have another one in service that won't be much longer since it was used for backups ...but we upgraded to using a NAS & external hard drive backup

We're a Dell shop, all you people with your HPs.

@Cole We've got one Dell, a R710 I believe.

Dells everywhere here.

lots of Equallogic storage, too.

I'm over the Dell versus HP argument. My days are spent on the anything versus (jankily-assembled) Supermicro debate.

I've just never really used HP, so no argument here. Just ask long as it isn't Supermicro or IBM.

@ewwhite Trust me, you wouldn't choose Fujitsu Siemens over SuperMicro if you had the chance..

HP sucks, the off of EBay refurb kit I've got under my desk proves it =P

@pauska My old boss in Frankfurt had a hard-on for Fujitsu... so he'd secretly buy them and hope that I wouldn't detect the servers.

It was quite weird...

@pauska oh god, I had to work on Fujitsu blade servers at my old job. Terrible - nothing but problems.

yeah, that was dysfunctional...

@ITHedgeHog Oh? Whyso?

@Cole we have a dell poweredge for our main server...the HPs were left over from the "old" network. The box I'm re-using used to be a novell netware server

LOL NOVELL

shakes fist

@tombull89 HA!

@ewwhite lol, was being snarky. This machine is just crapolla - because its from ebay and has been refurbed. Bits just die regularly. Terrible I/O performance too.

Silly DevOps

@Cole I used to work with novell ...back in high school. It was terrible.

@NathanC how old are you?

I actually know Novell, sadly.

22, 23 end of the month :p

shakes cane GET OFF MY INTERNET!

lol

Sigh, I was missing auto eth0 in the interfaces file ...explains why it was coming up but no IP address. facepalms

I really should avoid Linux on a monday morning.

I avoid Linux every morning

I avoid nothing, except doing work.

Quiet in here this morning. What, are people actually doing work?

Yep

pfftt

@Cole Being an awesome developer takes efforts, who would have thought.

That's what I like about being a SysAdmin, I'm awesome and I make no effort.

Work always comes first...

@ChrisS Depending on the algorithm losing the key is considered not entirely unreasonable for data destruction. I would only accept it if the disk is being reused in the same environment. If the disk was leaving out possession I would

@ChrisS Unless you have the option of boobies, then boobies > work. Always.

@ScottPack I would take the same approach if the data were of higher value to an attacker.

@ChrisS I'm working under the assumption that the data is classified as non-public (or whatever the terminology is) under your data classification policy.

If I was working with DoD data I'd secure erase and pulverize... But this is just average person financial data. Most of which could be stolen out of their mailbox of the attacker was local enough to pickup on of our used computers from the recycler.

Our policy only allows for Confidential and Non-Confidential. There's no shades of gray.

@ChrisS Well, NISPOM h as pretty good requirements for that type of data depending on what it is and where it's going.

@Dan FYI, we shred regular hard drives as well. Much cheaper than using a degausser.

@pauska Can't blame you, but at least the science of data destruction on mechanical drives is well understood. Overwrite the bit and you're done!

@pauska Our recycler has a shredder, so that's what we use. Getting data destruction equipment yourself is too expensive (especially since our recycler only charges us if we need certificates of destruction).

@ChrisS yeah, a degausser from Ibas or Veritas is $$$$$

@Dan Overwrite the bit many times and you're done

@pauska Once.

That is not true?

For security reasons, I prefer a very large hammer.

@pauska It's never been proved, anywhere, ever. So, I regard that as "Good enough evidence" ;)

I know a company who wipes harddrives for the military and the norwegian equalent of CIA.. they have to overwrite the disk from start to end more than one time..

Overwriting once gives (each byte) a 1 in a few thousand chance of being read by specialized equipment. Reading meaningful amounts of data from a zero'd drive is practically impossible.

Degaussers also have the auditability problem. Without moving the platters to a new disk you can't check the work. At least with an overwrite or a shred you can do some verification.

"Certificate of destruction?" Destroy the drive in front of the customer with a hammer. Or have the customer do it. :D

@pauska Yeah, a lot of policies require it but it's not backed by science

@Dan It'd be a fun world to live in if we could just ignore all policies

Sadly, that isn't the case. So, shredder! OM NOM NOM!

@pauska > “Advancing technology has created a situation that has altered previously held best practices regarding magnetic disk type storage media. Basically the change in track density and the related changes in the storage medium have created a situation where the acts of clearing and purging the media have converged.

@pauska > That is, for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack.” (p. 14, csrc.nist.gov/publications/nistpubs/800-88/…)

@pauska Don't get me wrong, if I was genuinely worried its the route I'd go - I just like people to know that nobody is recovering their once-overwritten drive

@NathanC I put the drives in a box and drop them off at the facility.... After that if I want proof I gotta pay. But they're a non-profit and I know people who work there (it's all on the up and up, at least since they started there a few years ago)

@pauska That was an update to NIST SP800-88 published in 2006.

If you had disks in a RAID array, wouldn't an attacker need a majority of the drives and a knowledge of the storage controller to get anything useful?

It'd be a good stress-reliever at the office whenever we replace equipment: "Stressed? Come smash some old hardware!"

@tombull89 Depends - if it's RAID1 you're sorted :D

And even RAID0 may have enough data to cause trouble with every other bit, depending on the file type etc of course

@Dan The thing is.. when do you bin hard drives? In my case it's very often because the drive is dead

If we had a dead laptop disk we'd likely take it apart and bin it. There's nothing valauble stored on the local disks (well, apart from a copy of Windows and Office)

So for us it's just so much easier to shred both functional and nonfunctional ones in one big shred

@pauska Yeah, same here

How to ruin an interview, #1337: blather incessantly about how awesome you are! Really, I MUST know that!

Lexmark technical support...unable to open PDF files since 1964....

@tombull89 Where do users store their data?

Do you delete the cached outlook files from the disk?

do you empty the offline files?

trust me.. you do not want to throw a disk before wiping it completely or smashing it like hulk

@DennisKaarsemaker When i get nervous I talk to much about nothing because the silence is deafening and I hate to sit there in absolute silence with the interviewer staring at me intently without speaking because then it makes me feel like I haven't thoroughly answered their question and I keep trying to explain in further detail

there are children being hired in africa to dig up harddrives after they have been buried on those laaaaaaarge computer graveyards that everybody keeps sending their gear to

@Travis there was no silence in here. It was impossible to interrupt the person.

certain countries love any kind of intelligence they can get..

@DennisKaarsemaker lol

@pauska $$$$$

@pauska Network share.

@tombull89 Offline files disabled?

Outlook cache files deleted?

windows temp folder cleared?

@pauska PUNY DISK NO MATCH FOR HULK. HULK NIST CERTIFIED DATA DESTROYER.

and so on..

@pauska yes, it was causing issues with something

there is data everywhere, you just don't see it..

Relatively cheap and quite cathartic.

As Dan said, if we bin a disk it's because it's dead. None of our systems will read it.

@tombull89 that doesn't mean none of NSA's systems can :)

So we'll take the disk apart, maybe scratch the platters, but that's probably it.

@ScottPack and slow

@pauska Right. I already said cheap. If you want fast then buy a shredder or contract.

I still think smashing it with a hammer would be the most effective...

@ScottPack ya. There are tons of companies who shred metal, so it would probably faster and cheaper to just rent time with them

@NathanC Are you aware how strong disk platters are?

it's not like you can bang a hammer on the casing of a hdd and expect it to shatter internally

@pauska Once they're out of sync though, you've got to really want that data to stand any chance

@NathanC According to SP800-88 that's called "pulverization" but there are requirements on particle size.

@pauska yup. That's what we do. Our default waste paper shredder also shreds metal. And then sends the shrapnel to tata for recycling into cans :)

@pauska There are at least 3 different platter materials. Ceramic will definitely shatter if you hit the casing with a hammer.

And glass

@Dan While technically different I tend to mentally merge ceramic and glass.

Most platters are ceramic from what I gather.

For some definitions of most.

@NathanC All the ones I've seen are metal, not that it's many in the global sense

2.5" disks tend to be glass/ceramic. High rotational speeds, so 10k/15k are mote likely to be glass/ceramic. Anything 7200 or lower, and 3.5", is almost definitely not.

Burn them

@Travis Kill them with fire!

Funny "Yahoo" answer to what to do with them... "No. Plug it into your computer and go to disk utility and erase it over 35 times. That is the maximum. 7 times is enough for the DOD so 35 should be good enough for you (probably over kill anyway)"

Pardon my ignorance, but why wouldn't a zero-fill be enough? I mean, if everything is "0" then there's no data to be read.

Although, I suppose logical != physical when it comes to sectors and things.

@NathanC For magnetic spinning platters that's a "generally yes". See page 14 of NIST SP800-88 for more details.

@ScottPack Gawd - why don't people invest in one of those $5 tripods? Or at least have someone hold the camera who doesn't have Parkinsons

@ChrisS No kidding.

Y'all are paranoid!!

@Travis confirming that no, you don't need to overwrite your hard drive 35 times.

@Travis Articles like that annoy me. It references the DoD 5220-22M as listing the standards, however it's been a LONG ASS TIME since that document contained any kind of overwrite standards. At one time that document contained sanitization standards, but a long time ago it was updated to state that media needs to be handled according to the Cognizant Security Authority.

@ScottPack Right

If I'm preparing a machine for a new owner, I just do a single zero-fill and call it a day.

Or random character, either one works.

hey room

@NathanC Right. However, I know a guy that was in a car wreck with an 18-wheeler. He wasn't wearing a seat belt and survived because of it. He will not a wear a seat belt ever again. Contrary to his beliefs, the US Government believes they save lives and have data to prove it...

Generally speaking you just want to ignore NISPOM and look at NIST. It's a lot clearer and more relevant to people not dealing with government data classifications.

@ScottPack can i talk with you?

@Saladin Why?

I have a sql server 2008 R2 auditing question that i need help with?

the ROOT rooms ppl have no solution for this

so i changed rooms.

Sounds like Windows garbage.

:(

Two things, first, top right

its not

I

Secondly, Scott isn't your personal support representative

lolol

but i know scott he has helped me before

You could either ask here or post on dba

what the place to ask such a question?

But, as shown in the topic ...we're not "live" support ;-)

@Saladin I'll let you off then ;) Presumed you were a random

serverfault or ...

I know SQL Server is a Microsoft product and only runs on Windows.

But seriously, ask on a main site

Otherwise, if you're talking about auditing then dba, sec.se, or SF would be your best bet depending on exactly how deep you want in which area and what type of expertise you want to attract.

@NathanC thank you

thanks @ScottPack

i will try DBA, i want to enable auditing for sql-server which supports logs for TMG so i can pull it using jdbc connection from SIEM product.

You know what so fucking annoying that the sysadmins don't know shit about auditing i have to tell them the sec people

i mean auditing should be a pure sysadmin jobs not the guys of security people

99% is just plain configuration, security related to what types of events are being logged..

but then this is a separate issue

Doesn't TMG come with directions for configuring a SQL server to hold its logs?

thanks anyhow

@ChrisS It does , but it just seems to work

@ChrisS One would hope so.

I'm missing something or the sysadmin is

What's wrong with "working"?

@Saladin: actually database auditing is totally a security job, its one of the things you learn in a computer security degree

tho, one of my classmates was an actual auditor ;p

well this is just theory thing in cooperate organizations these duties are largely different, in our place sec people don't have a role in auditing enabling steps

we just dictate the requriements

Right. The auditing configuration should be done as a collaborative effort between the security people and the DBAs. The DBAs should probably have access to the audit logs, since it's useful to them, but for liability and investigation issues the storage and collection of the data should be up to the security people.

So its a management problem!

It's that whole "separation of duties" thing.

you can't seriously accept me to login using dba credentials and do their configuration for them, they are all already running sql server for hundred of things why auditing should be so different?

the only way this fits right if we had audit role or separate jd for sec auditor usually windows have a separate group / role for auditors

this doesn't exists; in our case

and even in that retro-respect i don't even expect audit to perform configuration for sql sever they are just to see the changes that are made through logs and other means that nothing has been changed or removed or altered without prior consent or approval

Why is this necessary? I get why you might want to do it, but it seems like a lot of security assurance for a fairly small shop.

@ChrisS well ideally for log management you need to have proper auditing infrastructure in place ; most people forget this they just worry about syslog 514 traffic its the log sources which are poorly configured and without the right audit controls in place you have little assurance of integrity of the log correlation and management process