Questions and Answers
Bjorn Satdeva
CERT's latest advisory is about a security flaw in talkd. This daemon is used by the talk program. In itself, this is not newsworthy; however, it is an example of how some people are continuously looking for flaws in the existing network software and will utilize them as they are found. It is also an example of how poorly written software can be used to gain unauthorized access to machines connected to a network. I wish I could say that only old UNIX software has these kinds of flaws, but this is sadly not the case. With the explosion of the Internet, there has been an enormous growth in the need for skilled security people. A number of people are using this demand as an opportunity to move into the market as consultants or software vendors without first having the necessary technical background needed to give good advice. In the consulting business, I frequently encounter people who speak with great authority about security but are almost clueless about many of the issues. As one security consultant remarked when we discussed this sorry state of affairs, "If you can spell security consultant, then you are one." Not too long ago, I attended a meeting at a client site, in which the possibilities of the World Wide Web were explained to a number of users. During the half hour presentation, all the nifty things you could do with Active X, such as dropping directly into spreadsheet or word-processing program, were presented. However, not once during the meeting were the significant security risks of these activities mentioned. The Web is scary. Users and vendors alike are pushing for new functionality every day. Netscape and Sun are at least trying to do the right thing, even though it is an almost impossible task. Microsoft meanwhile appears not to care about security. This is a calculated risk that has worked for them in the past, but there is a very large difference between what is acceptable on a stand alone desktop machine compared to a networked computer, especially when connected to the Internet at large. It will be interesting to see how the world at large will react when the problem gets so big that no matter how much you try, putting your head in the sand no longer works. In the meantime, as UNIX system administrators, what can we do? Firewalls may not be politically possible, or we may be stuck with an NT-based firewall. We might be forced to open up holes through the firewall that allow updates of an internal database. In many cases, the underlying security paradigm is absent, and the security that has been implemented is flawed on many levels. To answer my own question: I am afraid there is not much we can do, except educate whenever we get the opportunity. And now to this month's questions:
Listing 1
Ping multiple hosts
#! /bin/perl
#$File = "/etc/pinglist";
open( FILE, $File ) || die "Cannot open $File";
while ( <FILE> ) {
next if /^#/;
next if /^127\./;
chop($Host = $_);
$Res = `ping -c 3 $_`;
if ( $Res =~ /3 pac\w* trans\w*, 3 pac\w* rec\w*, 0% pac\w* loss/ ){
print "$Host OK\n";
next;
}
print "$Host FAILED!!!\n", $Res;
A system administrator does not need to be a programmer, but I believe that some rudimentary knowledge of programming languages, such as Perl, is a must.
In regard to your comment about protecting the ports, again you are right. The problem here is similar to what I outlined above. People who think about security in terms of host security and are unfamiliar with the security problems faced when that host is placed on a network, tend to ignore that problem. This is a very human reaction, unfortunately, what you do not know can indeed hurt you. Like you, I wish that there were good system administration tools available which are appropriate for large sites. We are still in the same situation we were 10 years ago in respect to recommending tools to our clients. In many cases, we still rely on publicly available software when giving recommendations for how to improve system administration at a given site. This is unfortunate, but I think it is at least better than recommending commercial software, which sometimes fits like a square peg in a round hole.
No business or organization acquires computers for their own sake. There is always a purpose for those computers, and therefore the policies. As an example, a large company such as Boeing has a huge number of computers. However, Boeing is not in business just to purchase and run computers. If anything, the purpose of that business could probably be described as being able to build reliable airplanes as effectively and inexpensively as possible. The computing policy documents, like everything else in that organization, must reflect that purpose. The same will be true for literally every organization you can think of, even in the cases where the computers are very central to the demographics of the business, for example, service providers. It is unfortunate, but the bottom line is therefore that we still are in need of a good document that describes how to develop procedures and policies. If anybody knows of a good source for this information, please let me know.
About the AuthorBjorn Satdeva is the president of /sys/admin, inc., a consulting firm which specializes in large installation system administration. Bjorn is also co-founder and former president of Bay-LISA, a San Francisco Bay Area user's group for system administrators of large sites. Bjorn can be contacted at /sys/admin, inc., 2787 Moorpark Ave., San Jose, CA 95128; electronically at bjorn@sysadmin.com; or by phone at (408) 241-3111.
|
Do you know of any utilities that will allow for pinging multiple hosts from a file? I have tried fping, but couldn't get it to compile under Linux. Thank you so much.
No, I don't know of any. However, a competent system administrator should be able to write small scripts to do these types of jobs. In Listing 1, you will find a five minute hack that can do what you asked. It is a far cry from the capabilities of fping, but it will do the job until you find a way to fix the problem you have encountered with fping compilation.