From casey at schaufler-ca.com  Tue Jun 17 01:07:49 2008
From: casey at schaufler-ca.com (Casey Schaufler)
Date: Mon, 16 Jun 2008 17:07:49 -0700
Subject: [ubuntu-hardened] Configuring services for Smack
Message-ID: <48570055.10307@schaufler-ca.com>


For the security team meeting Thursday June 19th I
promised to provide the Smack equivalent to the
AppArmor profile for CUPS. The attached PDF is an
attempt to describe how one would configure a server
for use with Smack, which is different from a
description of how to configure Smack for CUPS, but
more in keeping with the way Smack works.

You don't really configure Smack. Smack is perfectly
happy to run with all processes using the floor label,
which is what init starts with, and all files labeled
to the floor label by default. Of course, you get no
additional value from Smack this way. You get value by
running the processes you trust less than the system
(e.g. user processes) with labels other than floor.
It is then the services themselves that must be taught
about Smack. As the paper describes, there are three
ways to do this:

- set the service running with the label of the clients
- use the Smack port multiplexer smackpolyport(1) to
  distribute requests from a well known port to a set
  of servers running with various labels
- modify the server application to be cognizant of Smack.

Thank you.

-- 

----------------------

Casey Schaufler
casey at schaufler-ca.com
650.906.1780


-------------- next part --------------
A non-text attachment was scrubbed...
Name: SmackServices080616.pdf
Type: application/pdf
Size: 198403 bytes
Desc: not available
Url : https://lists.ubuntu.com/archives/ubuntu-hardened/attachments/20080616/60209eb1/attachment-0001.pdf 

From emgent at ubuntu.com  Mon Jun 23 17:31:03 2008
From: emgent at ubuntu.com (Emanuele Gentili)
Date: Mon, 23 Jun 2008 18:31:03 +0200
Subject: [ubuntu-hardened] Ubuntu Whitehat team - modus operandi for
	penetration tests
In-Reply-To: <1214238344.6527.0.camel@beschia>
References: <1214238344.6527.0.camel@beschia>
Message-ID: <485FCFC7.40201@ubuntu.com>

Hi

As decided in the last meeting of the Ubuntu security group, below you will be able to read what the best modus operandi (in my opinion) would be.

Tool for report is avaiable here: https://edge.launchpad.net/~ubuntu-whitehat/+archive

Cheers,

Emanuele

-- 
Emanuele Gentili 	    | Ubuntu Security Group
emgent at ubuntu.com           | https://edge.launchpad.net/~emgent

Key fingerprint: F4B7 0793 069A 217E BB9F 8925 E0AC 34C2 2201 1E9A
gpg --keyserver keyserver.ubuntu.com --recv-keys 22011E9A


-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: uwh-modus_operandi.txt
Url: https://lists.ubuntu.com/archives/ubuntu-hardened/attachments/20080623/d7adbdf4/attachment.txt 

From jeffschroed at gmail.com  Mon Jun 23 18:00:12 2008
From: jeffschroed at gmail.com (Jeff Schroeder)
Date: Mon, 23 Jun 2008 10:00:12 -0700
Subject: [ubuntu-hardened] Ubuntu Whitehat team - modus operandi for
	penetration tests
In-Reply-To: <485FCFC7.40201@ubuntu.com>
References: <1214238344.6527.0.camel@beschia> <485FCFC7.40201@ubuntu.com>
Message-ID: <c24352ca0806231000g1dd3a588m752a5aff1ed66444@mail.gmail.com>

On Mon, Jun 23, 2008 at 9:31 AM, Emanuele Gentili <emgent at ubuntu.com> wrote:
> Ubuntu White Hat - Modus operandi
>
> STEP 1
> 0. portscan IP address (with the help of nmap, nessus, etc..)
> 1. investigate active services and daemons
> 2. investigate webapps in use
>
> STEP 2
> 0. Run a search through CVE Archives with the found services and active daemons running on the computer
> 1. Run a search through CVE Archives with the webapps used
>
> STEP 3
> 0. Penetration test with active services and daemons found to be vulnerable through CVE, only non-desctructive ones (no Denial-of-Service tests)
> 1. Penetration test with used webapps found to be vulnerable through CVE, only non-desctructive ones (no Denial-of-Service tests)
>
> STEP 4
> 0. Auditing of used daemons and webapps
>
> STEP 5
> 0. In case a 0day will be found, mail the Ubuntu pentest private mailing list to organize and help writing the bugfix and eventual Advisory
> 1. Write definitive report with "UWHA" (Ubuntu White Hat Anteater) and send it to Launchpad, in case of vulnerability attach screenshot and POC.
> 2. Automatically subscribe to launchpad bug the team that handles that specific infrastructure and in case the package is in Ubuntu mirrors and it's still not fixed, then subscribe Security Team (main) or MOTU Swat (universe)
>
> STEP 6
> 0. Get in touch with the team responsible for the infrastructure for eventual DoS tests.
>
>

Nice work, make sure this is in the wiki and easy to find.



-- 
Jeff Schroeder

Don't drink and derive, alcohol and analysis don't mix.
http://www.digitalprognosis.com


From emgent at ubuntu.com  Wed Jun 25 05:15:52 2008
From: emgent at ubuntu.com (Emanuele Gentili)
Date: Wed, 25 Jun 2008 06:15:52 +0200
Subject: [ubuntu-hardened] Ubuntu Whitehat team - modus operandi
 for	penetration tests
In-Reply-To: <c24352ca0806231000g1dd3a588m752a5aff1ed66444@mail.gmail.com>
References: <1214238344.6527.0.camel@beschia> <485FCFC7.40201@ubuntu.com>
	<c24352ca0806231000g1dd3a588m752a5aff1ed66444@mail.gmail.com>
Message-ID: <4861C678.5030101@ubuntu.com>

Jeff Schroeder ha scritto:
> Nice work, make sure this is in the wiki and easy to find.

If there aren't any suggestions or changes to the document I go to copy
it in the wiki page and I will put in the next Security Team Meeting one
thread for discussion about pt schedule.

E.

-- 
Emanuele Gentili 	    | Ubuntu Security Group
emgent at ubuntu.com           | https://edge.launchpad.net/~emgent

Key fingerprint: F4B7 0793 069A 217E BB9F 8925 E0AC 34C2 2201 1E9A
gpg --keyserver keyserver.ubuntu.com --recv-keys 22011E9A




From nvalcarcel at ubuntu-pe.org  Fri Jun 27 07:36:52 2008
From: nvalcarcel at ubuntu-pe.org (Nicolas Valcarcel)
Date: Fri, 27 Jun 2008 01:36:52 -0500
Subject: [ubuntu-hardened] Ubuntu Whitehat team - modus
	operandi	for	penetration tests
In-Reply-To: <4861C678.5030101@ubuntu.com>
References: <1214238344.6527.0.camel@beschia> <485FCFC7.40201@ubuntu.com>
	<c24352ca0806231000g1dd3a588m752a5aff1ed66444@mail.gmail.com>
	<4861C678.5030101@ubuntu.com>
Message-ID: <1214548612.6922.0.camel@buster>

Can you upload uwha 1.0 to the hardy archive please (and to revu so it's
included on universe)

On Wed, 2008-06-25 at 06:15 +0200, Emanuele Gentili wrote:
> Jeff Schroeder ha scritto:
> > Nice work, make sure this is in the wiki and easy to find.
> 
> If there aren't any suggestions or changes to the document I go to copy
> it in the wiki page and I will put in the next Security Team Meeting one
> thread for discussion about pt schedule.
> 
> E.
> 
> -- 
> Emanuele Gentili 	    | Ubuntu Security Group
> emgent at ubuntu.com           | https://edge.launchpad.net/~emgent
> 
> Key fingerprint: F4B7 0793 069A 217E BB9F 8925 E0AC 34C2 2201 1E9A
> gpg --keyserver keyserver.ubuntu.com --recv-keys 22011E9A
> 
> 
> 
-- 
aka nxvl
Peruvian LoCo Team
Key fingerprint = BCE4 27A0 D03E 55DE DA2D  BE06 891D 8DEE 6545 97FE
gpg --keyserver keyserver.ubuntu.com --recv-keys 654597FE

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : https://lists.ubuntu.com/archives/ubuntu-hardened/attachments/20080627/9b9b16be/attachment.pgp 

From emgent at ubuntu.com  Sun Jun 29 17:07:45 2008
From: emgent at ubuntu.com (Emanuele Gentili)
Date: Sun, 29 Jun 2008 18:07:45 +0200
Subject: [ubuntu-hardened] Ubuntu Whitehat team -
 modus	operandi	for	penetration tests
In-Reply-To: <1214548612.6922.0.camel@buster>
References: <1214238344.6527.0.camel@beschia>
	<485FCFC7.40201@ubuntu.com>	<c24352ca0806231000g1dd3a588m752a5aff1ed66444@mail.gmail.com>	<4861C678.5030101@ubuntu.com>
	<1214548612.6922.0.camel@buster>
Message-ID: <4867B351.3080005@ubuntu.com>

Nicolas Valcarcel ha scritto:
> Can you upload uwha 1.0 to the hardy archive please (and to revu so it's
> included on universe)
>   
Intrepid uwha release backported for Hardy.
About Universe, i dont know if it`s good add "Ubuntu White Hat" tool in
it, some feedback for it?


E.

-- 
Emanuele Gentili 	    | Ubuntu Security Group
emgent at ubuntu.com           | https://edge.launchpad.net/~emgent

Key fingerprint: F4B7 0793 069A 217E BB9F 8925 E0AC 34C2 2201 1E9A
gpg --keyserver keyserver.ubuntu.com --recv-keys 22011E9A




