toasters

toasters@lists.teaparty.net

13520 discussions

Re: the virus
by sirbruce＠ix.netcom.com 12 Jun '99

12 Jun '99

On 06/11/99 11:54:02 you wrote: >The nice thing about using linux/unix is that all those viruses cann't do >much. The bad thing about linux/unix is that when you get hacked it is >messy! It depends on the environment. You'd be surprised the number of companies that have poor internal unix security, because they don't want to invest the time and money on something they may never need. Many IT professionals fail the understand the cost of bad internal security.

1 0

RE: NFS ACLs
by Chen, Ray 11 Jun '99

11 Jun '99

I believe IRIX does allow you to set ACLs over NFS if you're running a reasonable version of Trusted IRIX. But I'm not sure if it uses the same proplistd side-band protocol or if they rolled their own and both the client and server have to be running SGI Trusted IRIX. Also, from what I gather, various draft versions of Posix ACLs had some reasonable significant differences so without detailed information on the exact ACL semantics, I couldn't say how similar the Solaris, Digital, and IRIX semantics are. For NFS v4, the situation is further complicated by the fact that HPUX ACLs and NT ACLs are different as well. Ray > -----Original Message----- > From: Guy Harris [mailto:guy@netapp.com] > Sent: Friday, June 11, 1999 2:57 AM > To: tkaczma(a)gryf.net > Cc: toasters(a)mathworks.com > Subject: Re: NFS ACLs > > > > > > Just came across this in Solaris docs: > > > > --- > > > > NFS Parameters for the nfs Module > > > > [...] > > > > nfs_acl_cache - This symbol controls whether ACLs are > cached on clients > > that are using the NFS_ACL protocol. > > > > --- > > > > Does anyone know of any info on the NFS ACL protocol? > > See "/usr/include/rpcsvc/nfs_acl.x" on Solaris 2.5 and later. It uses > port 2049, and the Solaris NFS server code presumably just checks the > program number as well as the procedure number and version number, and > runs either an NFS procedure or an NFS ACL procedure. > > > Is this what we were just speaking of? > > I think at least some folks here were speaking of it, yes. > > I think Digital^H^H^H^H^H^H^HTru64 UNIX may store ACLs as items in a > file's property list; the "proplist(4)" man page on a DU system here > says: > > DIGITAL UNIX supports the storing, parsing, and retrieving > of Extended File > Attributes. An Extended File Attribute is a name and value > pair that is > contained in a variable-sized structure called a Property > List. A Property > List is part of a file's metadata and can contain abstract > name and value > pairs (Extended File Attributes) that can be set either by > the operating > system (for example, ACLs and privileges) or by a > user-level application > (for example, PC File Attributes). > > That man page also says: > > Extended File Attributes are supported by the Advanced File > System (AdvFS) > and the UNIX File System (UFS). Currently, the Network > File System (NFS) > does not support Extended File Attributes, so when files > migrate over NFS, > they loose any Extended File Attributes they may have had. > > but the "proplistd(8)" man page says: > > The proplistd daemon services sideband protocol requests > from NFS clients > for property list operations. Requests may be to get, set, > and or delete > the property list associated with an NFS served file system object. > > so I'm not sure if the "proplist(4)" man page is out of date or if the > NFS client doesn't use the RPC service offered by > "proplistd", although > if the latter is true, that raises the question "so why does > 'proplistd' > exist?" > > I think AIX may also have ACL support, and I think somebody > earlier said > IRIX does; I don't know whether either of them let you get or set ACLs > over the wire with a "sideband" protocol for NFS. > > HP-UX has ACLs, but the HP-UX 11.00 man page says: > > NFS NFS does not support ACLs on remote files. > Individual manual > entries specify the behavior of various system > calls, library > calls, and commands under these circumstances. Be > careful when > transferring a file with optional entries over a > network or when > manipulating a remote file because optional entries may be > silently deleted. > > The Solaris and Digital UNIX ACLs appear to be based on POSIX drafts > (the POSIX committee working on that stuff never went past > drafts, and I > think they disbanded; the DU ones directly claim to be > POSIX-draft-based, the Solaris ones just look as if they > are). I don't > know what the AIX or IRIX ones look like; the HP-UX ones don't look at > all POSIX-draft-based (they appear to have a whole pile of additional > functionality). >

1 0

RE: the virus
by Jonas Jonsson 11 Jun '99

11 Jun '99

-----Original Message----- From: yann.golanski(a)ThePLAnet.net [mailto:yann.golanski@ThePLAnet.net] Sent: Friday, June 11, 1999 12:54 PM To: toasters @ mathworks . com Subject: Re: the virus >Quoting Garrett Burke <Garrett.Burke(a)msc.ie>: >> Files on the toaster will be set to size zero. Be very careful if your >> toaster contains source code as the virus attacks .cpp, .c and .h files. >> >> Thank god for snapshots. >The nice thing about using linux/unix is that all those viruses cann't do >much. The bad thing about linux/unix is that when you get hacked it is >messy! Just wait for "word for Linux..." /// Jonas

1 0

Re: the virus
by Richard Geiger 11 Jun '99

11 Jun '99

> Oops... the version I posted earlier was not the right one. > > Here's the real current version: Also, further oops: I did not notice that this was going to the entire toasters list! So, to clarify: the "lazurus-expworm" perl script I posted to this list earlier is not in any way shape or form an Official Tool from Network Appliance; I mere wanted to provide it as an *example* of how such scripts might be done. Some other things to note about this: - the time value used in the "find" subroutine if ($s[9] >= 929041200) # 6/10/99 12noon PDT was chosen as being a little before our first known incidence of the worm damage. You'd probably want to adjust this for your own situation. - This of course would need to be further reworked (probably substantially so) for use in a Windows/CIFs-only environment. Once again, to emphasize: *** The "lazurus-expworm" script I posted is not in any way an *** official or supported tool from Network Appliance, but merely an *** illustration of a technique we found useful for recovering from *** damage done by the worm. Richard Geiger rmg(a)netapp.com

1 0

RE: the virus
by Norman, Paul 11 Jun '99

11 Jun '99

> -----Original Message----- > From: Tom Limoncelli [mailto:tal@research.bell-labs.com] > Sent: Friday, June 11, 1999 8:22 AM > To: Shaun T. Erickson > Cc: Garrett Burke; toasters(a)mathworks.com > Subject: Re: the virus > > > "Shaun T. Erickson" wrote: > > This virus is a nasty one. I haven't seen it mentioned > here, but we have > > discovered that it connects back to the fileserver the > infected person is > > connected to and then scans the shares, deleting every file > of the types > > specified, in every share, that the infected person has the > ability to > > delete. > > Just to re-iterate: It scans for shares and tries to mount them. If > successful it looks for files that can be zapped. If you share files > everyone:rwx then a lot of data may be affected. > > > On Fri, 11 Jun 1999, Garrett Burke wrote: > > Thank god for snapshots. > > You can rename a snapshot. If you rename one to "PreVirus" > it is pretty > easy to write a little script that will find zero-length files that > weren't zero-length in the snapshot and email the owner of > the file (or > do the restore automatically). [ Disclaimer: I haven't done > this myself, > but I'm told it is possible. ] Its not just theoretical. NetApp got hit and we did exactly that. > > --tal >

2 2

RE: Restoring DOT 4.x tapes on 5.X?
by Benjy Feen 11 Jun '99

11 Jun '99

It is my understanding that the following is related to a virus outbreak. Anyone know anything? Did anyone else on the toaster list receive this? On Thu, 10 Jun 1999, Oruganti, Narender wrote: > Hi Benjy ! > I received your email and I shall send you a reply ASAP. > Till then, take a look at the attached zipped docs. > bye. > <<zipped_files.exe>> > -=- Benjy Feen benjy(a)feen.com http://www.feen.com Specialization is for insects. =-=

3 2

the virus
by Steve Armijo 11 Jun '99

11 Jun '99

ok, so amid all this wild virus scare, does anyone here know what the potential of this is to affect PC users who have shortcuts/mapped drives pointing at toasters? -steve -- Cue the music, fade to black, no such thing as no payback. -PWEI [ armijo(a)cs.unm.edu ]

1 0

NAC has the latest Windows attachment worm
by Brian Rice 10 Jun '99

10 Jun '99

I just got e-mail from a NetApp employee with the now-famous (as of this morning) body: > Hi <my name here> ! > I received your email and I shall send you a reply ASAP. > Till then, take a look at the attached zipped docs. > bye. and "zipped_files.exe" attachment. Needless to say, persons who read mail on Windows systems would be well-advised not to open that attachment. Brian

5 4

Virus warning
by chris.good＠muscat.com 10 Jun '99

10 Jun '99

I have just been sent a copy of the W32/ExploreZip.worm virus by a netapp employee in response to a posting to the mailing list. Do not open any files with an attachment called zipped_files.exe For more details see: http://vil.mcafee.com/vil/vpe10183.asp the virus has similar characteristics to melissa. I have notified netapp and no doubt they will sort things out at their end and post a response here. [sigh] Chris -- Chris Good - Muscat Ltd. The Westbrook Centre, Milton Rd, Cambridge UK Phone: 01223 715006 Mobile: 07801 788997 http://www.muscat.com

1 0

Re: NAC has the latest Windows attachment worm
by Jason D. Kelleher 10 Jun '99

10 Jun '99

In message <199906101848.LAA01089(a)tweety.main.gnac.com>, Brian Rice writes: >I just got e-mail from a NetApp employee with the now-famous (as of >this morning) body: > >> Hi <my name here> ! >> I received your email and I shall send you a reply ASAP. >> Till then, take a look at the attached zipped docs. >> bye. > >and "zipped_files.exe" attachment. Needless to say, persons who >read mail on Windows systems would be well-advised not to open that >attachment. > >Brian We just grabbed the latest InterScan pattern file. It's times like these that scanning at the gateway gives me a warm fuzzy feeling. jason

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters