Subject: Re: Security issues

From: Bob Woodward <[email-masked]>
Date: Fri, 06 Dec 1996 10:00:56 -0800

First thing you do is contact their ISP and anyone else they are connected
with.  What you have is someone who is not only a willing hacker, but an
ACTIVE hacker.  ISP's don't like those kind of people because who know's
who they will hack next.  I've had three different attempts at our site,
one turned out to be an employee who got fired on the spot for it.  The
other two lost their internet access rights with their ISP.  

I'm still trying to figure out everything that goes along with being our
internet site manager but we rely on our firewall a lot.  Despite this, I
monitor the log files to see what's happening on our site.

That's about the best I can do for now to help out.  I've seen references
to O'Reilly books a lot and I'm sure they have one on system security.
Might check that out.

At 12:34 AM 12/6/96 -0600, you wrote:
>Someone was poking around my system tonight.  They grabbed a copy of
>/etc/group /etc/passwd and /etc/netconfig inside the ftp directory.
>This made me wonder just what information ought to be in those files.
>As it stood I had some usernames in the passwd and group file.  There
>were no encryped passwords though this gives me little peace of mind.
>Just what do people do to make wu-ftp as secure as possible?  Are there
>a list of tips?  Finally, once you get a poker doing this, what steps
>should be taken to keep the person who obtained real user names from
>hacking the system.
>
>TIA,
>
>Mike Richman
>U. Oklahoma
>[email-masked]
>
>
----------
Bob Woodward, Seattle FilmWorks     ([email-masked])
Data Processing Department

Visit our Web Site to learn about getting your pictures via downloads on
the Internet!
Point your browser to "http://www.filmworks.com".

---

From: [email-masked] (Jay Schuster)
Date: Fri, 6 Dec 1996 17:15:54 -0500 (EST)

> to O'Reilly books a lot and I'm sure they have one on system security.

The absolute *best* book on Internet Security I have found is:

    _Firewalls and Internet Security_
    William R. Cheswick & Steven M. Bellovin
    Addison-Wesley
    ISBN: 0-201-63357-4

The O'Reilly's are OK, but the Cheswick and Bellovin is by far the best:

    _Practical UNIX Security_
    Simson Garfinkel and Gene Spafford
    O'Reilly & Associates, Inc.
    ISBN: 0-937175-72-2

    _Managing Internet Information Services_
    O'Reilly & Associates, Inc.
    ISBN: 1-56592-062-7

-- 
Jay Schuster <[email-masked]>
The People's Computer Company	`Revolutionary Programming'