- cypherpunks-legacy - lists.cpunks.org

Personal use crypto export
by Jim Gillogly 17 Dec '03

17 Dec '03

I'm moved to repeat Matt Blaze's exercise of a couple of years ago, where he went through the rigamarole to get an Official Paper from Customs or State or whoever was in charge to take his laptop out of the country with crypto on it for his personal use overseas. His experiences finding the right person to talk to to get a form, then his inability to find a Customs official to look at it on the way back, were semi-hilarious. However, now that crypto exports in general have moved from ITAR to EAR and BXA is in charge of general crypto exports, I can't find out how to get the right form to take out a laptop with PGP (or anything else) on it. Can anybody give me a pointer to whoever thinks they're in charge of this stuff? Or have they given up on this phase? Thanks... -- Jim Gillogly 24 Winterfilth S.R. 1997, 18:38 12.19.4.10.12, 7 Eb 10 Yax, Fifth Lord of Night

6 5

Security flaws introduced by "other readers" in CMR
by Tim May 17 Dec '03

17 Dec '03

At 11:10 AM -0700 10/15/97, Eli Brandt wrote: >Non-technical point: the NSA (reportedly) has no intention of using >GAK for classified information. They know that it weakens security. > >Do the privacy of the nation's data and the security of its >information infrastructure deserve the same consideration as the >Pentagon's "Confidential" memos? When you're planning to build in a >single point of failure, this is a question you have to ask. This also applies to CMR as well. Whatever the perceived business reasons for CMR, the fact is that it introduces additional failure points. No longer will Alice and Bob be secure that at least there are no "other readers" in the channel between them (what they do with the plaintext after decryption is of course solvable by no technology). And, contrary to some of what we've been hearing, even corporations have continuing needs to know that a communication between Alice and Bob, within a corporation or crossing the corporate boundary, is not being listened to by any other person. Merger negotiations are one obvious example. (There are workarounds, I suppose. CMR could have a "override" switch to turn off the CMR to a second key. But who decides on this? Maybe a signed message from a suitable higher-up? Ah, the complexity. And executives wanting to bypass CMR can and will use other channels. So many of the goals of CMR are out of reach....) Instead of choosing an example where CMR apparently "works," such as Crispin's example of a corporation using CMR to detect (as if it weren't detectable in other ways!) that an employee is operating a porn ftp site from company computers, let me throw out some examples where CMR introduces flaws into a security system. * Andy Grove sends a PGP 5.5-encrypted message to T.J. Rodgers, CEO of Cypress Semiconductor, outlining the plans for Cypress to be acquired by Intel. However, Cypress has implemented CMR, and one of the "second readers" of Andy's message is the cryptically-named (no pun intended) "CCCP" (Corporate Crypto Compliance Police), staffed by security guards and personnel management droids. Major security flaw. (Sure, one can imagine various levels of "second readers." But I rather doubt that most of them will be _offices_, with changing staffs. While one could, for example, designate "Gordon Moore" to be the second reader of all files encrypted to Andy Grove's key, I rather doubt this is the way CMR will play out.) * Craig Livingstone, at whitehouse.gov, is the Key Compliance Officer for all communications entering or leaving the White House. Enough said? * Sheep-dipped cutouts in defense companies await their orders from DoD, but find that other readers in their companies are monitoring them. And so on. "Three can keep a secret if two of them are dead." (Ben Franklin) What will of course happen is that these "security flaws" will be plugged by subterfuge. People will stop using the corporate mail for many such tasks, and will use nonwork accounts. With some loss of efficiency, and even more opportunities for leaks. (If firewalls are in place, on outside net connections, employees can just dial out. Or use Metricom Ricochet modems, if conditions are favorable for reception. Or wait until they go home.) In fact, CMR will mostly just mean bland, interdepartmental messages get "recovered." As I said before, this is a pretty crude way to implement a kind of corporate archiving of information. Truly sensitive stuff--stuff about takeovers, foreign production plans, new products, etc.--will be encrypted with channels having no nosy security guards or Corporate Crypto Compliance Police silently listening in. Which means we're back to square one. So why does PGP, Inc. bother? And why should OpenPGP squander efforts worrying about this? --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 5

Rules of Engagement on Video
by Jim Burnes 17 Dec '03

17 Dec '03

I know this isn't directly cypher related, but oh well. An award winning film, "Waco: the rules of engagement" is now available on video. Previously running at Art Houses and Film Festivals it was produced by a few revolutionary media people. Somehow it occurred to them that all the right-wingers had beaten them to the punch making civil rights abuses known to the public. Can't have any of that now, can we? Why should *they* have all the fun? Anyway its been lauded as a very well balanced work. Not like those other people -- talking about evil, new world order conspiracies. ;-) Probably most noteworthy is the included FLIR FBI footage (Forward Looking InfraRed) which, under expert scrutiny, appears to show LEFs raining automatic fire down on citizen units trying to escape the final conflagration. Here expert scrutiny is defined as the head of research for the army night vision development group. Its definitely the cure for those times when GAK starts looking like reasonable, sensible and prudent alternative. I have absolutely no involvement or monetary connection to these people. I just wish they would have put it on video first. "Is your religion BATF approved?" ---------- Forwarded message ---------- Date: Wed, 15 Oct 1997 12:34:04 -0700 (PDT) From: SomFord Entertainment <somford(a)worldnet.att.net> To: somford(a)worldnet.att.net Subject: "Waco: The Rules of Engagement" Video Order Form Thanks for your interest in obtaining the video of "Waco: The Rules of Engagement". We are pleased to announce that it is finally available! Please check the website periodically for ongoing reviews, press, announcements and updates to the order form. http://www.waco93.com/ "Waco: The Rules of Engagement" Video Order Form Print, Complete, And Mail This Form With Check Or Money Order To: SomFord Entertainment, 8778 Sunset Bl., Los Angeles, CA 90069 Questions: 310-289-3900 1. E-Mail Address:............................................... 2. First Name:................................................... 3. Last Name:.................................................... 4. Street Address:............................................... 5. Apt. No., Other Info:......................................... 6. City:......................................................... 7. State/Province:............................................... 8. Country:...................................................... 9. Postal Code:.................................................. 10. Phone:....................................................... 11. "Waco: The Rules of Engagement" Video.........Quantity:...... $25.00 for 1 tape. $22.50 each for 5 tapes. $20.00 each for 10 tapes. Bookstores and Catalogues, Call for Bulk Order Info. All Prices Include Domestic Shipping and Handling. CA Residents Please Add 8.25% Sales Tax. 12. Total:....................................................... Make Check or Money Order Payable to: SomFord Entertainment. Comments Or Special Delivery Instructions:....................... Please allow three weeks for delivery. Thank you for your order

3 2

Re: CFV: comp.org.cauce moderated -- support privacy and anonymity
by Igor Chudov ＠ home 17 Dec '03

17 Dec '03

[This message has also been posted.] [I am objecting to a proposal that seeks to ban one-way anonymous remailers and other forms of unrepliable addresses such as spamblocked addresses]. In news.groups, WD Baseley <wbaseley(a)mindspring.com> wrote: * [my apologies to the net at large for replying sans *snecks* - I don't * know which group is read by the person to whom I'm replying.] * In article <3447bfd7.22958863(a)128.2.84.191>, phelix(a)vallnet.com * >On 14 Oct 1997 11:57:07 -0400, moz(a)server2.mich.com (John C. Mozena) wrote: * >>Igor Chudov @ home <ichudov(a)algebra.com> wrote: * >>>Vote AGAINST comp.org.cauce which wants to outlaw anonymity and * >>>use of spamblocked addresses. Go to news.groups and find the * >>>CFV for comp.org.cauce, with the ballot enclosed. * >> * >>Vote for comp.org.cauce, which protects the utility of a newsgroup and the * >>freedom of postmasters to not run anonymous posting services should they * >>not so desire. * > * >Well, I just started reading this, and I didn't really know which way to * >vote. But such an anti-anonymnity stance makes the choice clear: * > * >vote *NO*. * * Since you just started reading this, I think you need more background * before coming to a decision. I'm not trying to influence it one way * or another; I'm just trying to give you more complete information. * I'm posting and emailing, and I'm sure that if I get it wrong I'll be * jumped upon thoroughly in the newsgroups - feel free to look there and * see if that happened. By all means, as one of the opponents of the proposal and supporter of anonymity, I ask you to do so and also get your privacy-concerned friends to take a close look at the debate. For example, here's what the proponent said: Mozena>>But, what do you have against anonymity? Mozena> Mozena>Nothing. What right do you have, though, to force me and others to Mozena>inconvenience ourselves so you can post anonymously or protect yourself Mozena>from spam? * The RFD requires posters to use addresses which receive, and reply to, * email; in other words, no munged, faked, spamblocked, or other * bouncing or redirecting addresses. There is nothing that says you * must use your real name, or any other identifier, that tells who you * really are. If "the-return-of-zorro(a)example.com" receives and replies * to email, it can be used to post to the proposed group. "Anonymity", * the ability to post without anyone knowing your true identity, is not * really the issue. Even anonymous remailers will work if they forward * email in both directions. But mungs and spamblocks will not work. These are not anonymous remailers, they offer a much lower security, they are not very reliable by their very design, and the only *true* anonymity can come from a one-way remailer. The proposal, as it stands, seeks to outlaw the one-way anonymous remailers. * John Mozena's comment on anonymous posting services stems, I'm pretty * sure, from an alternative offered by several folks. The idea was: * posters would add an 'X-Real-Address' line to their posts; the * moderation bot would use that line for correspondence, but remove it * before making the post public. John Mozena and others at CAUCE were * unwilling to do this because of possible legal ramifications; John * likened it to running an anonymous posting service, and wondered what * the consequences would be should someone use it to post copyrighted or * sensitive information. Well, this is NOT true. John objected to it with the argument that he does not like unrepliable addresses appearing in newsgroups. Anyway, all this talk about the X-Real_Address: field is NOT related to true anonymity, by the very definition of the latter. -- - Igor. The average American spends a total of six (6) months in prison.

1 0

Re: Document on Customizing OpenBSD after install
by K.R. Lewis 17 Dec '03

17 Dec '03

At 10:46 AM 10/15/97 -0700, J. Joseph Max Katz wrote: AND Randy Lewis has a remark about JJMK's response....below >Re... > >In the coming weekend, I'll be updating the newuser FAQ >(for things like PPP and 2.2). I'm sure a post-install checklist would be >a welcome addition. > >B U T . . . . > >Not everyone runs things like Kerberos or DNS. Keep in mind that many >people use OpenBSD for many things and in many environs. The OpenBSD setup >on my firewall at the office is much different than the Sparc, Alpha, and >P5/133 I run it on at home. The setup on my router machine at home is also >much different than the other machines in my house. There are ways people >have setup OpenBSD on embeded systems to do things like manage the >fuel/air mix ratio on their Corvettes (OK, one person I know of planned >that, but couldn't get the financing for the car...) I hope that draws the >picture. > >As for the verification after install, that is sort of "auto-manditory"-- >if a filesystem isn't mounted right, /etc/fstab has to be checked out. If >the network doesn't work, the network files must be examined to "make it >go." As oopposed to attacking this as a checklist, how about it is >attacked as "If networking doesn't work, check hostname.(interface)"-- but >there is more to that then just files in /etc (boot -c in order to >reconfigure hardware addresses) As a user of OpenBSD, and having tried to manage projects with it for implementation of added features for customers...I could not agree with the above position. You see, if you are ALREADY familiar with OpenBSD then you will most likely know exactly what to do when installing and seting up a system. New User's Notes / Installation Checklist's will most likely be ignored by you. However, if you are brand new to the system, then an Installation / Setup Checklist (a good one) will prove to be essential. Wouldn't it be great if just about every post to these groups from a new user was one like "..hey! This OpenBSD thingy works great! The installation was a snap!.." or something like that. We all know that hardly happens now...but, it could..... I, for one, believe strongly that a good 'Overview', 'Setup Notes' and 'Installation Checklist' must somehow find it's way into the distribution. It is also clear that the machine / arch specific differences will require unique versions for each. Randy > >/---------------------------------------------------------------- >/ Jonathan Katz, jkatz(a)cpio.org / http://www.cpio.org >/ Student, Unix geek, Security guy / http://posse.cpio.org >/ President and Founder: Corinne Posse / http://jon.katz.com >/ Phone: +1 (317) 590-7092 / "OpenBSD: Secure!" >/ "The meek may inherit the earth, >/ but Gale and I will seize the stars!" > >On Wed, 15 Oct 1997, Marshall Midden wrote: > >> Is there a checklist someplace on what to do after the install of OpenBSD 2.2? >> >> I'm thinking like: >> 1) Go into /etc >> a) Verify disks and network interfaces configured correctly. >> Files: fstab, hosts, myname, hostname.le0, mygate, resolv.conf, defaultdomain. >> You might wish to turn off multicast routing in /etc/netstart. >> b) Edit motd to make lawyers comfortable and delete "Welcome". >> c) Fix passwd via "vipw" to change passwords, set up users, etc. >> Make sure password on "root". Default is no password from console, and >> disabled from network. Make sure to edit "group" for any user groups, >> and to put people into the wheel group if they need root access. >> d) Any local configuration change in: rc.conf, rc.local >> e) printcap, hosts.lpd Get printers set up >> f) Tighten security: >> fbtab Set security for X >> inetd.conf Turn off extra stuff, add that which is really needed. >> rc.securelevel Turn on Network Time Protocol. >> g) kerberosIV Get kerberos configured. Remember to get a srvtab. >> h) aliases Local mail delivery (set postmaster, etc). Run newaliases >> after changes. >> i) bootptab If this is a bootp server. >> j) ccd.conf If using concatenated disks (striped, etc). >> k) exports If this is an NFS server. >> m) NIS (old yellow pages), hosts.equiv, defaultdomain, etc. >> n) ifaliases for www, etc. >> o) daily, weekly, monthly. >> p) "amd" directory if using this package. >> q) rbootd if needed for remote booting (ethernet MAC address to IP translation). >> r) Any other files and directories in /etc. >> >> 2) crontab -l. Do you need anything else? >> 3) After the first nights security run, change ownerships and permissions on things. >> Best bet is to have permissions as in the security list. >> > > >.. . () | Kenneth R. (Randy) Lewis _/_/ _/_/ _/_/ | email: krl(a)vicomp.com _/ _/ _/ | phone: +1 919 644 6306 _/ _/ _/ | fax: +1 919 644 6409 _/ _/ _/ | smail: V.I Computer, Inc. _/ _/ _/ | 531 Encinitas Blvd _/_/ _/ | Bldg 114 _/ _/_/_/ | Encinitas, CA 92024 . . computer corp. | http://www.vmepower.com

1 0

Re: Security flaws introduced by "other readers" in CMR
by Greg Broiles 17 Dec '03

17 Dec '03

Tim May <tcmay(a)got.net> wrote: >Truly sensitive stuff--stuff about takeovers, foreign production plans, new >products, etc.--will be encrypted with channels having no nosy security >guards or Corporate Crypto Compliance Police silently listening in. > >Which means we're back to square one. So why does PGP, Inc. bother? Because they've got customers who will pay for CAKware. Why will customers pay for it? Same reason the FBI wants GAK, even though motivated/well-informed crypto users will superencrypt or otherwise bypass the enforcement mechanisms. If you're the C in CAK or the G in GAK, access to some data is better than access to no data - and the possibility of enforcement radically alters the risk/benefit calculus of even intelligent actors who see their interests as contrary to those of the [C,G]. As Jon Callas confirmed at the recent Cpunks physical meeting, the current CAK/CAM/whatever system has very weak code re policy enforcement - for example, it'll allow otherwise forbidden messages to pass through its filters if even the "--- BEGIN PGP MESSAGE ---" lines are altered or removed. It won't disassemble tar or zip or uuencode packages, or otherwise attempt to discover simple attempts to bypass the enforcement mechanisms. They're not trying to stop determined covert communicators - that's not their threat model. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

3 2

update.341 (fwd) [edited]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From physnews(a)aip.org Wed Oct 15 14:00:06 1997 > Date: Wed, 15 Oct 97 10:28:48 EDT > From: physnews(a)aip.org (AIP listserver) > Message-Id: <9710151428.AA08697(a)aip.org> > To: physnews-mailing(a)aip.org > Subject: update.341 > > PHYSICS NEWS UPDATE > The American Institute of Physics Bulletin of Physics News > Number 341 October 15, 1997 by Phillip F. Schewe and Ben > Stein > > THE 1997 NOBEL PRIZE FOR PHYSICS has been won by [text deleted] > THE FIRST SOLID MATERIAL THAT CAN REVERSIBLY > SWITCH BETWEEN METAL AND INSULATOR at room > temperature and pressure, and without changing its chemical > makeup, has been created by researchers at UCLA (James Heath, > heath(a)chem.ucla.edu) The researchers prepare a Langmuir film, > an ultrathin layer of material on a water surface. The film consists > of a 2-D hexagonal pattern of silver nanocrystals (only nm size) > with each nanocrystal's surface capped by compressible organic > molecules. Applying pressure to the film can decrease the distance > between adjacent nanocrystals from 12 to 5 angstroms. When > compressed, the film becomes shiny and its optical properties match > those of a thin metal film. Prior to compression, the film has the > optical properties of an insulator: in this state, the > nanocrystalsbehave as semi-isolated particles and they do not share > electrons. As the separation between nanocrystals decreases, the > researchers observe a transition from "classical coupling" (adjacent > nanocrystals induce the movement of charge in each other and > thereby transfer energy) to "quantum coupling" (nanocrystals begin > to share electrons simultaneously and electrons delocalize, or cease > to occupy a specific position in the material). (C. P. Collier et al, > Science, 26 September 1997) >

1 0

pna.show_story?p_art_id=409724&p_section_name=Sci-Tech
by Jim Choate 17 Dec '03

17 Dec '03

CNN Custom News logo [LINK] Home World U.S. Weather Sports Business Sci-Tech Showbiz Lifestyle alt On Target Customize Profile Help Feedback Switch User [ISMAP] InfoSeek [INLINE] October 16, 1997 3:29 am GMT [INLINE] Sci-Tech Title [INLINE] Ad Space ________________________ ___Word ___Theme ______________ Options [INLINE] The story below was selected from CNN Custom News - a new personalized service that delivers only the news that's important to YOU. Sign up now to receive your personal news stories, weather, sports scores, and stock quotes from over 100 different sources - all for FREE. If you're already a user, please login. Custom News NEW SURVEY SHOWS BIG RISE IN INTERNET USE, BUT NOT FOR SHOPPING LA Times 14-OCT-97 Consumers Don't Trust Internet Enough To Share Their Credit Card Information ORLANDO, Fla.--(BUSINESS WIRE)--Oct. 14, 1997-- More than one out of three Americans have become users of the Internet during the last year, primarily for information gathering, but decidedly not for shopping, according to a national survey reported today by a leading consumer researcher. "There is clearly something addictive about the availability of galaxies of information for the asking," said Britt Beemer, chairman of America's Research Group, the firm that conducted the research project, in his keynote address before the 21st Century Commerce & CALS Expo USA at the Orange County Convention Center. "However, it's a very different story for shopping," he adds, "where very few people (2.8 percent ) feel comfortable in using the Internet to make a purchase in cyberspace." Beemer, who pioneered the influence of fear of crime on shopping with his annual survey on the subject, says he is "surprised more people weren't actively patronizing the Internet to eliminate worry about their personal safety, particularly for shopping at night." When asked about the degree of trust they had for shopping at a store in the mall compared with a purchase via the Internet, respondents opting for the store (72.1 percent) outnumber Internet shoppers (6.7 percent) by more than ten to one, the survey indicated. According to Beemer: "Most people (77.9 percent) are reluctant for security reasons to give their personal credit card data via the Internet to a virtual salesperson, but many others (26.9 percent) don't want to buy something they can't see and touch; 14.9 percent say they always buy in stores; 11.6 percent report they like to pay cash; and 11.1 percent simply enjoy shopping too much to let their computer have all the fun." The few products that do sell at all via the Internet include computer software, books, apparel, and home furnishings, but the percentages of people actually buying are nominal, Beemer says. Consumer use of the Internet to get information in influencing various purchasing decisions does appear to be increasing, with many people (45.9 percent) reporting they sought information prior to shopping, and 9.6 percent indicating they were searching for both information and advertising. Those who use the Internet say the reason they do so is to acquire information (68.4 percent); to chat with and meet people (7.1 percent); and to keep track of their finances (6.1 percent). When it comes to information gathering, 41.0 percent are seeking the news of the day; 23.7 percent are getting data on companies; 12.8 percent are looking for help in school work; 6.4 percent are checking out stock and bond prices related to their financial status; and 5.8 percent are surfing for travel information, the study points out. "There is some hope down the road that people's fears and concern about using the Internet for various personal business purposes will ease," says Beemer. "When asked whether they would expect to make financial transactions in the future, nearly six out of ten said `no,' but nearly 10 percent (9.4 percent) answered in the affirmative," he reports. The survey was conducted during the last week of September, 1997 of a national sample of 1000 respondents. Of this number, 41.7 percent had no access to a computer either at home or at work; 24.6 percent both at home and at work; 17.7 percent at home; and 15.9 percent at work, only. The study has a margin of error of +/- 4.3 percent. America's Research Group is a leading consumer research firm, headquartered in Charleston, S.C. Its staff has interviewed three million Americans over the past dozen years, giving ARG the largest database of retail trends in America. Britt Beemer is the author of PREDATORY MARKETING, published early this year by William Morrow. Search the net: InfoSeek ___________________ ____ [Help] [INLINE] Ad Space Top Copyright © 1997 Cable News Network, Inc. A Time Warner Company ALL RIGHTS RESERVED. Terms under which this information is provided to you. [INLINE]

1 0

Checklist, expanded
by Marshall Midden 17 Dec '03

17 Dec '03

NOTE: if upgrading or restoring files, it appears that some group numbers have been changed. ----------------------------------------------------------------------------- New installation checklist, after install and multi-user boot. (Instructions for correcting not given.) 1) Login on console as "root". 2) Check the system date. Type "date". If necessary, set the system date, and/or change the symbolic link to get the correct Time Zone. 3) Put a password on root. Run "passwd". 4) Check hostname. Type "hostname". (man "hostname" if need to change, and you also need to edit /etc/myname.) 5) Verify network interfaces configured correctly. a) "ifconfig -a". Correct by editing /etc/hostname.{INTERFACE} and via "ifconfig" if you do not with to reboot. Loopback interface will look something like: lo0: flags=8009<UP,LOOPBACK,MULTICAST> inet 127.0.0.1 netmask 0xff000000 An ethernet interface something like: le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,LINK0,MULTICAST> inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 [Will someone else fill in the ppp and slip interfaces.] b) You may wish to turn off multicast routing in /etc/netstart by commenting out (place a # sign at start of line) the line: # route add -net 224.0.0.0 -interface $hostname c) Check for routing. ("netstat -r -n") It will look something like: Routing tables Internet: Destination Gateway Flags Refs Use Mtu Interface default 192.168.4.254 UGS 0 11098028 - le0 127 127.0.0.1 UGRS 0 0 - lo0 127.0.0.1 127.0.0.1 UH 3 24 - lo0 192.168.4 link#1 UC 0 0 - le0 192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 Fix via editing /etc/mygate, and using "route delete" and "route add" if you do not wish to reboot. d) If using the Bind Name Server (DNS), check /etc/resolv.conf. It might look something like: domain nts.umn.edu nameserver 128.101.101.101 nameserver 134.84.84.84 search nts.umn.edu. umn.edu. If using a caching name server add the line "nameserver 127.0.0.1" first. (Of course, you need to change "named_flags" in /etc/rc.conf and add the named.boot file in the appropriate place. Same holds true if this is the name server for you domain. Also make sure "named" is running. [Otherwise there are long waits while timeouts happen.]) e) If using "NIS" (old yellow pages), check "domainname" and edit /etc/defaultdomain to correct. [Will someone else fill in more here. I refuse to use this package.] 6) Check disks correct. a) cat /etc/fstab b) df Edit "/etc/fstab" and "umount" and "mount" as necessary. (See man pages.) c) You may want to do NFS partitions later, but you may do them now. d) If you are using concatenated disks, edit /etc/ccd.conf and use "ccdconfig -U" and "ccdconfig -C" till you have it correct. ("umount" and "mount" and edit /etc/fstab as needed.) e) Go into the "amd" directory if using this package. [Will someone else fill in more here. I do not use this package.] 7) The system should be usable now, but you may with to do more customizing, adding of users, etc. Many sections may be skipped if you are not using that package (for example kerberos!). My suggestions are to go into /etc ("cd /etc") and: a) Edit motd to make lawyers comfortable and make sure that no mention of the word "Welcome" appears. (Some U.S. lawyers have stated that the word "Welcome" is an invitation to come on in.) b) Add users. There is a "adduser" script. You can use "vipw", and edit "/etc/group" if you desire. Make sure to put people in "/etc/group", under the "wheel" group if they need root access (non-kerberos). Something like: wheel:*:0:root,m4 c) Check for any local changes needed in /etc/rc.conf, /etc/netstart, /etc/rc.local, rc.securelevel.. Turning on something like the Network Time Protocol in /etc/rc.local and /etc/rc.securelevel requires: A) Making sure the package is installed. (see http://www.openbsd.org under "Ports: a Nice Way to Get Third-Party Software). B) Uncommenting the lines in rc.local (delete the # signs). if [ -f /usr/local/etc/httpd/httpd ]; then echo -n ' httpd'; /usr/local/etc/httpd/httpd fi C) Uncommenting the lines in rc.securelevel (delete the # signs). if [ -x /usr/local/sbin/xntpd ]; then /usr/local/sbin/tickadj -Aq echo -n ' xntpd'; /usr/local/sbin/xntpd fi d) Edit /etc/printcap and /etc/hosts.lpd to get printers set up. e) You might want to tighten up security by editing: fbtab Set security for X -- when you install X ... . inetd.conf Turn off extra stuff, add that which is really needed. f) Go into /etc/kerberosIV and configure kerberos. Remember to get a srvab. g) Edit /etc/aliases. Set postmaster, etc. Run newaliases after changes. h) If this is a bootp server, edit /etc/bootptab. You will have to turn it on in /etc/inetd.conf, or run "bootpd" in stand-a-lone mode. i) If this is an NFS server A) make sure /etc/rc.conf has "nfs_server=YES". B) Edit /etc/exports and get correct. It is probably easier to reboot than get the daemons running, manually, but you can get the order correct by looking at /etc/netstart. j) Edit /etc/rbootd.config if needed for remote booting (ethernet MAC address to IP tranlation). k) Look at and possibly edit the /etc/daily, /etc/weekly, and /etc/monthly scripts. Your site specific things should go in /etc/daily.local, /etc/weekly.local, and /etc/monthly.local. l) Look at the other files in /etc and edit as needed. (Do not edit files ending in ".db" -- like aliases.db, pwd.db, spwd.db, nor localtime, nor rmt, nor any directories.) 8) Check what is running via crontab "crontab -l". Do you need anything else? Do you wish to change things? For example: 30 1 * * * /bin/sh /etc/daily 2>&1 > /var/log/daily.out 30 3 * * 6 /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out 30 5 1 * * /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out 9) After the first nights security run, change ownerships and permissions on things. Best bet is to have permissions as in the security list (the first of the two listed permissions, and the first group number of the two). Use "chmod" and "chgrp" as needed. 10) Install packages to make the system more useful. A) Install your own. Easiest way is to copy source and compile it. B) Copy vendor binaries and install them. You will need to install any shared libraries, etc. (hint: "man -k compat") C) Install any of a large number of Third-Party Software that is available in source form. (See http://www.openbsd.org under "Ports: a Nice Way to Get Third-Party Software). You may have "fun" installing due to various compiling errors. Don't get discouraged easily! Sometimes checking the mailing lists for past problems that people have encountered will result in a fix posted.

1 0

Where are another cypherpunk
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

Where are another cypherpunk mailinglist ? ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1