WhiteWinterWolf Practical IT security, *nix systems & networking

Latest articles in ‘Openbsd’

9. ---

   

   • career
   • certification
   • *nix
   • freebsd
   • openbsd

   BSDA certification review

   The five Ws

   • What: The BSD Associate (BSDA) is a technical certification on BSD systems administration. It covers DragonFlyBSD, FreeBSD, NetBSD and OpenBSD.

     This certification covers general BSD systems administration (there is not much about system architecture itself), the specificities of each covered BAD flavors, common Unix services administration, and also a few non-technical points notably on the BSD license and its difference with other licensing types.

     I personally find the official naming misleading, as the requirement for this certification actually targets system administrators, not assistants.

   • When: The BSDA has no prerequisites, but is very technical and covers a wide range of domains so I would certainly not recommend it for the beginners.

     It can be seen as the BSD counter-part of the LPIC-2 Linux certification.

   • Why: BSD systems have a different approach than Linux ones on a lot of things, both technical and non-technical. Being Linux certified does …

   Continue

10. ---

    

    • hardening
    • *nix
    • freebsd
    • linux
    • openbsd

    Do randomized PIDs bring more security?

    The issue

    I read an article in the french magazine MISC (no. 74 - July/August, 2014) publishing a flaw affecting stunnel and libssh.

    To make things short, this flaw relies on the fact that a hello cookie created by the server is generated using the current Unix timestamp (so up to the second) and the PID of the process handling the request. The exploit sends a high number of connection attempts in order to force the server to generate duplicated cookies. At the end this attacks aims to deduce the server private keys.

    The author explains that such attack is not realizable on systems using traditionnal sequential PID because it would require more than 65000 connections attempts to made in less than one second.

    However, thanks to random PIDs used on some “hardened” systems the author demonstrates that, with 20 connection attempts per seconds, there is statistically more than one …

    Continue