Re: [sentinix-list] Announcement regarding upcoming release of SENTINIX

Hi

I was wondering why you have not added webmin to Sentinix ?

Cheers
Adrian Kriel

----- Original Message ----- 
From: "Michel Blomgren" <[email protected]>
To: <[email protected]>
Sent: Thursday, January 29, 2004 2:47 AM
Subject: [sentinix-list] Announcement regarding upcoming release of SENTINIX


Hi list!

I just wanted to tell everyone what I (and Chris Hammond and Xavier) am
working on right now.

Major changes in SENTINIX (probably v 0.80):

##KERNELS##

Linux 2.4.21 will still be used, but the do_brk and the do_mremap bugs have
been patched out.  I have experienced the best result with the 2.4.21
openMosix kernel, that's why I'll stick with it.  I _might_ try and add
2.6.0
(but patched against the do_mremap bug) as the "plain" and "smp" kernel. The
kernel headers would however be 2.4.21.

I will add more kernels in the future, for example openMosix 2.4.22. But
kernel compilation does take time and I need to get the system working
before
increasing the compilation time. It currently takes about 5 hours to compile
everything (source tree + initrd sys + kernels) on my AMD XP 1800+ (w/
ATA-100 disks).

##THE COMPILER##

gcc 3.3.2 instead of 2.95.3, although 2.95.3 is still in there in order to
compile the Linux kernels. Only C and C++ are compiled in gcc (perhaps I'll
add objc too). The libc library is glibc 2.3.2.

##THE INITRD (installation CD)##

The initrd rootfs has been refurnished. uClibc has been thrown out and
replaced with the approach of simply copying in selected libs from the /lib
directory and compiling all apps for the installation CD dynamically linked
against the regular (i.e. the same) libs under /lib.  A couple of bugs have
also been resolved, boot-loadsize is now 4, not 32 and setup.manualpart is
using another approach when calling sfdisk.

##WEBINTERFACE##

Next version looks fancier, but most importantly, it's behind strong TLS/SSL
client authentication (Mozilla supports AES-256 :o). A user would have to
install a PKCS#12 key file in his/her browser in order to access it
(basically PKI). The PKCS (.p12) key is not supported by all browsers (even
if they say so), this might be a problem some users may experience. It does
work flawlessly with a recent Mozilla (+ Mozilla Firebird) and MSIE.

##SECURITY##

Well, we're still lacking a local IDS (yes, I do know about samhain and
tripwire), but Xavier is doing a great job working on what's going to be
SENTINIX's own integrity app.  It'll include file hashing+checking and
rootkit detection.  I started making what was going to be a syscall and
anti-LKM-rootkit sec module or a kernel patch, but then I read up on LSM
(Linux 2.6.0) and now I'm wondering if that's not the way we're going to go.

All network services or apps supporting network services (such as openssh,
openssl, apache, php, mod_ssl, samba, sendmail, imapd, pure-ftpd, etc.) will
be compiled with the stack-smashing protector patch for gcc by Hiroaki Etoh
at IBM http://www.research.ibm.com/trl/projects/security/ssp/. Currently,
these apps have been successfully compiled with it:

openldap
apache
mod_ssl
php
openssl
openssh
sendmail
pine (imapd, ipop2d, ipop3d, pico, pilot, pine)
lynx
links
cvs
bind
dhcpcd
dhcp (dhcpd)
nessus
samba
nfs-utils
net-snmp
libol
syslog-ng
ntp
portmap
ntop

Buffer overflows... be gone!!!  8^)

I'm working on putting all network services behind TLS/SSL (sendmail
STARTTLS+AUTH {cyrus-sasl}), imapd, ipop3d, etc.). When e.g. sendmail and
imapd is started (from an rc.d script), it'll automatically check if
certificates and keys exist, if not, the rc.d script will auto-generate
them,
so "openssl-illiterates" will get a by-default-secured sendmail, imapd, etc.

Also, I'll add some personal network sec scripts of mine that I've patched
together from various sources. One will enforce some networking security
while a couple of others will be iptables templates for more advanced
firewalling. When I wanted to enforce my router's fw rules, I noticed that
it
can take many hours to write Netfilter rules (with iptables) that do what
you
want. I wanted logging of spoofs and null+xmas+fin scans among other things.
I'll include that script too.

##CVS##

The "Source Tree" is now in CVS (all tarballs are available through rsync).
Take a look at http://developer.berlios.de/projects/sentinix/ (you'll find
more info in the README.CVS file
http://cvs.berlios.de/cgi-bin/viewcvs.cgi/sentinix/sentinix/README.CVS ).

I'm testing Subversion, I really need changesets, perhaps it'll handle big
tarballs better than CVS too. Is anyone here familiar with subversion and
willing to give me some hints???

##BINARY PACKAGES##

As you might have heard, SENTINIX is going modular. All apps will be
packaged
into packages (.sx.tgz) containing binaries.  These packages are being (or
are about to be -- I'm still working on the generator) auto-generated during
the compilation process of the Source Tree.  Once done, an admin is going to
be able to upgrade/remove packages using a simple command line tool (sxpkg).
I'll also be working on making sentinix installable from http, ftp and sftp
(although, this feature will not be in the next version of sentinix).

##PACKAGE LIST##

Hang on, here's a list of all the packages in the current (my private)
Source
Tree, generated from "make versions" under the /usr/src directory...

linux-includefiles-2.4.21-i486-1
man-pages-1.60-i486-1
glibc-2.3.2-i486-1
binutils-2.14-i486-1
gcc-3.3.2-i486-1
coreutils-5.0-i486-1
zlib-1.1.4-i486-1
findutils-4.1.20-i486-1
gawk-3.1.3-i486-1
ncurses-5.3-i486-1
vim-6.2-i486-1
libtermcap-1.3.1-i486-1
m4-1.4-i486-1
bison-1.875-i486-1
less-381-i486-1
groff-1.19-i486-1
sed-4.0.8-i486-1
flex-2.5.4a-i486-1
gettext-0.12.1-i486-1
tcpip-slackware-9.1-i486-1
gdbm-1.8.3-i486-1
perl-5.8.2-i486-1
whois-4.6.9-i486-1
texinfo-4.6-i486-1
autoconf-2.57-i486-1
automake-1.7.8-1.4-p6-i486-1
bash-2.05b-i486-1
file-4.06-i486-1
libtool-1.5-i486-1
bin86-0.16.14-i486-1
bzip2-1.0.2-i486-1
diffutils-2.8.1-i486-1
ed-0.2-i486-1
kbd-1.08-i486-1
hdparm-5.4-i486-1
e2fsprogs-1.34-i486-1
reiserfsprogs-3.6.11-i486-1
grep-2.5.1-i486-1
gzip-1.3.5-i486-1
which-2.16-i486-1
man-1.5m2-i486-1
nasm-0.98.38-i486-1
lilo-22.5.8-i486-1
make-3.80-i486-1
modutils-2.4.25-i486-1
patch-2.5.4-i486-1
procinfo-18-i486-1
procps-3.1.14-i486-1
psmisc-21.3-i486-1
shadow-4.0.3-i486-1
sysklogd-1.4.1-i486-1
sysvinit-2.85-i486-1
tar-1.13.25-i486-1
util-linux-2.12-i486-1
gcc-2.95.3-i486-1
linuxmandocs-2.4.21-i486-1
calcpercent-0.1-i486-1
installwatch-0.6.3-i486-1
gdb-6.0-i486-1
strace-4.5.1-i486-1
ksymoops-2.4.9-i486-1
db4-4.1.25-i486-1
mailx-8.1.1-i486-1
traceroute-1.4a12-i486-1
popt-1.7-i486-1
logrotate-3.6.3-i486-1
nano-1.2.2-i486-1
iptables-1.2.9-i486-1
libpng-1.2.5-i486-1
libjpeg-6b-i486-1
freetype-2.1.5-i486-1
glib-1.2.10-i486-1
minicom-2.1-i486-1
mm-1.3.0-i486-1
libpcap-0.7.2-i486-1
tcpdump-3.7.2-i486-1
readline-4.3-i486-1
openssl-0.9.7c-i486-1
wget-1.9-i486-1
curl-7.10.8-i486-1
nail-10.5-i486-1
lynx-2.8.4-i486-1
gmp-4.1.2-i486-1
mysql-4.0.17-i486-1
gd-2.0.15-i486-1
apache-1.3.29-i486-1
portmap-5-i486-1
cyrus-sasl-2.1.15-i486-1
openldap-2.1.23-i486-1
samba-3.0.0-i486-1
eject-2.0.13-i486-1
cron-2.3.3-i486-1
dhcp-3.0pl2-i486-1
dhcpcd-1.3.22-pl4-i486-1
parted-1.6.6-i486-1
debianutils-1.16-i486-1
openssh-3.7.1p2-i486-1
bind-9.2.3-i486-1
bc-1.06-i486-1
ntp-4.2.0-i486-1
biew-550-i486-1
gpm-1.20.1-i486-1
mc-4.6.0-i486-1
pure-ftpd-1.0.17a-i486-1
libnet-1.0.2a-i486-1
libnids-1.18-i486-1
dsniff-2.3-i486-1
nmap-3.48-i486-1
netwox-5.7.0-i486-1
scapy-0.9.16-i486-1
netcat-110-i486-1
lftp-2.6.8-i486-1
raidtools-1.00.3-i486-1
zoneinfo-sentinix-linux-i486-1
links-2.1pre14-i486-1
slocate-2.7-i486-1
cdrtools-2.00.3-i486-1
infozip-2.3-5.30-i486-1
usleep-unknown-i486-1
sendmail-8.12.10-i486-1
procmail-3.22-i486-1
oggvorbis-1.0-i486-1
mad-0.15.0b-i486-1
sox-12.17.4-i486-1
mpg321-0.2.10-i486-1
nfs-utils-1.0.6-i486-1
bchunk-1.1.1-i486-1
gcal-3.01-i486-1
mhash-0.8.18-i486-1
http_fetcher-1.0.3-i486-1
fetch-1.0-i486-1
fping-2.4b2_to-ipv6-i486-1
qstat-25c-i486-1
radiusclient-0.3.2-i486-1
net-snmp-5.0.9-i486-1
nessus-2.0.9-i486-1
nagios-1.1-i486-1
snort+acid-2.0.6-i486-1
bmon-1.2.1-i486-1
replimenu-0.9.1-i486-1
dialog-0.7-i486-1
openmosix-tools-0.3.4-i486-1
rexima-1.4-i486-1
cdparanoia-III-alpha9.8-i486-1
cdp-0.33-13-i486-1
gnupg-1.2.3-i486-1
sharkwrapper-0.3-i486-1
python-2.3.2-i486-1
sysstat-5.0.0-i486-1
fblogo-0.5.2-i486-1
clamav-0.65-i486-1
sentinix-perlmodules-1.0-i486-1
spamassassin-2.60-i486-1
mailscanner-4.25-14-i486-1
pine-4.58-i486-1
ngrep-1.41-i486-1
ansirem-NA-i486-1
announceuptime-0.1-i486-1
ipaudit-0.95-i486-1
tcptrace-6.6.0-i486-1
lsof-4.69-i486-1
makedev-2.3.1-58-i486-1
ipfm-0.11.5-i486-1
iptraf-2.7.0-i486-1
ettercap-0.6.b-i486-1
rsync-2.6.0-i486-1
rcs-5.7-i486-1
cvs-1.11.10-i486-1
libol-0.3.11-i486-1
syslog-ng-1.6.1-i486-1
screen-3.9.9-i486-1
miscrequired-1.0-i486-1
sentinix-rc.d-1.0-i486-1
sentinix-setuputility-1.0-i486-1
cgitoolkit-0.1-i486-1
rrdtool-1.0.45-i486-1
ntop-2.2c-i486-1
cacti-0.8.4-i486-1
snortcenter-1.0beta-i486-1
bandwidthd-1.2.0b-i486-1
sentinix-mysqldatabases-1.0-i486-1

Packages will be named something like e.g. rrdtool-1.0.45-i486-1.sx.tgz.

##FINAL NOTE##

If anyone is interested in helping out with something listed above, let me
know!

The best way to keep in close contact with me is to join the #sentinix
channel
at server irc.sentinix.org, my nick is "replikan".  I have strange uptimes,
so people on the american continent will probably find me there during and
after their working hours. ;)

That's it folks... for now!
Stay tuned!

Michel

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix