c0t0d0s0.org

Nils zitiert in "Impressionen eines Wahlhelfers" den Verein Mehr Demokratie e.V.:

Beim Volksentscheid vom Oktober stimmten 365.133 Hamburgerinnen und Hamburger für verbindliche Volksentscheide. Bei der jetzigen Bürgerschaftswahl stimmten 331.184 Hamburgerinnen und Hamburger für die CDU und Ole v. Beust. Der Volksentscheid scheiterte, Ole v. Beust aber bleibt Bürgermeister.

We´ve announced a new tape library: The SL3000. Up to 3000 tapes. Up to 56 drives. It´s a smaller system for people who doesn´t need the massive sized SL8500 (we had a gap here before, the SL8500 was too large and the SL1400 to small for some customers)

Okay, i finalized my SMF tutorial. Was a good distraction from other events ...

Part 1: Introduction
Part 2: The foundations of SMF
Part 3: Working with SMF
Part 4: Developing for SMF
Part 5: Conclusion

Okay, I hope i was able to give you some insights into the Service Management Framework. It´s a mighty tool and this article only scratched on the surface of the topic. But there are several excellent resources out there.

Okay, now you know how to do basic tasks. But how to use SMF for your your own applications. I will use openvpn as an example. A good source for this program is blastwave. Please install the package tun and openvpn

I want to show a running example, thus we have to do some work. It will be just a simple static shared key configuration, as this is a SMF tutorial, not one for OpenVPN. We will use theoden and gandalf again. gandalf will be the server. theoden the client.

After so much theory SMF may look a little bit complex but it isn´t. For the admin it´s really simple. You can control the complete startup of the system with just a few commands.

The additional capabilities of the SMF comes at a price. SMF has to know more about your services. Most of the new components of the SMF has to do with this capabilties. So we have to define some foundations before doing some practical stuff.

The Service Management Facility is a quite new feature. But sometimes i have the impression that the most used feature is the capability to use old legacy init.d scripts. But once you use SMF with all it´s capabilties, you see an extremly powerful concept.

VMware again. Sun and VMware announced an OEM agreement:

Sun Microsystems (NASDAQ: JAVA) and VMware Inc. (NYSE: VMW) today announced an OEM agreement to expand their virtualization offerings. Starting today, Sun is offering the VMware Infrastructure product suite on Sun hardware systems with full support from Sun.

Hope this will result in another usecase for the internal USB ports of the new x86 systems soon.

My considerations about the security of virtual machines seem to be correct. The Register writes about a VMware Workstation exploit in VMware vuln exposes the perils of virtualization:

The exploit uses a specially crafted path name to access folders that are being shared between the host and virtual environments. VMware applications fail to validate the malicious parameters passed from the guest system to VMware's Shared Folders mechanism. The Shared Folders mechanism then hands off the bad data to the host system's file system, which allows the exploit complete access.

At the end virtualisation is based on software and software has bugs. Such exploits are inevitable. You have to consider this in your security policies. You can´t assume that a virtual server is as secure as a physical one. This is not a problem, you just have to take it into consideration.

On the foundations of Dtrace the security specialists Tiller Beauchamp and David Weston created a tool for finding vulnerabilties in your code (or writting exploits, depends on your objectives). It uses the mechanisms of DTrace and extends them. As Internetnews writes in Blackhat: Dtrace a Rootkit:.

Sun's Dtrace application was developed primarily as a tool to help monitor functions on Solaris. According to a pair of security researchers at the Black Hat conference, you can also use Dtrace as the basis for a rootkit-like tool for offensive and defensive security operations.

Finding vulnerabilties and writting exploits are different sides of a special case of debugging code. And debugging is exactly the job, we´ve developed dtrace for. It was really obvious, that someone will use dtrace for such an usecase.

Vor einiger Zeit habe ich hier ja mal eine Hoerempfehlung für Vortex von Collide ausgesprochen (Ist das wirklich schon fast drei Jahre her ??). Jetzt haben kaRIN und Statik von Collide und Dean Garcia (von Curve) unter dem Bandnamen "The Secret Meetin" erstmalig zusammengearbeitet. Herausgekommen ist dabei das Debütalbum Ultrashiver.

Beide Bands sind ja in ihren jeweiligen Musikrichtungen wohlbekannte Groessen. Das merkt man dem Werk auch an. Ausfälle gibt es keine, der Standard wird durchgehend hoch gehalten. Und kaRIN hat nunmal eine perfekte Stimme fuer diese Musik. Wenn man an eher dunkeler elektronischer Musik gefallen gefunden hat, so ist diese Musik definitiv ein Reinhoeren wert. Eine Hoerempfehlung fuer einzelne Stuecke gibt es diesmal nicht. Man muss die CD in voller Länge auf sich wirken lassen.

To my grandmother:it was only one hour ago
it was all so different then
there's nothing yet has really sunk in
looks like it always did
this flesh and bone
it's just the way that you would tied in
now there's no-one home
(from Peter Gabriels "I grieve")
She died yesterday evening. She passed away gently and without pain after a really long life. Gute Reise, Oma, wo immer du jetzt auch bist ...

Until i´ve finalized my next larger article, i want to give spotlight to a really small, but really useful feature: One relativly unknown feature of recent versions of pkgadd is the ability to load packages directly from web. You just have to specify an URL:

# pkgadd -d http://www.blastwave.org/pkg_get.pkg

## Downloading...
..............25%..............50%..............75%..............100%
## Download Complete


The following packages are available:
1 CSWpkgget pkg_get - CSW version of automated package download tool
(all) 3.8.4

[..]

Installation of was successful.
#

That´s all. As the packages just have to be accessible by http, you can use an existing internal webserver to serve your favourite "must-have" extra packages and install them directly from there. Okay, and solves the problem nicely to get started with Blastwave without moving around the pkg_get package via ftp