Missing me some Slackware...

I haven't played with Slackware in quite awhile.  I still run a server through Linode.com but I no longer have Slackware installed as an OS (I'm using Ubuntu for ease of use...yes, it is easier to maintain compared to Slackware and I've not run into any 'gotchas' yet).  I run one machine that has Slackware installed (it's sorely in need of an update, though) and it is being used as a NIDS system.  I've another machine with Slack on it that hasn't been turned on in months (it's OS version is even older than the other system).  I'll probably turn on this system and begin to use it again, but it is in very sore need of cleaning (it has 4-5 hard disks with data ALL over the place).

I'm trying to resist the urge to run Slackware in a VM on my Alienware system.  It will require me to probably get more RAM (I'm trying to resist that idea for now).  I do not want to attempt a native install, as I don't feel like experimenting to get Slack to work on that system.  The integrated and dedicated GPUs will probably be an immediate issue, as well as the fact that my system is running two 750GB drives in RAID0.  And, that is also my gaming system.  There's no real need for me to install Slackware natively on my system.  But, I will definitely install Cygwin, since I can leverage it's tools (such as GnuPG) without having to open a shell and have an internet connection.  Cygwin is the less complicated of the aforementioned options.

But I am missing using Slackware, which is why I've been trying to be more active at ##slackware on irc.freenode.net.  The thing is, I also have a fetish for Open- and FreeBSD, so I've been focusing on both of those the past few years.

Researching and found an old flamefest spark

Reference:

http://mythtv.beirdo.ca/ircLog/channel/1/2008-07-14

Summary: At LQ.org, there was a discussion on the security forums on how vulnerable Linux was to attacks/malware. Someone didn't like what was being discussed because of typical Linux zealotry. What happened on LQ's forums spilled over into ##slackware on IRC. Dagmar, the instigator of a LOT of bad things that used to happen in ##slackware got perm banned by me. Later, documented in the link above, he is his typical self, not even attempting to objectively explain what the whole thing was about, pretty much slandering me about how flawed my thoughts are on the whole thing and is worrying that I'll propagate bad information.

Let me explain some things about myself. I'm an IT security engineer. I don't just mess with routers and I'm not some glorified network engineer. I'm a senior consultant. I not only consult, I'm able to find "needle-in-the-haystack"-type info using packet-level analysis. Most of what I do requires that I be a jack-of-all-trades in network engineering, but my specialty is security. I'm proficient in utilizing many industry-leading security tools, both freeware and commercial software. I work at a very large ISP/telecom within a large managed security services team. I am THE lead of a government security operations center. We manage well over 100 customers' security posture via firewalls, NIDS, HIDS, and IPS appliances, using ArcSight, an aggregation and correlation tool that is fast becoming the standard in security event monitoring.

Every day, we see machines being compromised...this is nothing new. The compromises span every mainstream OS. This includes Linux. Whether it is kernel level or application level is not the argument. The argument is that Linux is not as rock-solid as everyone makes it out to be. Sure, it has more safeguards than Windows-based systems, but it is still susceptible to application-level exploits. Whether this is a coder issue or PEBKAC/user/admin issue is besides the point.

People need to stop thinking that just because they are running Linux, they are safe. That is NOT the case. This is not paranoia speaking. It is from seeing such things happen on a daily basis during security event monitoring. Due to applications such as PHP-Nuke, it is becoming more difficult to secure back end applications. It is much harder to stop SQL injection than it is to stop SSH brute-forcing, for instance. This isn't the only issue, though. The issue is the perception that because Linux code is open and free, the code base is free of vulnerabilities. That is NOT the case. Also, many people think that a majority of the cracker focus is on Win32 because MS has a majority of the market share. That also is NOT the case. That is a big assumption. milw0rm and other such sites document many *nix-based vulnerabilities, along with Bugtraq at Securityfocus track all vulnerabilities. Sometimes, people justify Linux because its security model is better focused than Win32 systems. It is, but that does not mean that Linux is rock-solid. It has its own faults, whether it is the user, the admin, or the software developer (or even kernel developer).

Dagmar has a habit of blocking out people's opinions and sometimes beating people down with his own. Dagmar thinks he knows security more than anyone else when he's just a developer. I see attacks every day on all types of machines. Some of the attacks are successful. I doubt that Dagmar sees those. Dagmar need not worry about me "propagating" untruth, because what I say IS the truth. All you have to do to see the truth is to research and not be blind to other opinions.

Dagmar also stalked. After the IRC discussion, he began to frequent the LQ security forums and respond to every thread I posted to. He was hardly ever in those forums before then. I noticed this immediately (and also checked). I didn't mind this, but when it spilled back over into IRC, I tired of it and wanted it ended...it really had no place in ##slackware and I was fed up with his attitude about the whole thing. I don't suffer drama very well.

Now, Dagmar has been banned several times before for the lack of tact in the way he 'helped' people in ##slackware. He was walking a thin line to begin with. Those with operator status in ##slackware acknowledge that he is knowledgeable, but that is not grounds for him to be dismissed as an abusive ##slackware visitor. Sure enough, he did the same thing with a channel operator (me) and I banned him. I also discussed it with the other operators. The consensus was that he stay banned since his history of being banned was substantial.

That was why he got banned...not because his views went against my own, but because he started regressing back to his former self and became abusive. He did the same in the LQ.org forums, but I was able to filter his posts from my normal views. As an operator at Freenode.net, I can't and shouldn't filter any visitor from my views in ##slackware, so my only option was to ban him, and like I said before, he'd his own infamous nature that was going against him.

As a security consultant, I'm certainly not going to keep my thoughts quiet about what I think is a disservice to my favorite operating system. I certainly know more than someone who is not a security consultant about IT security...its what I get paid to do and its what I've been doing for years. It's the same as a person who has built his own car, vs. someone who works as a senior Mercedes mechanic.

As much as I can, I tell people that there is NO secure OS. It is only as secure as the admin makes it, and even if the admin puts 100% resources into hardening the box, it will never be 100% secure. The LQ security forums is itself proof that Linux systems get compromised more than most people think. 2-3 times a week, someone reports they've been compromised. There's even 4 threads on Linux-based vulnerabilities:

Kernel Vulns
Mozilla Firefox Vulns
The Problem with PHP Application Security
Failed SSH Login Attempts

I can post a ton of other links but why do this when there is Google?

Did some ##slackware log archiving...

Yeah, I had to do some archiving of the logs, as diskspace usage was at 96%. I didn't just archive the channel logs, but also archived my snort and web logs. About the only thing I haven't archived yet are the modsecurity logs (will do that sometime this weekend). Currently, the host's drive space is currently at 74%. The channel logs are still in place, but I've crunched the logs into monthly tar.bz2 files. This renders the logs unsearchable by google (yeah, this sucks), but I had to compromise...they are still downloadable, just not searchable. So, if you need them, they are there for download. Once you download them, you can grep each tar.bz2 after uncompressing them. Hopefully, Google still has the logs cached so that a person searching for an item can still see the cached files. Maybe I'll purchase more drive space so that I can host the logs in an untarred and uncompressed format in the near future.

Speaking of the channel, there has again been some ruckus about someone being banned 'unduly'. People have to recognize that moderating a channel does come at a price. One of these prices is the fact that people can't visit their frustrations on the channel. An individual visited the channel highly upset that Pat froze Slackware-current relating to issues with both the 2.4 and 2.6 kernel. Instead of following advice to follow up with Pat, he continues to vent on the channel, causing a rather heated flame war over something trivial. He was +q'd (meaning his speech was removed), but he evaded +q. He was then "removed" (meaning he was booted, not kicked, from the channel), but came back in the channel with the same attitude. He was then banned for 30 days. Anyone who evades moderation will automatically get a ban. Why 30 and not 7 days? Because, behind the scenes, in private message, the individual was very argumentive and I didn't feel like dealing with him 2 days later for the same offense. After reading the logs, someone had the gall to mention in the channel that the ban was unwarranted...this person thought that the individual was banned because of his views...WRONG. Read the channel guidelines. It states specifically that any +q/ban evasion will be dealt with in a rather harsh manner. Many people do not realize that the ops will never be able to please every single person's views in the channel. I've been doing this a LONG time (4+ years) and no matter if I just sit there and let the channel run itself or if I step in and boot someone, someone ALWAYS complains. It's a no-brainer for me: moderation is what it is. You can take it or leave it. There aren't too many channels on Freenode that aren't moderated. By nature, moderation pretty much means you can't state everything you feel, especially when it ruins the continuity of the channel chat. Is this an oxymoron, especially since Freenode is inhabited mostly by coders and free-thinkers? Every discussion, whether its in real-life in a conference or in someone's home or online on a forum or in a chat room/channel, will have some type of moderation. So, going forward, I'll not be including comments to the ban messages, as this adds confusion to why the person was banned. Really, the channel doesn't need to know why said person was banned after the fact. The ban messages are for the person being banned and it was designed that way by the people who set up the IRC specifications. If you want to know why someone was banned, speak with them directly or read the logs. I've no time to hold some lengthly dialog with someone who thinks that everyone should join an IRC channel and unload their frustrations. I try to think as objectively as possible on anything that goes on in the channel and to be quite honest, there's been a ton of bitching about the ops lately. When I see the non-ops quit pushing the ops' buttons, I'll take them more seriously and get more active in seeing to their needs...but the bellyaching has to stop first. Seriously, its usually the same people bitching about their rights being violated, and if its not the same people, there's usually some association.

Slackware Wikipedia Entry, ##slackware road rage that has to stop

Here it is: http://en.wikipedia.org/wiki/Slackware

The above link is for people who constantly enter ##slackware asking what Slackware is about or how it compares to other distributions.

The questions are highly irritating, as the information is ALL over the internet and people tend to not use http://www.google.com as it was intended. There are comparisons between Slackware and other distributions everywhere. Information on Slackware and its philosophy is also everywhere, so it is a bit ridiculous going to ##slackware and asking for comments, especially when one will most likely receive biased opinions: of course we aren't going to slight our own distribution.

##slackware on the whole has become very weird lately. We've lost a few old-timers that offered excellent support. We've also decided to kill the more off-topic banter unless there is absolutely nothing else to chat about...then we tend to get visitors who think we serve them like it is a paying job and we're customer support. We also have regulars who try to dictate to the channel operators the way the channel should be run...they pretty much threaten to hijack the userbase by opening other channels if they don't get their way or say in the matter.

I should explain how things should work:

1. I'm the head operator of ##slackware on irc.slackware.com. I maintain the channel's chat flow. I don't lord it over the channel. Proof that I do not abuse operator power is documented in your own IRC client logs (if you've visited ##slackware) or at http://wigglit.ath.cx/slackware_botlogs/.

2. The guidelines are enforced by the operators based on the guidelines posted at http://wigglit.ath.cx/slackware-rules/rules.shtml. Those rules SUPERCEDE the server guidelines (http://freenode.net/channel_guidelines.shtml). What's good for the server isn't necessarily good for our channel. Don't complain to the server ops about this because they will not become involved, as is their policy...they don't govern the channels, that's what the channel ops are for.

3. The channel guidelines are just that: guidelines. They are there to give the visitors an inkling of what's accepted and what's not. These are not constitutional laws, so when you find yourself banned because you think we won't take away your speech and we do, realize that IRC doesn't give you the right to tell someone to fuck off or post porn links or 'fight the man', with 'the man' being the channel operators.

4. Visitors should NOT expect us to answer every question that is asked. Some of us have day jobs. Some have families. Some may not have the experience or knowledge to answer the question. Some don't care. Don't expect the conversation to gravitate toward you when you ask a question. Current discussions may not stop when you ask your question, so don't get ticked off...keep asking (within limits; don't spam the channel with the same question every 60 seconds or you will get removed), maybe every 3 or so minutes. Also, BE SURE YOUR QUESTION PERTAINS TO SLACKWARE, AND NOT SOFTWARE THAT MAY BE INCLUDED IN SLACKWARE'S BASE INSTALL!! This means that if you've an issue with KDE or a KDE application that's installed on your Slackware distribution, your issue isn't slackware-related, its KDE-related, unless you can PROVE that the underlying issue is indeed related to Slackware. This also applies to hardware.

5. If anything happens in the channel that upsets you, take a deep breath and use your IRC client's ignore function to filter out the unwanted chatter. Don't take the matter into your own hands by insulting the offender, as you may become kicked or banned from the channel, regardless of your intentions. We recently had an incident where someone decided to attack someone based on the perception that the victim was overweight. The offender was asked to stop with a 'first and last warning' but continued 10 minutes later and was banned. Also, at this point, the victim had previously been passive to the attack, but became aggressive when the attacker ignored the operator's warning. After the attacker was banned, an onlooker decided to join the fray by insisting that the victim should also be banned because the victim defended himself by attacking also. The fact remains that the first attacker was banned because he directly ignored an operator's warning. The onlooker was also banned because he couldn't this issue, which was none of his business, die. Is all of this considered favoritism? In the above context, no, but if you're someone who is used to inciting anarchy, the rules/guidelines of ##slackware will never be enough. This is why every operator is empowered to handle things as they see fit, even when an abuser's tactics skirt the guidelines.

6. Lastly, if you bait an operator just for the sake of skirting guidelines, you're going to lose that battle. An intellectual debate is one thing, a targeted yet subtle attack is beyond the norm and will be dealt with.

I'll probably be posting the link to this entry to ##slackware so people can be aware of how assinine the drama in ##slackware has been lately.

A good example of some of the above activity can be found at this link:

http://wigglit.ath.cx/slackware_botlogs/slackware.log.27Aug2006

Use your browser's find function to find 'corto' and read from there until he gets his voice taken (around 4:22PM).