Free fakes software for linux

fakehermes project is a companion program to hermes that implements a fake (and very simple) SMTP server.

Why would I want to run a fake SMTP server?

The main use of fakehermes is to configure it as a secondary MX server. Some spammers will try to send spam directly to your least prefered SMTP server, because some secondary SMTP servers are badly configured and will relay spam to the main SMTP server without any check.

Placing fakehermes as a secondary SMTP server will receive (but not proccess) those spammers connections. Legitimate connections will retry sooner or later on the main SMTP server.

fakehermes will also log all attempts to send email through it with a very detailed log that will log not only who sent the email but also what tricks did they try to send it.

fakehermes does NOT implement a full SMTP server. It will NOT deliver ANY mail, so DO NOT try to use it as your main SMTP server.

fakechroot project provides a fake chroot environment to programs. A fake chroot allows you to run programs which require root privileges on an unprivileged user account.
For example, you can create a Debian bootstrap or a development environment and build packages inside a chrooted system using a standard non-root user account.
You can then use the apt-get command to install other packages without root privileges.
Enhancements:
- This release includes a new environment variable FAKECHROOT_EXCLUDE_PATH and fixes for the getcwd(3), readlink(2), and mktemp(3) functions.
- The chroot(2) function is now recursive and allows nested chroots.

Fiked is a fake IKE daemon that supports just enough of the standards and Cisco extensions to attack commonly found insecure Cisco PSK+XAUTH VPN setups in what could be described as a semi-MitM attack.
Basically, knowing the pre-shared key, also known as shared secret or group password, the VPN gateway can be impersonated in IKE phase 1, in order to learn XAUTH user credentials in phase 2.
The configuration supported by fiked is IKE aggressive mode using pre-shared keys and XAUTH. FakeIKEd supports algorithms like DES, 3DES, AES128, AES192, AES256, MD5, SHA1, and DH groups 1, 2, and 5. Main mode is not supported.
Basically, if you know the pre-shared key, also known as shared secret or group password, you can play Man in the Middle, impersonate the VPN gateway in IKE phase 1, and learn XAUTH user credentials in phase 2.
This attack is not new. It has been known for a long time that IKE using PSK with XAUTH is insecure, and this is not the first actual implementation of the attack.
To successfully demostrate an attack on a VPN site, you need to know the shared secret, and you must be able to intercept the IKE traffic between the clients and the VPN gateway.
There are several ways to find out the shared secret, including being a legitimate user, grabbing it from some Cisco config file, using ike-crack, or layer 8 hackery.
There are also several ways to redirect the IKE traffic to your running fiked instance, including ARP spoofing, 802.11 hostap, or layer 1 hackery.
Usage:
Usage: fiked [-rdqhV] -g gateway -k id:psk [-k ...] [-l file] [-L file]
-r use raw socket: forge source address to match < gateway >
-d detach from tty and run as a daemon (implies -q)
-q be quiet, dont write anything to stdout
-h print help and exit
-V print version and exit
-g gw VPN gateway address to impersonate
-k i:k pre-shared key aka. group password, shared secret, prefixed
with its group/key id (first -k sets default)
-l file append results to credential log file
-L file verbous logging to file instead of stdout
Enhancements:
- Bugfixes, portability changes, and support for dropping privileges.

spamdyke is a drop-in filter for qmail to provide connection-time blacklisting, graylisting, DNS RBL checking, improved logging, and more spamdyke project is a standalone program that does not use qmail source code or require patching/recompiling qmail.
For anyone who runs a mail server, spam is a problem. Its a huge problem and its only getting bigger. Unfortunately, qmail doesnt have many facilities for dealing with spam. qmail also doesnt do good logging. The qmail logs are probably useful to qmail developers but not to system administrators. Consider:
- Qmail doesnt log with a human-readable time format.
- Qmail logs dont track usable information (like senders and recipients).
- Qmail doesnt log to a single log file, making it very difficult to track an email from connection to delivery.
- Qmail logs roll over after a set size is reached (could be a few hours, could be a few minutes).
All of these things makes qmail very difficult to troubleshoot or monitor. spamdyke solves this. It monitors incoming traffic, acting as a middleman between qmail and the remote server. It catches the sender and recipient addresses as they go by and logs them to syslog. If it sees something it doesnt like (e.g. a blacklisted sender), it cuts the connection, closes qmail and fakes the rest of the SMTP transaction with the remote server. qmail thinks the remote server disconnected normally. The remote server thinks qmail is rejecting the message. Its the best of both worlds.
Some history: DJBs ucspi-tools package includes a handy little program called rblsmtpd for checking incoming SMTP connections against a DNSRBL. Initially, this seemed like a great thing (and it was) but it didnt go far enough. Lots of spam still came through. So after extending rblsmtpd to do more and more and more things, a limit was finally reached where it wouldnt go any further. Thus, spamdyke was born.
Main features:
- Reject the connection if the remote server has no reverse DNS entry.
- Reject the connection if the remote servers reverse DNS entry does not resolve.
- Reject the connection if the remote servers reverse DNS entry contains its IP address and a prohibited keyword (like "dynamic").
- Reject the connection if the remote servers reverse DNS entry contains its IP address and ends in a country code (whats the japanese word for "dynamic"?).
- Reject the connection if the remote servers IP address is listed in an IP blacklist.
- Reject the connection if the remote servers reverse DNS entry is listed in a domain name blacklist.
- Reject the connection if the remote servers IP address is listed in a given DNS realtime blacklist.
- Reject the connection if the remote server sends data before the SMTP greeting banner is displayed (earlytalkers).
- Reject the connection if the senders address is listed in a sender blacklist file.
- Limit recipients to a maximum number per connection. (Yes, this goes against RFC 821 but legitimate mail servers retry the rejected recipients, spammers dont.)
- Graylist incoming mail to specific domains (some domains can enjoy graylisting while others do not).
- Close the connection after a set idle time.
- Close the connection after a set maximum time.
Those filters end up rejecting more than 99.9% of the incoming connections to my mail server. As a result, I receive (on average) less than one spam message PER WEEK! (Down from a high of 70+ per day.) Regular correspondance with real people has not suffered.
Graylisting deserves special mention. As of 2007, its not widely used (and therefore still effective against spammers). Heres how it works:
An incoming connection is received and the sender and recipient are identified.
A log is consulted to see if the sender has sent email to the recipient before. If so, the message is accepted. If not, the message is rejected with a temporary rejection code and a log entry is made.
When the remote mail server retries the message (usually only a few minutes later), the previously-logged connection is noted and the message is accepted.
Simple, right? After the system is activated, regular correspondents first email is delayed a few minutes. After that, there are no delays. But the spam stops because most spammers dont retry their deliveries! Even when they do, they usually change their sender address to a new (fake) one, which gets graylisted.
Graylisting is amazing and makes a tremendous difference (for now). spamdyke will also:
- Bypass all filters if the remote servers IP address is listed in an IP whitelist file.
- Bypass all filters if the remote servers reverse DNS entry is listed in a domain name whitelist file.
- Log meaningful messages to the syslog (very unlike qmails logs).
- Log all SMTP traffic to aid diagnosing problems.
Enhancements:
- This release fixes a serious bug that was causing lost mail when the remote server sent the message and disconnected in a burst without waiting for a response.
- Code has been added to translate bare line feeds into carriage return+line feeds.
- Support has been added for MUAs that send their username with their AUTH LOGIN command.

Firestorm is an extremely high performance network intrusion detection system (NIDS). At the moment it just a sensor but plans are to include real support for analysis, reporting, remote console and on-the-fly sensor configuration. It is fully pluggable and hence extremely flexible. Firestorm performs a lot better than all other systems I have tested (such as snort and prelude) by as much as a factor of 2 (and thats under favourable conditions, it way outstrips the competition under a targeted DoS attack).
A Network Intrusion Detection System is a system which can identify suspicious patterns in network traffic. If a firewall is a doorman, a NIDS is an undercover KGB agent. He silently gathers intelligence and can watch an enemy even if the door security has already let them in (maybe the enemy can make fake identification documents).
Tested Platforms
Linux 2.x
FreeBSD 4.x
OpenBSD
Solaris
Should compile and run on any mainstream UNIX really...
Main features:
- Protocol anomaly detection
- Full application layer decodes
- Fully pluggable
- High performance OS Specific capture module for Linux
- Capture from libpcap files (normal AND redhat extended)
- Packet decode engine fully supports encapsulation
- Decode plugins included for many protocols (see below)
- Comprehensive snort rule support
- Wu-Manber setwise string matching
- Easy to configure; just one config file
- Can run chroot and with lowered privs (when started as root)
- Can run as a realtime process (when started as root)
- Preprocessors to allow supplementary modes of detection (eg: anomaly)
- Full IP defragmentation (passes fragroute evasion tests)
- TCP stateful inspection with window tracking
- Intelligent TCP stream reassembly
- HTTP URL normalization
- EXTREMELY fast and scalable signature engine
- Configurable token-bucket rate-limiting of any alerts
- GNOME2 based analyst console user interface
- Enhanced logging format for ease of analysis
- ELOG indexing for lightning fast sorting and filtering of alerts

mod_auth_cookie_mysql2 is a rewrite of the mod_auth_cookie_mysql module for apache 1.3. Some features were added, some were forgotten.
The module is available for apache 1.3 (mod_auth_cookie_mysql1) and apache 2 (mod_auth_cookie_mysql2). It is tested with mysql 3.x/4.x and and 5.0.x.
The current version of of this module is version 0.7.
If you want to receive a message when a new version is released, please leave your e-mail address in the announcements field at the left top of this site. This will register you to a moderated mailing list. Your e-mail address, will be kept private, it isnt visible to other users and it will not be distributed.
Basic auth is a standard authentication method in the internet. Two big disadvantages are, that on every request the username and password are transmitted to the webserver and there is no possibility to log out without closing the webbrowser.
With this module you can authorize your users with cookies. An external script sets the cookie and this module checks it against a MySQL database. The username/password combination is only one time transferred to the webserver when the external authenticator script (which sets the cookie) checks the user data. The generated cookie consists only of random session data.
So you can, for example, authenticate the user and set the cookie in a ssl connection and then use the cookie in a non-ssl environment and nobody can spy the username/password. Since the cookie is only random session data nobody can "hack" the system by manipulating the cookie values. Additionally you can add checks for session expiry and the correct remote ip on the server side.
Main features:
- Fake Basic Auth with cookies
- Cookie only consists of random session data, no username or password
- Can check expiry information stored in database against cookie
- Can check if the remote IP is equal to the IP stored in database
Enhancements:
- bug fix: return-code of function check_valid_cookies not initialized - thanks to Valerii Valeev

FakeBold Font patches for QT 4.3.x fake a bold font style and output for some fonts without bold support.

It is specially and very useful for CJK fonts. actually it works with all fonts without bold style.

Here I use FT_Glyph_Embolden to get a bold glyph.

These patches is not related to font rendering result, if you want to control font rendering result, please control fontconfig configurations.

Screenshot1: shows bold/bolditalic support with "SOng" and "Hei" Chinese font.

Screenshot1: shows bold/italic support for Chinese,Korean,Yi,Tibetan with Sans fontset(Song,SIL Yi, Tibetan machine uni fonts)