Free pain software for linux

PAiN project is a new MUD code base written in Java.
PAiN is a new MUD codebase written in Java. It provides a general purpose persistence engine (PAiN DB) and the ability to do dynamic code reloading.
Main features:
- Pure Java database engine (transparent constant-time object access, tracking of the dirty state, transactions and savepoints support).
- Static server code (connection handling, support for code reloading and base interfaces).
- Dynamic reloadable set of action classes and plugins (virtual world logic code and plugins).
- Graphical tool to administrate server and database
Enhancements:
- PAiNDB: Collections could be saved separately from object image.This option should be used if collection is not the only field of dbobject, it has size of 20-40 items and dbobject fields are changed often. Saving collection separately will reduce flushing and object backup time inside transactions.
- PAiNDB: DbObject.provideSchema() is now static method and required for all non-abstract DBObject impls. This allows to import class schema into db without object instantiation.
- GUITool: fully rewritten, modules concept added.
- Codebase: more admin console commands.
- Tinylyb: roles removed: Reset, ResetGroup. SpaceGroup was renamed to Area.
- Tinylib: more shell implemented(this shell should be used to show multipage output)
- Tinylib: online builder bugfixing.
- PAiNDB: fixed bug with error on objects removal with non-empty StringMap type fields.
- Tinylib: bugs in @build mode fixed. More complete visualization for array-type fields
- Tinylib: number of small enhancements.

stephanie is a program for hardening OpenBSD for multiuser environments.

Mmmmm, OpenBSD. Functional, secure, free. With an emphasis on security and integrated cryptography, it carries an excellent reputation for plain old "you-just-cant-hack-this-ness". Not perfect, but nothing is, at least theyre not wearing suits and lying to you.

There are a few roles where i believe OpenBSD fits perfectly. One of these is in multiuser environments, where you have large numbers of possibly malicious users with local access. Here the OpenBSD teams commitment to auditing and fixing code provides a level trust in the environment which is hard to find elsewhere. Also, their efforts to provide integrated cryptography means setting up secure access is easy. So, lets take advantage of the freely available source and tailor it to our specific needs.

Details:

In Phrack 54, route|Mike Schiffman wrote a series of patches for OpenBSD 2.4 for Trusted Path Execution (TPE). Stephanie brings a modified version of these up to speed for OpenBSD 2.8 - 3.0, along with some additional features. A trusted path is one where the parent directory is owned by root and is neither group or other writeable. The TPE works off an internal list of trusted user ids. If a given user tries to execute a file not in a trusted path, and their user id is not in the kernels trusted list, they are denied execution privileges. In real terms, this means they cant download, compile and run krad-sploit.c.

In addition to the TPE, a series of privacy patches came along too. Originally supplied as patches for the individual utilities, these are now implemented through kvm(3), and honour trusted users (ie, trusted users are allowed to see all system information). As a practical example, this means that untrusted users will only be able to see information about processes they own, and the stat tools (netstat, iostat, vmstat, etc) will generally be broken for them. It has been pointed out that by going through trying to kill every possible process id you can find other users processes, but you cant really gain any information on them, so this is not really a great concern.

The original TPE patches had one known way of bypassing the execution restrictions, which was using shell redirection to allow arbitrary interpreted language scripts to be run (perl, sh, etc). This has been fixed up, but could possibly be a big pain in the ass, so please pay attention. When an interpreter is invoked, like most things, it creates a new process group with a job count of one. When a series of commands are connected via the | character on the command line, all the commands belong to the same process group and the job count represents the number of commands eg ps -ax | grep something | awk {print $1} has a job count of three, and the ps, grep and awk processes all belong to the same process group.

The one exception to this is when a user logs in, where we find their shell has its job count set to zero. So how can we use this to prevent shell redirection for a given set of programs? We need to be able to distinguish between ordinary commands and interpreters. At the moment this is done by setting the immutable flag on them. So, in kern_exec(), if we find an untrusted user executing something with the immutable flag set and a job count greater than zero, we flag the process as being potentially dodgy. Then in other system calls we disallow read()ing from fd 0 (stdin) and things like dup2(0, n) if the process has been flagged.

There are two main disadvantages to this. First is the system will need to be brought down to single user mode if the interpreter needs to be patched, and secondly, people will have a hard time suing to an untrusted user. Of course, when a user has shell, they can still type any commands that could otherwise be placed in a shell script, but at the least, this will raise the bar a bit.

Finally, Stephanie brings restricted symbolic links, ala the openwall patches for linux. As time permits, im still working on adding additional features, and will add bits of the openwall stuff i like. The basic goal is to add an extra layer of security without being a monumental pain in the ass to legitimate users, so some things wont be there. I havent added the additional hard link restrictions of the openwall patch, but will do something about this later as time permits.

Installing:

Step by step instructions are presented in the install guide which comes with the source. Read it all first, but its reasonably straight forward. It would be a good idea to read the original article (local copy) if you havent already.

Its distributed under the original two clause BSD license, mess with it all you want, but dont get cranky at me if it breaks something.

You can also read the tpe_adm(8) man page online.

Dataxi project is a collection of tools for developing form-based information systems. Dataxi enables one to quickly build an application based on forms with which the user can access the underlying database in order to query, read, edit and write. Dataxi is the link between the user interface and the database.
Dataxi is an OS and enviroment independent product. It follows HTML and SQL standards to such extend that interoperability with all browsers and database backends should be supported.
Dataxi runs on all major operating systems as is or only with minor changes in ini -files.
The purpose of Dataxi is to take the pain away from the most boring phase in the data access application development: user interface designing and programming. Ones you have defined the layout of the form and location for columns, you are done, unless you prefer setting data validation and output format features and other niceties.
A database is a structured collection of data. It may be anything from a simple shopping list to a picture gallery or the vast amounts of information in a corporate network. To add, access, and process data stored in a computer database, you need a database management system such as MySQL. Since computers are very good at handling large amounts of data, database management plays a central role in computing, as stand-alone utilities, or as parts of other applications.
Enhancements:
- This version works with both PHP 4 and 5.

myOpenID is a small, fairly lightweight, standalone, single-user Identity Provider for OpenID authentication. The project comprises a single PHP script that can be used by one individual to run their own personal OpenID "IdP."
The program requires no external libraries, and has very minimal requirements. It should run on almost any server that runs PHP 4 or 5. It requires no database, and does not access the file system beyond session handling.
What matters is that OpenID is a promising new technology, but from a user porint of view, its a pain the butt to manage. When I wanted to actually, yknow, get an OpenID thingie of my own, I found there was no satisfactory way to make it happen. My options were to either download a complex set of libraries and build an application to handle serving up my identity, or to set up an account with a third party provider. Since I dont like bulky libraries, and I really dont like the idea of re-centralizing a decentralized framework through trusting someone else with my account credentials... I did what any good Geek would do. I made myself a third option: myOpenID.
Usage:
myOpenID is a single user (though, if you were so inclined, you could easily turn it into a multi-user setup) IdP, or "Identity Provider" for the OpenID framework. Its a single PHP script with minimal dependancies. You dont need a database, you dont need to make your filesystem writable, you dont need to download any libraries, and you dont need to recompile PHP.
Okay, well, you shouldnt need to do any of that. Installation requires an MD5 hashing utility. Why? Because you have to authenticate to it using a password. myOpenID uses HTTP Digest authentication for security, and you set your password must be encrypted when the script is set up. For Linux or OSX, I suggest OpenSSL. For Windows, there are a number of utilities available. I suggest this one by Colin Plumb will do exactly what you need.
Enhancements:
- Added support for PHP4, including a better mechanism for getting Digest authentication headers which should work with non-Apache servers
- Added a (hidden) logout mode, usable by calling myOpenID.php?openid.mode=logout
- Fixed a bug which occurred when associate mode was called and was unable to produce a secure key. Future queries from that handle would then fail check_authentication mode queries
- The lifetime for a smart-mode client is now same as the default cache life of the session minus ten seconds, which should be just under three hours
- Renamed the sha20 function to sha1_20 (to designate using sha1 to get a 20 byte hash)
- Some code and debug cleanup

Religion is a Perl module that can generate tracebacks and create and install die() and warn() handlers.

This is a second go at a module to simplify installing die() and warn() handlers, and to make such handlers easier to write and control.

For most people, this just means that if use use Religion; then youll get noticably better error reporting from warn() and die(). This is especially useful if you are using eval().

Religion provides four classes, WarnHandler, DieHandler, WarnPreHandler, and DiePreHandler, that when you construct them return closures that can be stored in variables that in turn get invoked by $SIG{__DIE__} and $SIG{__WARN__}. Note that if Religion is in use, you should not modify $SIG{__DIE__} or $SIG{__WARN__}, unless you are careful about invoking chaining to the old handler.

Religion also provides a TraceBack function, which is used by a DieHandler after you die() to give a better handle on the current scope of your situation, and provide information about where you were, which might influence where you want to go next, either returning back to where you were, or going on to the very last. [Sorry - Ed.]

See below for usage and examples.

USAGE

DieHandler SUB

Invoke like this:

$Die::Handler = new DieHandler sub {
#...
};

where #... contains your handler code. Your handler will receive the following arguments:

$message, $full_message, $level, $eval,
$iline, $ifile, $oline, $ofile, $oscope

$message is the message provided to die(). Note that the default addition of " at FILE line LINE.n" will have been stripped off if it was present. If you want to add such a message back on, feel free to do so with $iline and $ifile.

$full_message) is the message with a scope message added on if there was no newline at the end of $message. Currently, this is not the original message that die() tacked on, but something along the lines of " at line 3 of the eval at line 4 of Foo.pln".

$eval is non-zero if the die() was invoked inside an eval.

The rest of the arguments are explained in the source for Religion::TraceBack. Yes, I need to document these, but not just now, for they are a pain to explain.
Whenever you install a DieHandler, it will automatically store the current value of $Die::Handler so it can chain to it. If you want to install a handler only temporarily, use local().

If your handler returns data using return or by falling off the end, then the items returns will be used to fill back in the argument list, and the next handler in the chain, if any, will be invoked. Dont fall off the end if you dont want to change the error message.

If your handler exits using last, then no further handlers will be invoked, and the program will die immediatly.

If your handler exits using next, then the next handler in the chain will be invoked directly, without giving you a chance to change its arguments as you could if you used return.

If your handler invokes die(), then die() will proceed as if no handlers were installed. If you are inside an eval, then it will exit to the scope enclosing the eval, otherwise it will exit the program.

WarnHandler SUB

Invoke like this:

$Warn::Handler = new WarnHandler sub {
#...
};

For the rest of its explanation, see DieHandler, and subsitute warn() for die(). Note that once the last DieHandler completes (or last is invoked) then execution will return to the code that invoked warn().

DiePreHandler SUB

Invoke like this:

$Die::PreHandler = new DiePreHandler sub {
#...
};

This works identically to $Die::Handler, except that it forms a separate chain that is invoked before the DieHandler chain. Since you can use last to abort all the handlers and die immediately, or change the messages or scope details, this can be useful for modifying data that all future handlers will see, or to dispose of some messages from further handling.

This is even more useful in $Warn::PreHandler, since you can just throw away warnings that you know arent needed.

WarnPreHandler SUB

Invoke like this:

$Warn::PreHandler = new WarnPreHandler sub {
#...
};

This works identically to $Warn::Handler, except that it forms a separate chain that is invoked before the WarnHandler chain. Since you can use last to abort all the handlers and return to the program, or change the messages or scope details, this can be useful for modifying data that all future handlers will see, or to dispose of some messages.

This is very useful, since you can just throw away warnings that you know arent needed.

FireAngel is a relatively small script that should easy the pain of setting up a Linux 2.4.x iptables based firewall. FireAngel project can do basic firewalling such as specifying unsafe and safe interfaces, host/subnets and ports.

FireAngel can also set up Masquerading for you (over multiple interfaces if you really want that). Theres no fancy documentation, just a quick installation guide (a couple of lines) and a documented configuration script. FireAngel just tries to do its work as good as it can, nothing more, nothing less...

Oh and by the way... This thing comes without guarantees! I do not and will never take responsibility for faults in the script or the configuration file.

Installation:

Copy the "rc.fireangel" file to your /etc directory and edit options as you want them. If needed, create your own "rc.fireangel.allow" and "rc.fireangel.disallow" files. Copy fireangel script to /etc/init.d (or /sbin/init.d or /etc/rc.d), and make sure it gets started, either by including it in some run level, or by calling it in ip-up/ip-down or ifup/ifdown
configuration.

THC-Dialup Login Hacker is a tool for penetrating dialup modems.

All you need is UNIX and minicom. Have fun with this little release!

The internet is not the only door into a network. In this new days, wavelans are becoming popular, in old days, there were dial-in modems. But today, dial-in modems are still present in any company.

While tools for wardialing (scanning phone numbers for modems by dialing every number and checking if theres a carrier) are available for all operating systems for years, there were only a very few tools for trying to guess login/passwords against modem carriers, and they were all for MS-DOS only. Years ago, I wrote such a tool called LOGIN-HACKER, which is still in use by many people, just because theres no real choice.

About 5 years ago I completely moved from MS-DOS to UNIX (Linux and OpenBSD) so executing penetration tests became a pain in the ass for modem login hacking. Finally I wrote some scripts to hack into modem carriers for Unix as well.

To make it flexible and portable, I chose not to write my own terminal program and scripting language, like I did with LOGIN-HACKER. I just use simple Minicom scripts. And they are very effective! Also they could include more commands to interact with the operating system while the script is running, I made it possible, to autodetect almost any prompt, and detect if a login/password, or password only prompt was successfully passed or not.

OpenScientist is an integration of open source products working together to do scientific visualization and data analysis, in particular for high energy physics (HEP).
The project is definitely NOT one million lines of intricated and unnecessary complicated home made code reinventing everything.
Motivations
Experiments in high energy and nuclear physics need to be at the edge of computing technologies but at the same time have to face a very long life time (LHC experiments are going to be a matter of decades). This involves that the software must be organized in a way that permits to include or discard some technologies in an easy way without having to recode everything at each change of a piece.
For data analysis, the HEP community had used the CERN/PAW tool for years. Whilst this program had been used and is probably still used by hundred of physicists in the world, it is not any more maintained by the lab that created and promoted it : CERN. This lab had not been able to establish long term collaborative software engineering plans in order to have a technical follow up of this program and analysis tools in general. (What is astounding, is that the same people that were behind CERN/PAW come now with another tool (ROOT) which has exactly the same engineering defects).
OpenScientist is first of all an architecture trying to handle the problem differently to avoid upseting huge software phase transitions in the future. The key points of the system are the modularity and the openness. See the Languages, Coarse graining architecture, and The file formats intrinsic pain section for more about the technical choices and design.
Enhancements:
- An HDF5 driver was introduced in BatchLab.
- The build system was replaced with obuild.
- Support for CoinPython was added.
- Initial support was added for both Qt4 and SDL.
- Examples were added.
- Assorted code cleanups and speedups were done.