Free step by step software for linux

stephanie is a program for hardening OpenBSD for multiuser environments.

Mmmmm, OpenBSD. Functional, secure, free. With an emphasis on security and integrated cryptography, it carries an excellent reputation for plain old "you-just-cant-hack-this-ness". Not perfect, but nothing is, at least theyre not wearing suits and lying to you.

There are a few roles where i believe OpenBSD fits perfectly. One of these is in multiuser environments, where you have large numbers of possibly malicious users with local access. Here the OpenBSD teams commitment to auditing and fixing code provides a level trust in the environment which is hard to find elsewhere. Also, their efforts to provide integrated cryptography means setting up secure access is easy. So, lets take advantage of the freely available source and tailor it to our specific needs.

Details:

In Phrack 54, route|Mike Schiffman wrote a series of patches for OpenBSD 2.4 for Trusted Path Execution (TPE). Stephanie brings a modified version of these up to speed for OpenBSD 2.8 - 3.0, along with some additional features. A trusted path is one where the parent directory is owned by root and is neither group or other writeable. The TPE works off an internal list of trusted user ids. If a given user tries to execute a file not in a trusted path, and their user id is not in the kernels trusted list, they are denied execution privileges. In real terms, this means they cant download, compile and run krad-sploit.c.

In addition to the TPE, a series of privacy patches came along too. Originally supplied as patches for the individual utilities, these are now implemented through kvm(3), and honour trusted users (ie, trusted users are allowed to see all system information). As a practical example, this means that untrusted users will only be able to see information about processes they own, and the stat tools (netstat, iostat, vmstat, etc) will generally be broken for them. It has been pointed out that by going through trying to kill every possible process id you can find other users processes, but you cant really gain any information on them, so this is not really a great concern.

The original TPE patches had one known way of bypassing the execution restrictions, which was using shell redirection to allow arbitrary interpreted language scripts to be run (perl, sh, etc). This has been fixed up, but could possibly be a big pain in the ass, so please pay attention. When an interpreter is invoked, like most things, it creates a new process group with a job count of one. When a series of commands are connected via the | character on the command line, all the commands belong to the same process group and the job count represents the number of commands eg ps -ax | grep something | awk {print $1} has a job count of three, and the ps, grep and awk processes all belong to the same process group.

The one exception to this is when a user logs in, where we find their shell has its job count set to zero. So how can we use this to prevent shell redirection for a given set of programs? We need to be able to distinguish between ordinary commands and interpreters. At the moment this is done by setting the immutable flag on them. So, in kern_exec(), if we find an untrusted user executing something with the immutable flag set and a job count greater than zero, we flag the process as being potentially dodgy. Then in other system calls we disallow read()ing from fd 0 (stdin) and things like dup2(0, n) if the process has been flagged.

There are two main disadvantages to this. First is the system will need to be brought down to single user mode if the interpreter needs to be patched, and secondly, people will have a hard time suing to an untrusted user. Of course, when a user has shell, they can still type any commands that could otherwise be placed in a shell script, but at the least, this will raise the bar a bit.

Finally, Stephanie brings restricted symbolic links, ala the openwall patches for linux. As time permits, im still working on adding additional features, and will add bits of the openwall stuff i like. The basic goal is to add an extra layer of security without being a monumental pain in the ass to legitimate users, so some things wont be there. I havent added the additional hard link restrictions of the openwall patch, but will do something about this later as time permits.

Installing:

Step by step instructions are presented in the install guide which comes with the source. Read it all first, but its reasonably straight forward. It would be a good idea to read the original article (local copy) if you havent already.

Its distributed under the original two clause BSD license, mess with it all you want, but dont get cranky at me if it breaks something.

You can also read the tpe_adm(8) man page online.

TrustWatch Search by GeoTrust is a Firefox extension that allows you to search with Trust on Google, Yahoo! and MSN.

This extension uses the popular TrustWatch anti-phishing service so you can see real-time/in-line site rating information for all your search results. Currently support the Google, Yahoo! and MSN search engines.

Also, you can report suspicious sites for fraud or phishing and see a detailed site report about the web site at your fingertips.

Other features allow you to submit fraudulent webmail with a simple right click report function.

Powered by Linux is a KDM theme created after a wallpaper of the same name. It was tested on KDE 3.5.6.

PySyCache is an educational program for young children (4-7 years old).

pysycaches purpose is to teach them to manipulate the mouse by uncovering a picture with mouse movements.

This game doesnt want some powerfull computer, and it can be used at home with yours children or in the schools

The target of PySyCache is that child must show a picture hidden by a cache. In this order, the mouse movements erase the cache and the picture appears step by step.

Sudoku Savant is a simple GUI-driven application to solve and generate Sudoku puzzles through logical means.

Sudoku Savant generates and solves standard Sudoku puzzles with anything from 3x3 to 5x6 or 6x5 grids, using the following strategies:

- Singletons
- Locked candidates
- Number subsets
- X-Wings, Swordfish and Jellyfish
- Both Simple and Multi-Colouring.

These strategies should be enough to provide a step by step solution for any Sudoku puzzle that you are likely to find in a newspaper or magazine, although Savant can also resort to "trial and error" if presented with something really pathologically nasty. (This will at least confirm that the puzzles solution is unique.)

You may also parameterise or turn off the more advanced strategies, to see whether they were really needed.

Finally, Sudoku Savant lets you solve the puzzle by hand, providing hints, cell colouring, up to 4 pencil marks per cell, and the ability to high-light any incorrect moves. A partially completed puzzle can be saved in a simple text format so that you can continue solving it later.

SCAP-Java is an automatic thematical mapping software. It draws colors or symbol maps from your data, with step by step procedures coherent with the cartography semiology methodology.

SCAP-Java was developed for education and map production, with an emphasis on usability: its easy to create a PDF map from spreadsheet data and geospatial datasets (mif/mid).