TRIGGER LOGON ON DATABASE

NOTE: dba and sysdba will bypass all of the logon triggers.

CREATE OR REPLACE TRIGGER LOGON_DB_TRIGGER
AFTER LOGON ON DATABASE
BEGIN
FOR rec in (select username,program,SYS_CONTEXT('USERENV','IP_ADDRESS') ip from v$session
where audsid = userenv('sessionid')) loop
IF rec.IP = 'xxx.xxx.xxx.xxx' AND rec.USERNAME = 'HR' AND upper(rec.program) in ('MSACCESS.EXE','SQLPLUSW.EXE','JREW.EXE','MSEXCEL.EXE')
THEN
EXIT;
ELSIF upper(rec.program) in ('MSACCESS.EXE','SQLPLUSW.EXE','JREW.EXE','MSEXCEL.EXE') THEN
raise_application_error(-20001,'Access Deny');
END IF;
END LOOP;
END;

http://www.red-database-security.com/advisory/bypass_oracle_logon_trigger.html

[original] oracle virtual private database

Application
application partitioning
application server node distribution
schema reference modification

RAC
service
node specify execution

Network
bandwidth limit

VPD
vpd key column
oracle user privilege
vpd schema
vpd user role
vpd user
multi-level vpd db objects
oracle user privilege
vp utl_file_dirs
vp packages

Performance
partitioning
parallel processing
resource plan

Storage
raw devices mount
dg allocation rule
raw allocation rule
lun allocation rule
raid allocation rule
disk allocation rule

Backup
backup schedual
point in time tablespace restore
transport tablespace
flashback database

OS, Operation and Administration
os user privilege
single sign on (os/oracle)
batch distribution
shared folder and failover
peak load balance schedual
responce time and resource usage monitoring

Java SSH Implementation

I found a introduce document of Java SSH Client on openssh site.

The following "free" clients are recommended for interoperating with OpenSSH from Java clients:

• MindTerm 1 is an SSH1-only implementation. GPL Licence.

  "MindTerm is an entirely FREE(*) SSH protocol 1 client program written in 100% pure Java (non-certified). It is distributed with source code since we believe that security related software can't otherwise be seriously trusted. MindTerm can be run as a stand-alone program or as an applet in a webpage. It can be run with or without a GUI (stand-alone). It has two notable features setting it apart from some other clients, built in scp file transfer and a special ftp-tunnel which works with "ordinary" ftpd's "behind" the sshd."

  NOTE: Mindterm 2 is not free.

• SSH Plugin is an SSH1-only implementation, by Matthias L. Jugel and Marcus Meißner. GPL Licence.

  "This implementation of SSH provides IDEA and RSA/PKCS#1 encryption and was originally written in 1998 by Cédric Gourio. He used a part of the old Java Telnet Applet to write his Java SSH client and so the code was similar to our old applet."

• Ganymed-SSH2. BSD style license.

  "The Ganymed-SSH2 for Java library (implementing the SSH-2 protocol) is used in Ganymed and a couple of other projects at ETH Zurich. It allows you to connect to SSH servers from within your Java programs."

But obviousely there are more implemnatations.

Netspace Foundation - Java SSH Client

Welcome to AppGate!

TamTerm(その他 / JAVA・JAVA Script)

Download: 他のOS用のソフト > JAVA・JAVA Script > インターネット＆通信

Java SSH Client

SSH for Java

SourceForge.net: SSHTools

JTA - Telnet/SSH for the JAVA(tm) platform :: start

ssh + Java - SWiK

ssh + open-source - SWiK

OpenSSH セキュリティ管理ガイド サポートページ

Mindterm, un applet Java client SSH

Java SSH Client Applet

Debian -- Package Search Results -- ssh

SSH client in command line mode

AppGate MindTerm applet running...

Java SSH Client

MidpSSH | SSH and Telnet client for Mobile devices (MIDP/J2ME)

network.openssh.devel (thread)

JAVA based SSH client

MindTerm SSH Client 3.1.2 Signed Java Applet

JCTerm -- SSH2 Terminal Emulator in Pure Java

EC-Council Certified Ethical Hacker

If you want to stop hackers from invading your network, first you've got to invade their minds.

Computers around the world are systematically being victimized by rampant hacking. This hacking is not only widespread, but is being executed so flawlessly that the attackers compromise a system, steal everything of value and completely erase their tracks within 20 minutes.

The goal of the ethical hacker is to help the organization take preemptive measures against malicious attacks by attacking the system himself; all the while staying within legal limits. This philosophy stems from the proven practice of trying to catch a thief, by thinking like a thief. As technology advances and organization depend on technology increasingly, information assets have evolved into critical components of survival.

If hacking involves creativity and thinking 'out-of-the-box', then vulnerability testing and security audits will not ensure the security proofing of an organization. To ensure that organizations have adequately protected their information assets, they must adopt the approach of 'defense in depth'. In other words, they must penetrate their networks and assess the security posture for vulnerabilities and exposure.

The definition of an Ethical Hacker is very similar to a Penetration Tester. The Ethical Hacker is an individual who is usually employed with the organization and who can be trusted to undertake an attempt to penetrate networks and/or computer systems using the same methods as a Hacker. Hacking is a felony in the United States and most other countries. When it is done by request and under a contract between an Ethical Hacker and an organization, it is legal. The most important point is that an Ethical Hacker has authorization to probe the target.

The CEH Program certifies individuals in the specific network security discipline of Ethical Hacking from a vendor-neutral perspective. The Certified Ethical Hacker certification will fortify the application knowledge of security officers, auditors, security professionals, site administrators, and anyone who is concerned about the integrity of the network infrastructure. A Certified Ethical Hacker is a skilled professional who understands and knows how to look for the weaknesses and vulnerabilities in target systems and uses the same knowledge and tools as a malicious hacker.

To achieve the Certified Ethical Hacker Certification, you must pass the CEH exam 312-50

WARNING: Students are warned against attending CEH training at unauthorized training centers. Only those who attend CEH training at EC-Council ATCs are eligible for CEH certification. Also you will be required to show proof of official CEH training attendance when you apply for EC-Council's LPT certification and Master of Security Science (MSS) degree program. Please e-mail us at info@eccouncil.org to check the authorized validity of a training center.

EC-Council has certified IT professionals from the following organizations as CEH: (Selected list)


* Cisco Corporation
* Novell
* Canon
* Hewlett Packard
* US Air Force Reserve
* US Embassy
* Verizon
* PFIZER
* HDFC Bank
* University of Memphis
* Microsoft Corporation
* Worldcom
* Trusecure
* US Department of Defense
* Fedex
* Dunlop
* British Telecom
* Cisco
* Supreme Court of the Philippines
* United Nations
* Ministry of Defense, UK
* Nortel Networks
* MCI
* Check Point Software
* KPMG
* Fleet International
* Cingular Wireless
* Columbia Daily Tribune
* Johnson & Johnson
* Marriott Hotel
* Tucson Electric Power Company
* Singapore Police Force
* PriceWaterhouseCoopers
* SAP
* Coca-Cola Corporation
* Quantum Research
* US Military
* IBM Global Services
* UPS
* American Express
* FBI
* Citibank Corporation
* Boehringer Ingelheim
* Wipro
* New York City Dept Of IT & Telecom - DoITT
* United States Marine Corps
* Reserve Bank of India
* US Air Force
* EDS
* Bell Canada
* SONY
* Kodak
* Ontario Provincial Police
* Harris Corporation
* Xerox
* Philips Electronics
* U.S. Army
* Schering
* Accenture
* Bank One
* SAIC
* Fujitsu
* Deutsche Bank
* Symantec
* Sun Microsystems
* Google Corporation
* McAfee
* Dell Corporation
* Verizon
* Motorola
* Singapore Airlines
* Infosys
* TATA Consultancy
* Wipro
* Deloitte
* Oracle

ssh and firewall

firewall の内側の Debian マシンから, 外側にある Debian マシンへの ssh
の接続を試みているのですが, ちょっとつまづいております.

http://hp.vector.co.jp/authors/VA000770/docs/NikkeiLinux00-12/config.ja.html
を参考にしてやったことは以下の通りです.

Kernel 2.4.6                                   Microsoft Proxy Server 2.0
+----------------+ STDIN  +------------+       +-----------+
|                |------->|        |-------|           |
| ssh 2.5.2p2-3  |        | proxy-klab |       | web proxy |
|                |<-------| command    |<------|           |
+----------------+ STDOUT +------------+ https +-----------+
  Client Machine                                  ^   |
                                            https |   | https
< inside >       |   |      
----------Firewall--------------------------------+---+----- 
< outside >                  kernel-2.2.19        |   |      
                          +-----------------+     |   |
                          |                 |-----+   |
                          |  ssh 2.5.2p2-3  |         |
                          |    port 443     |<--------+
     +-----------------+
        Server Machine 

Firewall の内側にある, Microsoft Proxy Server 2.0 がうけつけているポー
トは, 80 番 (http) と, 21 番 (ftp) と, 443 番 (https) にあてたものだけ
です. やろうとしているのは, Firewall の外側にある Server Machine の
sshd サーバを, port 443 (https) で走らせ, FIrewall の内側の Client
Machine の ssh クライアントから, proxy-klab という perl script を介し
て, web proxy 経由で, Server Machine の https の 443 番ポートにアクセ
スし, ssh コネクションをはるということです.

そのために, まず, Firewall の外側にある Server Machine の
/etc/ssh/sshd_config において, 「Port 22」という記述を,「Port 443」に
書き変えて, 「/etc/init.d/ssh restart」とし, port 443 番 (https) で sshd を立ち上げ直しました.

次に, Firewall の内側にある Client Machine の ~/.ssh/config で,

Compression yes
Host ip.address.of.Server.Machine
Port 443
ForwardAgent yes
ForwardX11 yes
ProxyCommand /path/to/proxy-klab %h %p

としました. そして, 本メール末尾に添える proxy-klab という perl script
を用意し, 以下のようにすると,

# ssh -v -l UID ip.address.of.Server.Machine
OpenSSH_2.5.2p2, SSH protocols 1.5/2.0, OpenSSL 0x0090601f
debug1: Seeding random number generator
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: ssh_connect: getuid 1000 geteuid 1000 anon 1
debug1: Executing proxy command:  /path/to/proxy-klab ip.address.of.Server.Machine 443
debug1: unknown identity file /home/UID/.ssh/identity
debug1: identity file /home/UID/.ssh/identity type -1
debug1: unknown identity file /home/UID/.ssh/id_rsa
debug1: identity file /home/UID/.ssh/id_rsa type -1
debug1: unknown identity file /home/UID/.ssh/id_dsa
debug1: identity file /home/UID/.ssh/id_dsa type -1

と, ここでネゴシエーションが止まってしまいます. この時, サーバ側には,

Jul 18 23:03:33 phys5 sshd[2222]: Did not receive identification string from ipp.address.of.client.Machine

というログが残っていました.

同様の環境で, proxy server が 「Microsoft Proxy Server 2.0」ではなく,
「squid-1.1.20」に変えたものだと, この方法で ssh で上手く外に出られる
ことは確認できています. したがって, 怪しいのは, この方法と MS の proxy
server との相性 (もしくは設定の違い) ということになるのですが, どなた
か同様の状況に遭遇された方はいらっしゃいますでしょうか. MS Proxy が返
すメッセージについてもう少し調べてみようと思いますが, 何でもよいので情
報を頂けたら有難いです. よろしくお願いします.

# Microsoft Proxy Server 2.0 の web proxy は ftp URL もうけつけるので
# すが, 愛用の ncftp だと外に出ることができません. Netscape では,
# ftp://UID:passward@ip.address.of.Server.Machine とアドレスを指定する
# と, うまくログインでき, ファイルのダウンロードはできるのですが, ファ
# イルのアップロードはできません. ncftp の作者は,
# FIREWALL-PROXY-README で「Note that NcFTP does _not_ work with HTTP
# proxies that accept FTP URLs. Why? Because they accept HTTP
# requests, silly, not FTP, which this program does.」とちょっとお怒り
# の様子です. ssh で上手く接続できれば ftp はいらないのですが,
# HTTP proxy を経由で, ftp で接続することができるクライアントがもしあ
# れば, 教えて下さい.

---
wada

# dpkg -l ssh
ii  ssh            2.5.2p2-3      Secure rlogin/rsh/rcp replacement (OpenSSH)

# cat proxy-klab
#! /usr/bin/perl
$PROXY_KLAB = "ip.address.of.proxy.server";
$PROXY_KLAB_PORT = 80;
$Verbose = 0;

while ($_ = shift) {
    last if ! /^-(.*)/;
    if ($1 =~ /^v+$/) { $Verbose += length($&); next; }
    print <<EOF;
Usage: proxy [option...]  
 Options:
     -v    Verbose mode
EOF
}
$HOST = $_;
if ($_ = shift) {
    $PORT = $_;
} else {
    $PORT = 23;
}
print "Verbose Level: $Verbose\n" if $Verbose;
use Socket;
($name, $aliases, $proto) = getprotobyname('tcp');
($name, $aliases, $type, $len, $thataddr) = gethostbyname($PROXY_KLAB);
$that = sockaddr_in($PROXY_KLAB_PORT, $thataddr);
socket(S, PF_INET, SOCK_STREAM, $proto) || die "socket: $!";
connect(S, $that) || die "connect: $!";
if ($Verbose > 1) {
    $Rin = &fhbits('STDIN S');
} else {
    $Rin = &fhbits('S');
}
&login;
&connect;
exit 0;
# login 処理
sub login {
    &receive(0.1);
    &send("CONNECT $HOST:$PORT HTTP/1.0\r\n\r\n");
    do { &receive(0.1); } until (/HTTP\/[\d\.]+ 200.*\n\n/);
    $Raw =~ m/HTTP\/[\d\.]+ 200.*[\r\n]+/;
    $Raw = $';
}
# connect
sub connect {
    local($rout);
    print "CONNECT\n" if $Verbose;
    $Rin = &fhbits('STDIN S');
    syswrite(STDOUT,$Raw,length($Raw));
    while ((select($rout=$Rin,undef,undef,undef))[0]) {
 if (vec($rout,fileno(S),1)) {
     return if sysread(S,$_,1024) <= 0;  # EOF
     syswrite(STDOUT,$_,length);
 }
 if (vec($rout,fileno(STDIN),1)) {
     return if sysread(STDIN,$_,1024) <= 0; # EOF
     syswrite(S,$_,length);
 }
    }
}
# send(str);
# str を送る
sub send {
    undef $Buffer;
    undef $Raw;
    while( $_ = shift ) {
 print if $Verbose > 2;
 syswrite(S,$_,length);
    }
}
# receive(s);
# s 秒入力が途絶えるまで待つ
sub receive {
    local($timeout) = shift;
    local($rout);
    while ((select($rout=$Rin,undef,undef,$timeout))[0]) {
 if (vec($rout,fileno(S),1)) {
     &abort if sysread(S,$_,1024) <= 0;  # EOF
     $Raw .= $_;
     tr/\r\000\012\021\023\032/\n/d;
     $Buffer .= $_;
     print if $Verbose > 1;
 }
 if (vec($rout,fileno(STDIN),1)) {
     &abort if sysread(STDIN,$_,1024) <= 0; # EOF
     s/\n/\r/g;
     syswrite(S,$_,length);
 }
    }
    $_ = $Buffer;
}
sub fhbits {
    local(@fhlist) = split(' ',$_[0]);
    local($bits);
    for (@fhlist) {
 vec($bits,fileno($_),1) = 1;
    }
    $bits;
}
sub abort {
    exit(1);
}

ssh を使った Firewall 越えの問題が解決したので報告致します.

From: wada@mail2.off.ne.jp
Subject: [debian-users:29218] ssh を使った Firewall 越え
Date: Thu, 19 Jul 2001 17:01:42 +0900

> firewall の内側の Debian マシンから, 外側にある Debian マシンへの ssh
> の接続を試みているのですが, ちょっとつまづいております.

> 次に, Firewall の内側にある Client Machine の ~/.ssh/config で,
>
> ProxyCommand /path/to/proxy-klab %h %p
>
> としました. そして, 本メール末尾に添える proxy-klab という perl script
> を用意し, 以下のようにすると,

Web proxy サーバの MS proxy 2.0 に telnet をかけてみたら, squid の時と
異なる反応を返してくるので, 用意した proxy-klab という perl script と
の相性が悪かったと思い, こいつを改造することを考えて ssh のプロトコル
を色々調べているうちに, 以下のソースに辿りつきました.

http://www.imasy.or.jp/~gotoh/connect.c

この connect.c をコンパイルし (gcc -o connect connect.c),
/etc/ssh/ssh_config もしくは ~/.ssh/config で,

Host Name
HostName Ip.Address.Of.Server.Machine
Port 443
#ProxyCommand /home/wada/bin/proxy-klab %h %p
ProxyCommand /home/wada/bin/connect -H Ip.Address.Of.Proxy.Server %h %p

としたらあっさり上手くいきました. お騒がせしましたがお蔭様で幸せになれ
ました.

MD5 Encryption with JavaScript

IE hole and web mail security

This summary is not available. Please click here to view the post.

authentication with php from otn