TLS via SMTP is opportunistic which makes connections vulnerable to man-in-the-middle-attacks. In order to prevent mitm-attacks, DANE could be used. The sender-server will first check the domain-records if dnssec is in use(and valid) and if a TLSA-record is published(and valid). If a TLSA-record is valid and matches with the certificate of the recipient-server the connection could be encrypted and the encryption is verified. Postfix was one of the first smtp-servers that implemented DANE since the author of the DANE protocol is a postfix-developer. This article describes how to enable DANE in postfix.

DNS is one of the oldest but also one of the most important network protocols we have and actively use. Dan Kaminsky discovered 2008 some serious flaws in DNS which is very well explained on this site. DNSsec is supposed to solve those problems.

I am very surprised that statx-fun got one of my most popular git repositories. Arkadiusz Miśkiewicz even created a PLD-Linux-package for it. I didn’t expect that.

Every time I replace an old hard disk by a newer or bigger one I think that I’ll wipe it later. Now I have a big amount of hard disks to wipe. Since wiping takes ages, I don’t want to use my personal computer for that. I would prefer a small device with low energy consumption just for wiping. That’s why I am going to build a “Nukestation”. Basically it’s just a Raspberry Pi with nwipe on it and a udev-rule for automatically wipe attached hard disks. But some extras would be nice…

Darkik’s Boot and Nuke(DBAN) is an open-source programm for securely wipe hard drives but reached it’s end of life. There is a fork called nwipe.  On Debian it can be easily installed by calling “apt-get install nwipe” and works almost the same like dban.

Dnsmasq is a great piece of software. Described in few words I would say that it is a dns-forwarder, dhcp-server and tftp-server. I like the way dnsmasq can be configured. A-Records can be created by simply adding entries in /etc/hosts and I define dhcp-hosts by adding lines in /etc/ethers. But we live in very strange times. Google-DNS, Cloudflare-DNS and QUAD9 are open dns servers, but might spy on us(if a service is free to use in the internet, then we might not be the customer but the product). All the DNS-resolvers of our ISP aren’t trustworthy either since the EU already decided to force ISP’s to block sites. But blocking sites might not be the only problem. The one who controlls your dns-requests, is also able to route your traffic which could be used for Man-in-the-middle-attacks to gain control. So I decided to install a dns-recursor in my network. Dnsmasq does its jobs satisfyingly but it needs another dns-recursor. That’s why I want to add a recursor and use it together with dnsmasq. A very handy dns-recursor is unbound. It’s easy to configure and does DNSsec.

Overview

• System affected: suricata
• Software-Version: prior to 4.1
• Impact: Code-Execution. The impact for this vulnerability is considered as low because an attacker could exploit this for code execution only if the configuration-file is not protected properly.

Overview

• System affected: Suricata-Update
• CVE: CVE-2018-1000167
• Software-Version: 1.0.0a1
• User-Interaction: Not required
• Impact: Remote-Code-Execution

I wish you a merry Christmas, beautiful holidays and a happy new year.