Having a laptop as your primary computer means that a whole chunk of your life is subject to walking off. Now, I’m no security expert, but here are a few things that I know to do in order, well, make me feel a little more secure.
First, my new computer is a MacBook. Mac OS X has a nice little feature that scrubs the files in trash as it deletes them. You can command click on the trash icon and choose “Secure Empty Trash” every time you empty it, or you can go “Finder Preferences”, click “Advanced” and check “Empty trash securely”
Next up, GPGtools. GPG is an open source implementation of PGP security. There are several small encryption related tools, but the killer one is the ability to sign and/or encrypt mail.
Next, I installed TrueCrypt. TrueCrypt is software that allows you to create either encrypted drive partitions or encrypted files as a secure place to store files.
Next, I installed Prey from http://preyproject.com/ This is free software that will help you track down your laptop should someone steal it. You can track three devices for free, including smart phones. I also enabled “Where’s my Mac?” and a cron/reverse-ssh/webserver scheme as other ways to recover my laptop should it grow legs and wander off.
For network access, I use OpenVPN to connect to my firewall, and an IPSEC tunnel to connect to my work firewall. Mike provided me a nifty VPNTracker “Player” that made configuring it a non-issue.
Just a few tips to keep my private life private…
Postfix is surprisingly flexible. When I initially set it up two years ago, I set it up to reference a database, but I had a flaw in my logic. Basically, Postfix had no idea if a domain was marked active or inactive in the database. All it knew was whether a domain was in the database or not. Postfix has a default query, that looks for key information. However, you can supercede it in your config files. So I simply commented out the old variables that it passed to the default query, and wrote a new one:
user = DB_USER
password = supersecretpassword
hosts = 127.0.0.1
dbname = DB_NAME
table = domain
#select_field = domain < -- old version, commented out
#where_field = domain <-- old version, commented out
query = SELECT domain FROM domain WHERE domain='%s' and backupmx = false and active = true
Yes, I have backupmx enabled, even though that’s a titanically bad idea, and I would never use it. Why is it a bad idea to fuction as a Backup MX server? Because spammers don’t play by the RFCs and often send spam to lower weighted MX records in an attempt to bypass spam protection.
But I never know what people may ask for in the future.
People are so curious nowadays… Today I’ve received one NMAP ping from Colorado State (I’m guessing since I recently downloaded NMAP) and one “Version” query from ISC.org. Or at least, I think I have. Oh well, no harm done.
Say what you want about Kaminsky. I mean, the man is crazy. However, being on call when your employer, a regional ISP, reboots both the primary and secondary DNS servers, makes you appreciate how important DNS is in the grand scheme of internet things. Granted, his attack is fairly novel, but yeah… I’m glad ISC makes updating BIND nice and easy.
Where the hackers are crowing and exploits are flowing, seeding new ph34r.
It’s the most wonderful time of the year.
It’s the hap-happiest season of all,
when your software’s updating and admins are hating users not on the ball. It’s the hap-happiest season of all!
Seriously, can we spread out BH DefCon et al? I mean, not that I mind updating day after day…