<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 24/04/11 22:02, Chris Robinson wrote:
<blockquote cite="mid:772031.36249.qm@web114718.mail.gq1.yahoo.com"
type="cite">
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt;"><font face="Arial">...<br>
</font>I have just ordered Kogan's Agora 12" laptop preloaded as
it will be with 11.04. It will be going on holiday with me to
USA in August.<br>
</div>
</blockquote>
<br>
If you don't want the US TSA getting their grubby mitts on your
laptop, you will need to have it encrypted and powered off when you
go through their facilities.<br>
<br>
<a class="moz-txt-link-freetext" href="http://www.schneier.com/blog/archives/2009/07/laptop_security.html">http://www.schneier.com/blog/archives/2009/07/laptop_security.html</a><br>
<a class="moz-txt-link-freetext" href="http://www.schneier.com/blog/archives/2008/03/tsas_ideal_lapt.html">http://www.schneier.com/blog/archives/2008/03/tsas_ideal_lapt.html</a><br>
<a class="moz-txt-link-freetext" href="http://www.schneier.com/essay-217.html">http://www.schneier.com/essay-217.html</a><br>
<br>
Disclaimer: i have no idea whether this makes it more likely for you
to get refused entry to the country. Personally, i wouldn't take a
laptop with data i care about to another country without
considerable investigation into my rights and responsibilities in
taking the laptop through customs. I would save myself the effort
and just buy a small, cheap laptop explicitly for the purpose. Or
more likely, buy one when i get there, because it's cheaper.<br>
<br>
<blockquote cite="mid:772031.36249.qm@web114718.mail.gq1.yahoo.com"
type="cite">
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt;">
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt;">
<div style="font-family: times new roman,new york,times,serif;
font-size: 12pt;"><font face="Arial"> Considering the
extensive WiFi access over there I am seeking some advice
on what protection I will need?<br>
<br>
-------------------------------------------------------------------<br>
I've just been playing with Firestarter for it's DHCP
server capability, but it also seems to be a very good
firewall. </font></div>
</div>
</div>
</blockquote>
<br>
Obviously, firewalls are important. Most publicly-accessible
systems are attacked by random malware on a daily/hourly/minutely
basis. I like Shoreline Firewall (<a class="moz-txt-link-freetext" href="http://shorewall.net/">http://shorewall.net/</a>). It is an
iptables frontend that makes it easy for people who know what they
are doing to get a workable configuration. It is ridiculously
well-documented. It may not be a good match for you, depending on
your skills.<br>
<br>
<blockquote cite="mid:772031.36249.qm@web114718.mail.gq1.yahoo.com"
type="cite">
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt;">
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt;">
<div style="font-family: times new roman,new york,times,serif;
font-size: 12pt;"><font face="Arial">I think I'd also
disable SSH while on insecure networks, and make sure that
there's no other ports open. Apart from SSH this is the
default for Ubuntu/Linux.<br>
</font></div>
</div>
</div>
</blockquote>
<br>
I usually change the default port on ssh, and prohibit
password-based login. The variables you want to change in
/etc/ssh/sshd_config are:<br>
<ul>
<li>Port ### (where ### is an unused port number less than 1024 -
look for spares in the 700-900 range in /etc/services)<br>
</li>
<li>PermitRootLogin without-password</li>
<li>PasswordAuthentication no</li>
<li>UsePAM no<br>
</li>
</ul>
<blockquote cite="mid:772031.36249.qm@web114718.mail.gq1.yahoo.com"
type="cite">
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt;">
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt;">
<div style="font-family: times new roman,new york,times,serif;
font-size: 12pt;"><font face="Arial"><br>
Oh, and pick a really good password. </font></div>
</div>
</div>
</blockquote>
<br>
BTW, the definition of "really good password" is probably 20
characters or greater. Don't worry about complexity; don't worry
about special systems, just go for length:
<a class="moz-txt-link-freetext" href="http://news.electricalchemy.net/2009/10/password-cracking-in-cloud-part-5.html">http://news.electricalchemy.net/2009/10/password-cracking-in-cloud-part-5.html</a><br>
<br>
<blockquote cite="mid:772031.36249.qm@web114718.mail.gq1.yahoo.com"
type="cite">
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt;">
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt;">
<div style="font-family: times new roman,new york,times,serif;
font-size: 12pt;"><font face="Arial">I revised my own
security arrangements when I discovered from auth.log that
"people" had been trying to log in via ssh as root.<br>
</font></div>
</div>
</div>
</blockquote>
<br>
The ssh changes i suggested mitigate this. Note, however, that they
require you to have a public key created and usable (Google for
ssh-keygen to find out more).<br>
<br>
Paul<br>
<br>
</body>
</html>