New way of thinking about the Internet

Just wanted to give a thanks for posting this. I have registered in Open Directory and on other search engines but I am sure you know how long that takes. I didn't want to get slashed so I avoided that like the plague.

Thanks again,
Scott

Well, who would like to guess how long it will take until it goes down?

How long until each service is disabled (usually due to DoS attacks). How long until new registration are either made insanely difficult, or stopped completely. How long until the box mysteriously drops off-line without any warning?

if you havent already, you should talk with someone who administers a free shell account server, like grex or arbornet or freeshell (lonestar) and find out about the problems that come with such a setup, like the kiddies constantly trying out new rootkits, DoS's due to irc, spammers using your system, porn/vendors using it as a redirect method, etc.

yes, i read your list, but still want to make sure you're forwarned about how frustrating it can become when every second person who comes to use your system really is trying to abuse it; i'd want OpenYetIronWill.org

I've seen a few projects like this before. Compaq did a really good job with their open-access evaluation servers; they firewalled the hell out of them. By that I mean that they allowed most anything incoming (you could run your own daemons and stuff and talk to them, but they still blocked DOSs etc.), but you cound't connect to anything from an account within the box. I'm not suggesting that you necessarily take that approach, but there's not really any reason to allow users to connect to other machines out there on the net, at least not a login session (telnet, SSH, etc.). IRC will probably get you in trouble in short order as well, and wach out for spammers.

Write yourself a nice little user agreement, use the tools available in OpenBSD (chroot jails, profiling, etc) to keep your box as un-0wn3d as possible while still providing users with functionality. Keep an eye on people and nuke their accounts when they are obviously trying to cause trouble.

Congratulations, you're officially a BOFH. Welcome to the club (-:. Now where did I put my etherkiller...

this is great! i too have wanted to do something like this, but bandwidth restrictions and the fear of having anonymous users rip it apart has kept me from implementing it. kudos to you for giving it a go.

i'm curious though... what measures have you taken to ensure that your users don't root the machine within a couple of days? i'm sure you have all the standard stuff in place (firewall, maybe an IDS, quota, etc...), but what other things have you done to make the system secure?

Let your freak flag fly!

Best of luck. What's the liability if someone does evil things, like hacking .mil addresses from your box? Just a thought. Have fun.

feels like this is a good place to talk about securing an OBSD shell server, right?
so how would you do it?

snortbridge;
chroot;
systrace;
freebsd syscalls^H^H^H^H^H^H^H^H^H^H^H^H^H
Stephanie/trojanproof;
hire Dug Song;
zonealarm^H^H^H^H^H^H^H^H
etc etc - yes/no?

I want to know, and I bet I'm not the only one.
just looking for experience.

Hi,

If any BOFH's want to trade shells for traceroutes and other network diagnostic utilities, mail me. I can also do sec. dns, mail caching and more.

Check out http://www.userid.org/config.txt for my dmesg info.

Great! Very generous! Don't let them scare you away;).

i did not see any mention of a written "security policy"/"acceptable use policy". the only thing i saw was mention of "some rules".

if you don't have an AUP you have skipped a very important first step. you certainly want to set preconditions to account creation. user _must_ agree to the conditions set forth _BEFORE_ you ever give him/her an account. if you have not done this then you may find yourself in a major legal pickle if/when someone uses your host to attack another system.

Why? i dont get the point of it all... is it that hard for people to run their own servers? kiddies and other irc punks that just have to stay on the server 24 hours a day?

i think it is a waste, and it will get abused very quickly. you have to ask yourself what kinda person would be interested in shell accounts and jump on the first mention of it... not the kinda people i would want on my network/boxes.

but that is just me, sure i will get DoS'd in 15 seconds... oh ph33r...

--

times are different, lots of kids dont care of have ethics in this whole thing. shells accounting would be great if it actually was used as intended and not abused, but time and time and time again, it has shown that what is intended is not how it eventually gets used.

i am all for community and group growth in a unix environment, but i also know that alot of what i would like to happen, wont happen. not cause i think so, but from what has happened.

maybe it will be different this time, maybe slashdot didnt attract a bunch of linux redhat monkeys jumping for a place to run a eggdrop.

i could be wrong, but i am willing to bet that i am not... we'll see if the server(s) you have up for these shells accounts still exist in 6 months... if you still have hair and dont mind phone calls from other admins complaining about your user's actions...


just my opinion,
chris

I ve been on shells for quite a while now. For two reasons: 1. My networks in the place that I live in, in Asia, does not have a network fat enough to do anything well. 2. to get around censorship rules/crowded corridors etc.. by port redirection. I dont know if I am doing something wrong by actually using a box like this for such purposes. Anyways, let us know.I really dont use shells for much else. Increasingly, one gets locked out for doing anything at all. Anyways, Kudos to you man. Great work. Wish I could do something like that.I would promptly put up something like that. :-). Static IPs are expensive, and so are the bloody rates for anything related to telecom. anyways,keep up the good work. And no, i dont have an account on your system yet. :-) Shaji

You might want to check out http://freeshell.org/

They have NetBSD servers supporting a ton of users, and have been around for a few years.

You can find a list at www.bylur.net/free/ , for instance...

friend has a site with alot of info, and one of the things she has a topic on is shells:

http://speedygrl.com/shells.html

sdf.lonestar has been around for a while.