Today we have a very special guest, not only for the studio and our other hosts, but for me personally and professionally. Our show today is called Ma'ili'ili Musings, Sustainable Agriculture in Waianae. And we're going to talk to our guest, Frankie Kothi, a little bit more about Ma'ili'ili, what it is, and her extremely amazing watershed management project in Ma'ili'ili, on the west side of Oahu. So usually our show we're talking to farmers or chefs or restaurateurs, and I always want to talk about the people who make all that farming happen besides the farmers, the people who help the farmers behind the curtain. So today we have Frankie Kothi, Project Coordinator of Oahu Resource Conservation and Development Council. Super long name, right? Also known as Oahu RC&D, an organization very close to me because I work for them as well. So Frankie is my colleague and co-worker, and she and I have been working together for about two years now, working with farmers in the field, providing technical assistance, community outreach, and conservation planning. But today she's the star of the show, not me. We're not talking about me. So right now I'd like to take a quick second and introduce and do a warm introduction for Frankie Kothi. Oh, thanks, Steph. Hi, Frankie. Hey. I'm going to pretend like I don't know you at all. Sounds good. So Frankie, so you work with this organization called Oahu RC&D. I thought maybe you could give us a quick elevator pitch of what that is. Yes. Okay. So Oahu RC&D, which we do go by the acronym a lot more, is a sustainable agriculture nonprofit. And our work mainly focuses on the farmer and those partners of the farmers. And we reach out to them and help to promote stewardship of the islands through community outreach, like workshops and events, conservation planning and technical assistance. People who are having trouble on the lands and need some help, we're here for them and can provide them resources. And of course watershed management and watershed restoration, which is the grant that I work under. And yeah, it's been a really great project and learning experience to be under. And so it seems you're talking about watershed management. I think a lot of times when people, you know, I don't think people are sitting around all day thinking about watersheds like we are. So I thought you could just take, just give us a brief overview of maybe what a watershed is and why is it so important specifically to farming? Definitely. So watersheds basically run Mt. Kutimakai, mountain to ocean. Anything that is up higher is going to trickle down into the ocean. So for my project in this episode, we're talking about Mo'ili'ili, which is what I work under. I work in the watershed of, I'm sorry, the Ahupua'a of Lualuale.  And so it's a small little piece of the pie of the Lualuale Ahupua'a or Latin division. All right. Yes. And you know, obviously people here know Ahupua'a, but watersheds may be a more mainland idea. So I thought maybe we could pull up a map of Mo'ili'ili. I think we have an image of this. Yeah, there it is. Can you tell us a little bit what we're looking at? So I understand we have a bunch of lines here. Oh yeah. But for everyone who doesn't understand maps, maybe you could give a quick overview of what this is. Absolutely.  So if you were driving out to the west side of Oahu, this is kind of what you're looking at. At the bottom, you'd see Nanakuli, like the corner of that yellow index. And you'd keep driving along and Mo'ili'ili is in the middle of that. And you start to hit this red dotted line. That red dotted line is the project boundaries. So this project was delineated through this land boundary, which is a smaller piece of the Lulule watershed, which is the yellow boundary. So Ahupua'a Yellow, red dotted project boundary. And then within that is an even smaller division, which is the project area, the focus area, excuse me. And that's about 2,000 acres. And that's really where the farm hub is of Lulule. The area Mo'ili'ili is known, it means small pebbles and because the land there is so pebbly, the farmers work in a very interesting environment working around those different obstacles, but the soil is extremely fertile. So it's a huge hub of farmers in that small focus area where I'm working. Yeah. I think it's, you know, we keep talking about this project that you're working on Mo'ili'ili. And, you know, who is this through? Is it a state entity? Like, what is this project and how did it come about? Definitely. So these funds originally are Environmental Protection Agency, EPA funds. Okay, federal funds then. Federal funds that get trickled down into the state level, which is through the Department of Health, Clean Water Branch. Clean Water Branch puts out grant funding and Oahu R-C-N-D applies for these grants. And one year, Mo'ili'ili happened to be one of the focus areas, and we said, hey, let's do it. And we took a stab at it and applied for grant funding, and we're awarded funds to help these farmers in Y&I, specifically for erosion control and preserving the watershed and keeping the waters clean. So the Department of Health, Clean Water Branch, ultimately clean, they want clean water, right? Yeah. And you can do that through reducing erosion, right? Yes. Preventing soil from getting in our waterways. So you're working with farmers and ranchers and landowners there to do what exactly? So, you know, the goal, reduce erosion, improve water quality, how are you helping farmers do that? Definitely. So it's really funny because a lot of people you talk to who aren't in agriculture and you say, oh, I do sustainable agriculture. They kind of look at you like, because it sounds oil and water, like agriculture, soil, tilling, things like that does not usually mix with the idea of sustainability and generations to come, and sometimes it has a stigma. What this project does is marry the two of sustainability and agriculture by helping to implement best management practices or BMPs, which is basically green infrastructure on the property. So adding that greenery to help reduce soil from just washing off their property because everything that's on land can go down into the ocean, anything. And there's so many streams there. And Y&I has such a unique environment that it's so dry and then as soon as floods and waters come in, which it does, it's not like it's used to the water coming through. So it washes everything out. It has a bigger impact. Yeah. Sometimes I get calls and they're like, this stream just washed out half, like it's double. And that's just how it is. So the farmers, they're extremely aware of it, which makes my job really easy because I have farmers who want to add in that green infrastructure and put in green belts and put in grassed waterways, things that are going to trap the soil. So I come in and help these farmers with projects that they ultimately want to do, but don't always have funds to do it because as we know agriculture in Hawaii is extremely financially stressful. And it's a lot of times they're doing double jobs or they're trying to make this work as a full-time job. It's really difficult. And so having these funds helps the farmer to make that possible. So total, we gave out $65,000 to farmers within that focus area to work on projects that they felt could improve their properties and make it last for generations to come. So yeah, it's been really great to see these projects come to life. Yeah, so something, people probably not in natural resource management, erosion is a natural process, right? We could do the best practices in the world and you're still going to have some erosion, especially here in Hawaii with the geology of Hawaii. And why specifically are you working with farmers? Farmers are just the most resilient people I know. Resiliency is a hot word right now, yeah? Oh, we want. Right, it totally is. And whenever somebody asks me about my work and they're like, oh, how is it, like, how are these farmers? Like the first word, there are two words that come to my mind. One is resilient. The farmers are so resilient. They want to make this work. They are struggling, but they are thriving in what they do. Every time they think it's two steps backwards, they make five steps forward. It's unreal. The work that they do is just so rewarding to them and you catch it, like you want them to do well. And so we pick this watershed knowing that there are going to be farmers in here that are going to want to do some good for the environment. The original land stewards, if you will. Yeah, they are. And I'm just there to help them along the way.  These are projects they wanted to do. So I mean, they've just been inspiring. The second word that comes to my mind whenever I think of these farmers and especially agriculture in Waianae and Mo'ili'ili is momona, which is fertile and rich and usually it's used to describe food, right, which is so perfect, but they are momona. Like they just have so much that they can give to the land and that they put in. And what they get out of it is just even more beautiful, like their crops, their work, everything culminates into these great farms and great productions. And you can see it in the owners. You can see it in their farm workers. Everyone comes back. They come and volunteer. Yeah. I think Oahu, RCD, we work with farmers specifically, but these watershed projects focus on farmers because we know that they want to do good in Hawai'i. Yeah. Yeah. And they also manage larger pieces of land, too, right? So like by reaching one individual, you might be able to reach 10 times the amount than if you just reach one homeowner or a small landowner that way, too. Yeah, definitely. I was just out the other day and I met with this farmer and he had one acre. We spoke for maybe two or three hours just talking about what's going on, what's happening. He just wanted to hear everything. I was talking to the story and learning from him what he thinks of the area and why he's here and why he loves this as his home. And at the end of the day, it wasn't going to work out. And he was like, well, you know, I got auntie next door who's got five acres. She could use some help. Oh, wow. You know, so it's a community out there. They want to help each other and everyone is connected in that watershed. So you really see, to me, the local culture of Hawai'i come out in some of these more rural areas, especially Waianae. Yeah. So, I mean, it's just great being out there. It's very refreshing. Yeah. Well, it seems like you definitely have enthusiasm and passion for this project.  Where did this come from? Agriculture was not my background, as Steph knows. But... I don't know you. No, you don't know me at all. No, not at all. Agriculture was not my background, my mom's gardens, but that's probably the extent of it. I grew up suburbs Mililani. When agriculture, to me in my time growing up here, was not a big thing. You don't see the gardens and aquaponics that you see now. I walk through the middle school now and there's this huge aquaponics thing going on. I'm just like, what is this? Like, this was not here before, you know? So it wasn't in my background, but I was always out in nature. My mom always took me hiking. And then me and my sister got involved in paddling. So I mean, to me, nature is extremely important and I always had this desire to want to learn more about it, which is why people get island fever here, but I've never gotten island fever because every time I go outside, I learn something new, even if it's on the same hike, you know? And so I always wanted to help. I've always been somebody who wants to help out wherever necessary. When I finished my undergrad here in zoology, I knew I liked helping people and I knew I liked helping the environment, but I went for my master's in natural resource management and that's what led me into managing resources and ultimately led me to Oahu, our CND. So it's been great learning about agriculture and I feel very in tune with the communities of agriculture as of now. Yeah. We're going to take a quick break, but when we come back, we're going to talk to Frankie Moore about her specific project in Me'ili-ili and how she's supporting sustainable agriculture in the Waianae area. She took her passion for natural resources and nature and her ability to work with local community and just provide technical assistance and we're going to see kind of before and after shots of this project and how you, the audience, can help support her as she continues to work in Me'ili-ili. We'll be right back. Hello. I'm Yukari Kunisue. I'm the host of New Japanese Language Show on Think Tech, Hawaii, called Konnichiwa, Hawaii, broadcasting live every other Monday at 2 p.m. Please join us where we discuss important and useful information for the Japanese language community in Hawaii. The show will be all in Japanese. Hope you can join us every other Monday at 2 p.m. Aloha. Hello, everyone. I'm DeSoto Brown, the co-host of Human Humane Architecture, which is seen on Think Tech, Hawaii, every other Tuesday at 4 p.m. And with the show's host, Martin Desbang, we discuss architecture here in the Waian Islands and how it not only affects the way we live, but other aspects of our life, not only here in Hawaii, but internationally as well. So join us for Human Humane Architecture every other Tuesday at 4 p.m. On Think Tech, Hawaii. Welcome back. We've been talking to Frankie Kothi, project coordinator for Oahu R. Sandy. The name of our show is Ma'ili'ili Musings, right? So we're talking about Ma'ili'ili, what it is and what she does specifically in this watershed to help farmers, ranchers and landowners provide sustainable agriculture here in Hawaii. So we talked a little bit about her love of nature, her background in natural resource management and all the technical assistance that she's providing in the field, specifically in the watershed of Ma'ili'ili. Frankie has been with the Oahu R.C.N.D. for about two years now and she's hit the ground running, coordinating with local community and farmers to really impact the land here in Hawaii. So right now we're going to be talking about the specific projects she's been doing in Ma'ili'ili and the farms that she's been working with. So her project is basically helping farmers implement practices that reduce erosion and improve water quality through a grant through Department of Health Clean Water Branch here in Hawaii. So they are focused, their goal is to improve water quality specifically in the Ma'ili'ili watershed. And Frankie's been working with farms out there because they have a larger impact on proving our water quality and also providing local food. So we are now going to jump back to Frankie and we're going to talk a little bit about, so you kept talking about you're helping these farmers, you're helping these farmers.   Yeah, so the money that we provide the farmers, so yes, we provide them with funds. Funding for farms. Funding for farmers in Waianae specifically, you know, it's so important that they see some of that too. It's a huge hub out there. The money gets divvied out to some farmers who have qualified based on an application that they put through to us. We saw that they were a good candidate and we awarded them funds, total of $65,000 among a number of farms and we provide 76% funds and they have to come up with the rest. And that can be through monetary or matching, like labor and donated materials, volunteer days, any kind of those things, so they can make it up pretty well. And it brings in this really good collaboration of, okay, we have these funds and I'm going to bring in some money here and let's have this huge volunteer day of everyone moving rocks. And it's just, it's huge, it's wonderful to see, it's a very powerful project. And the goal is to identify those resource concerns that they have themselves and provide the funding for them to achieve those practices. So example, one of these farms is on a stream bank, a stream bank runs through their property. When it floods, the stream pulls out and pulls out some of the land. So they cleared keave, they use the funds to clear it and to stabilize the bank by adding in native plants like poshina hina and a'ali'i where it does well in dry environments and it's going to flourish really well. And they're doing a small piece of it and once that's set, then they're going to continue on after the project ends because they can propagate and use the same materials. And at the same time, they're using other erosion tools like vetiver, which is a really strong grass that's not, it doesn't spread, it's not like California grass. It stays in one place and it acts like this amazing barrier that when soil comes through, it blocks it and it just stays right there and then they can take that soil and put it back on their land and they're using it for that too and every measure they can take to keep that soil on their property, they're trying to do it. So that's just one project going on and again, 76% of the funds come from us and then they make up the rest. It's an investment on everybody's part.  But also, you know, like you said, decreasing the cost so it makes it easier for the farmer to implement and also, you know, it's not stealing money away from their business, but ultimately provides for the community, right? Because you're now not getting all this fertile topsoil that you were talking about washing into the stream, going down into the ocean and ultimately the coral reefs. So, you know, I thought maybe we could talk, you know, we keep talking about these farmers, these farmers, maybe we can talk about the specific farms that you've worked with. So I think we have a logo here of the farms you've been working with. Yeah. So tell us who these farms are and what they do. So these are just a few of the farmers that we work with and, you know, I call them farmers, but they're more like my partners in this. They're just so great to work with. And as they learn things from me, I learn from them even more. So one is Kahumana, an organic farm out there. And they do a bunch of these diversified crops. The second right next to that is Ma'au. And they do a lot of diverse organics as well. Two great organizations and farms and also really good friends. Like the farms are friends. It's unreal, you know? They're like, oh yeah, you went over there and saw them. Yeah, yeah, yeah, you know? There's no, there's no, it's, there's not a competition because there's such a need for local food. So it's really, it helps each other when they work together. That's what's unreal. Down below that wonderful little bee is. Adorable. Adorable, as is their family. The Tallentino's, Tallentino farms. They're known for their honey. So if you went to like four seasons or some, I think even at salt, yeah, they'd have some great value added honey. And besides that, they were known as like the eggplant kings in the 70s. So they have a long history of farming it in Y and I. It's funny to go from eggplant kings to now honey kings. Second generation, that's why. So they've got, they've got the generations rolling in and a fun back story about their, their introduction to honey was they were out of pollinators. So what they did was they started planting flowers and fruiting trees so that they could bring the pollinators back. And that's how they got into honey and the kids kept going with it and. Yeah, it's natural transition. Yeah, yeah. So they do both at the same time now, the commercial agriculture and the honey. All right. Yeah, and then the last one on there was Naked Cow Dairy.  And they do specialty cheeses, which are amazing and butters, which are also amazing. You can find them in Safeway, I know that. Safeway. And I believe they do events out at Salt Cockroach too. So, you know, they're out and about and they are busy and they work so hard. That's one thing they all have in common. They work so hard, all of these guys. So they, all four of these amazing farmers have projects and funding to do some of this conservation work. Okay. Yeah. So let's take, let's take maybe Kahumana photo. Yeah. We'll show up before and after. And you can kind of tell us what we're going to be looking at, at this Kahumana photo. So, left is? Left is October 2017. Okay. So they had broken ground on this hillside and it was fallow lands and they wanted to do an orchard and they weren't sure how they were going to do it. They wanted to plant a bunch of trees and they didn't have the funds to be able to do contour. They were like, we're just going to plant the trees and call it. Okay. The project allowed them to properly do contour planting, which means that they, the water, when it comes down the slope, it won't just wash off. It'll catch on those trees and it's way more sustainable than planting in rows down the slope. So on the right side, January 2018, they have graveled that top road, which will help for road access instead of bringing on vehicles on this dirt road and driving everywhere. Yeah. They've got this amazing gravel road, which is still intact and we're in June. It's really stable. They did an amazing job and then you can see some of the trees that they're planting just coming up and stabilizing. Little babies and they've mulched everything, which I was just amazed by. I was ready to see like, okay, it's going to be dirt and contour. Here we go. They're like, oh no, we mulched it all. I was like, great. I was like, awesome. So they are really making some huge strides. Yeah. Yeah, and that mulch is going to conserve moisture, right? So they're going to reduce on irrigation costs, especially out on the west side, right? Where it is definitely drier for sure and not as much rainfall. So maybe would you like to look at another farm? Let's do another one, yeah. We'll let our producer pick, which, all right. Okay, this is Naked Cow Dairy and this is a really fun project. So Naked Cow Dairy is on a property that had a lot of concrete underneath it. Okay. So they worked with it and they had paddocks and their cows could roam around, but they couldn't grow grass for doing rotations. Wow, for feed. Yeah, they couldn't do feed because they've got concrete all over the ground. Right. And who has money to pull up concrete? Oh gosh. And I mean thick industrial concrete. Acres and acres of concrete. Yes, and it was unbelievable. And so they pushed and pushed and they pulled out all this concrete. And you can see the piles in September 2017 on the left. That's mid-process. Okay. And then on January 2018, it looks greener. It's because of the rain season. What's missing are those concrete piles. They're all gone. And if you see it in the very far back, it looks like pebbles in the back. That's from a volunteer day of 40 people stacking up those. 40 people. Yeah, like really, really like pebbles that I'm talking about.  It's rough. They're rocks. They are rocks, yeah. So they've collected them all and they were getting them out of there on that site visit. So now they can put in pasture. So that's going to be a huge game changer for them in terms of conservation improvement.  They already have these great ideas and they want to do it. But like you said, they're farming or they're ranching. And then they're also trying to build their business, marketing. They're out at salt. They're out here. They're out in four seasons. They're doing value added production, but they don't necessarily always have the time or money to do it. And so you help them with that by providing funding, but also that technical assistance in the field. So we have some pictures of you just out in the field talking to farmers. Tolentino's here. You've got the little ones out, that farming family you're talking about. Yeah, and obviously holding workshops out in Y&I, cover crop cocktails, just field days, just so not only so we can help farmers, but farmers can help other farmers as well. Definitely, yeah. Well, I want to thank you for coming on our show today. It's been a pleasure to talk to you in this way. Thanks for having me. I see you. I saw you this morning, but yeah. So thank you again. You're a huge friend to the show host here, Pomai, Matt, and myself. So thank you for coming on and updating us about the Ma'ili'ili project and what you've been doing. Of course, many times. Definitely. We were joined by Frankie Kothi, project coordinator of Oahu R-CND. You can learn more about her and her job at www.oahurcd.org or just come out to a neighborhood board meeting out in Y&I or one of our workshops to talk to her directly. She loves connecting with farmers, landowners, ranchers, or basically anyone in the community. Very personable. So I want to thank her and thank ThinkTech for having Hawaii Food and Farmers series on. We'll see you next time.


All right, Nitin asked a question regarding Microsoft Teams meetings. I am covering for my manager to run his meeting in his absence. What a nice guy. Yeah, that's great. Just out of curiosity, I joined the meeting today which is scheduled for Monday to check the options regarding sharing. I accidentally shared the content and I ended. May I know if the members will be able to join this meeting on Monday, as the chat window show the meeting ended, or should I send out another invite? I'm worried this is a pan-European project and a lot of people are involved. Tear face. It's not like you can't start the meeting again, ultimately. Well, that's the first answer to that. It's still there, it's still everybody's calendar, you can start it again. Unless they did events and for a quarter while with events, if you started it, you were done. You couldn't restart it. If it's a team meeting, it's a matter of what did you, what have you potentially got in there? Did it auto-start a recording, for example, that you might need to remove from the chat and delete because if you're the owner. If you're not the owner, you're going to have some troubles with removing anything that you might have put in. Yeah, so the persistent meeting, the links are forever, it seems like, because it creates a unique meeting link for every meeting you create. And I can always click that link and it'll say, that meeting's in the future, or it'll say, waiting for somebody else to let you in or that space is there. I don't know how long those stay active. I do believe if you don't, so if you set up a meeting link, I do believe if you don't log into that meeting link, I want to say it's 90 days, but don't quote me on that. Within a certain period of time, it eventually, the link will actually die because I was reading something on that, somebody asked me for that a while back. But it's a really long time. I think that's a setting, Sharon. I think there's an admin, you have the ability to go and set what that is. Maybe, I took the team's admin cert, it might have been on there somewhere, I don't know, but yeah. This is where you notice like, when I'm sure we've all, when I've organized a meeting and we've gone in there and like three of the four people show up and we end early, we wrap up, and then the person who comes in late and restarts it again. So, I mean, there is a meeting that we have actually ended it and yet the link is still live and others that were invited can go and jump back into it. So occasionally I've done that and seen that and I jump in, see the one person be like, yeah, we wrapped up early, so we're done. Yeah, but sorry. Thanks for calling. Yeah. Thanks for being late. Which is a strategy as we all know, maybe if you don't want to go to. I just, I'll give you the, I'll send the link. It says the meeting URL will never stop working. It only expires if it's a PTSN sort of dial-in number or underlining meeting policies. It says the note that a team's meeting though has the limit of 30 hours. I'll copy the link and I'll put it into chat. No, that's great. I know they've changed quite a bit over the last couple of years, so that's good to have the correct reference for right now. But be forewarned, this could change at any time. While we were talking, it may have just changed. We don't know. You just described the cloud. The magic, the opportunity of the cloud is that it- It's yours. It's interesting, when you go in, it states that, but when you go in, it says, a meet now, start time plus eight hours, a regular with no end, start time plus 60 days, meeting expires after that.  So that's straightforward. That's what you're saying. I do know, like there are certain meetings we've had that if nobody logged into them for a certain period of time, when you go to click on it, it says something like this link has expired or something. So I know that there was some- Seems pretty arbitrary. It's what I'm telling you, that's what I'm saying. Like, I mean, and ask again tomorrow. I'm sure it will change. Yeah. Okay.


1, 2, 3, 4, 5, 6, 7, 8, 9 It's the 10 Smoothie Commandments It's the 10 Smoothie Commandments Number one The challenge Except imperfection The blend is a machine User error is expected Number two If it's salt Add some water Milk are juicy, yo Frozen fruit is fine But respect to the effin' ratio Put your liquids In the jug first So add your fleshy fruit And then add your greens and seeds Jerk, don't be averse to it Loatin' it right Frozen fruit Last, are you seein' the light? Number four Blend it up Go to 10 Yeah, high speed I'm built to go fast It's how I work It's what I need Analogy for you If you had a Lamborghini You'd let it be a horse It's not a pony You weenie Five Plan your necks As blend before you sleep Snowbar drinks can be Sugary Cosly Number six Recipes Some are good Some are not Same thing every day is hella smart Seven Must go produce it Value weight with haste The greens that must be juiced And spoiling fruits Nothing goes to waste Number eight The color wheel, yo It's not too late Complimentary colors They make brown Brown don't taste great Tomorrow's me Me right now Hey Can we agree we're sleepy Such a long ass day Okay But we need micronutrients So we can work and play Blend it down What if wifey wants Some lovin' in the morning Hold up You think I'll love the beer Pizza Donuts this weekend Really did no harm Fine, I'll set the alarm Number nine Make a big bet Say I'm doin' my best Say look, I'm the Royal Smoothie Highness Then blend One, two, three, four, five, six, seven, eight, nine Number ten Drink it now Definitely Subscribe if you haven't already Next vid will have it Yo, end the parody Go, it's done Thank you for watching us Hey, that was fun


anyone who has a voice after Saturday night at Defconn? It wasn't really Saturday night at Defconn, right? Okay, so anyway, we'll start now. My name's Jay Veal. I'm here to talk about Mastio Linux, and we've done a lot more with the tool now, and I want to show you what we've done. It's been a little while since we've talked about Mastio at Defconn, and we've got some more to show. What's that louder? Yeah, how's that? Stick up any better? No. Okay. Try and type while I do this. Move closer. Like this. I will eat the microphone. I stole that from Raven. Okay. So I'm here to talk about Mastio Linux. My name's Jay Veal, and we've done lots of new stuff for some major, one major, one major new thing and a lot of little things, and I'll show you what we're doing. By the way, if you've got the slides that are on the CD, these are slightly updated. They're only minor updates. The stuff on the CD is pretty comprehensive. These just look a little bit nicer, so you can grab them from here. I'll let you write down the URL. I will let you stop writing down the URL. Okay, so I'm gonna talk to you. I'm gonna tell you about what Mastio did before, what it does now. We'll take a pretty in-depth look, and I'll even tell you a little bit about how you can extend it yourself, because well, it's open source, and we could always use the help, and heck, if you wanna do it yourself back home and not share, we'll be okay with that too. So Mastio Linux is a hardening program for Linux. That's a whole bunch of distributions. That's Red Hat and Mandrake and Sousa and Debian and Ubuntu and Gen2 and Turbo Linux, and there's probably one or two others, but I'm not sure. Not yet Slack. I'm so sorry. I know, I keep promising Slack one day. Okay, well Slack once I get a Slack VM, right? But it also works in HPUX because Hewlett Packard put in some programmers, and they've been helping a whole lot, and it works in OSX, except not 10.4 because Cisco's VPN client didn't work on 10.4, my first install, so they'll blow that away. Thank you. But yeah, so it works on plenty of Unixes, and we're expanding that list. The biggest thing that differentiated Mastio from other hardening scripts before was that, well, first that we shared it, right? And that instead of us all using our one-offs, but also that it educated the administrator about the process and educated the administrator about hardening and about what they could harden. It tried to get people to stop using telnet, for example. Tried to stop getting people, tried to stop getting people to stop using clear text protocols who seen the wall of sheep. I can't believe that wall's still scrolling. I just, how could you walk by there, see your picture there and not start telling everybody, oh my god, clear text, bad. Anyway, the new news is that Bastio now has a kind of audit or assessment function, and what it's doing is it can actually tell you how well-hardened the box is so far. It can say, these are all the hardening steps I know about, these are the ones that you've done, these are the ones that you haven't done. And the idea of well-hardened, it can also compute a score. So you can say, this is how well-hardened this box is, and well-hardened is something that you can define personally, you can kind of take the Bastio team's advice, or you can get a definitions file that talks about how well-hardened the box should be from your organization, whatever that organization is, employer or auditing board or whatever. So let me just show you how the two of them interact and hopefully I'll be able to keep this mic close enough to my throat, you guys can still hear me. But let me just demo and show you how it works, so I don't keep just talking about it. Tempting to keep mic, can you guys hear me in the back still? Oh man, choked on a microphone, what's that? How's that? Better? Tip it up, slightly in front of me. Stand on one foot, start typing. Okay, I can do that, that's easy. So, let's see. I'm SSH'd right now into a Fedora Core 4 system. So what I'm gonna do is, Bastio, can you guys see the bottom of the screen? Oh yeah, these are great screens. Okay, so I'm typing Bastio minus A for audit and it's gone and it's just finished the audit. It's kind of a fast process. And this is what our initial audit report looks like. What you've got here is a score out of 10 and I'll tell you more about that score over time. And this thing right here says how we got that score, what weights file we used. I'll talk about weights files some more, but basically who decided how your system should be scored is in that. Okay, so there are items here that don't have a weight. There are items here, here, let's see. So I'll show you basically the way this works. Bastio has a whole bunch of modules and you're gonna see these modules. I just want you to see the structure of the report. Okay, Bastio has a whole bunch of modules. So one of them is called file permissions or we'll page down a little bit. Okay, one of them is a send mail module here. So here's the DNS module here. Just at the top of the screen. And this basically is an item called charoute bind and that labels something you can redefine if you like. It can be item four dot three if you like. Here's a question, is bind in a charoute gel is it set to run non-route? Here's your current state, yes it is. Here's the weight of that question. Sorry, you didn't really get anything for it. It was weighted zero. That wasn't something that you were acquired to do or it wasn't something that you were considering is all that important. And then here's the score contribution based on that way. Does that make sense? So the idea is oh, and if we go to that question, you got a little pop up if you've got JavaScript on in this browser. This is all running locally so we want to talk about JavaScript issues and all that. Let's just trust me for now. This is running locally. You're not the idea that the browser isn't off doing other things. This browser's popped up by Bastio. You can have another browser hanging around. This is your separate one. So we've got a pop up. If you don't like pop ups, you can turn off JavaScript in it and you can just click on the question and we'll give you. Can you guys see that? No, okay. How's that? Okay, so this question is named in a charoute jail. This is the thing that's being checked. And it's also an item that can be hardened in Bastio and this explanation here basically says this is why you should do this. And I'll show you that some more but one of the Bastio's things is it says listen, here's why you should charoute named D. Because you could be a total newbie. You could be like, what does charoute mean? What's named D? And so we'll try to give you a feel for it. We'll say, okay, this is what you should know. This is why you should do this. Maybe this is when you shouldn't. This is when, because everyone's always concerned with hardening. What if that's gonna break something? Oh, it's gonna break something, right? So the idea is, okay, I understand that risk. Let us tell you when it would break something, when it wouldn't break something and let you make an informed decision. Does that make sense? So, so here's my report thing and it goes on for pages. You can print it out if you like but there's also something where you can just contract all the modules. We're working on a cooler looking version of this and I'll tell you a little bit about that as we go on. But you can contract all the modules and say just see one of them. So it's a fun little interface. It's a simple little interface but it does the job. There are of course people who are really into, who are really saying, listen, why can't I run this in text mode? I'm not really an ex person. If Bastio finds that you're not actually doing ex forwarding it'll pop up its own text browser to pop up links or W3M or links two or the other links or whatever it is. And then there's two other things here. There's also a text version of that. So you can see it like that. And then the other piece which I'm gonna refer to later is that there's something that's machine parsable. And by machine parsable the weird thing is this thing looks a whole like a Bastio config file. This will come up later. This thing looks, we can give you a version that says for each module, for each item number in there, what your current state is. Whether you're hardened, whether you're not hardened. The Y and Ns or whatever are basically the answers that it found on the system. Does that make sense? So I'll show you, let's take this and run Bastio normally. I'm running Bastio minus X to show it in X. Oh, there's something everybody should know. We all, remember when we always tell that into systems and you type X clock, you type Netscape and you see things pop up graphically and that was good. And then we did that with SSH and that was good. And then it stopped working. Like all of a sudden you SSH knew something and there was no X anymore. Everybody, anybody have that? Raise your hand if you had that happen. Maybe only a few people have had, maybe only a few people have had that happen. Just SSH minus X and it's like it used to be. It's a security thing almost sort of kind of. Anyway, so I've started up Bastio and I don't know, can you guys read this? I can't see from over here. Okay, well anyway, why don't I just, I'm gonna, fine.  But there's a bunch of modules on the left side. There's a question up here that says would you like to do this thing? There's an explanation here that says here's why you would want to and here's why you wouldn't want to. It's the same one you saw on the auditing side and then there's like a yes or no. So we can kind of go through and just tell it we want to harden the system and I'm basically just choosing the defaults for now. The defaults for Bastio are basically chosen so that you won't get, so that you won't screw things up too badly if you just go through and never didn't make a decision if you always click yes or click no. You're losing a lot of the benefit if you do that the first time because we've probably got something to tell you about. Okay, Bastio's got a firewall that I'm skipping for anybody watching and another tool that I'm skipping I'll talk about later. So Bastio will go and it'll basically just go and say this is these are the things I did and there's an error in here because it's trying to work on iNetD.conf and there's one on the system and there's no X on it D either. But that's not something to really worry about. So what I've got right now is if I were to look at if I were to look at the number of things that are still running. Okay, well that should be all. Okay, well what I can do right now let me just rerun in audit mode and show you I just went through and hardened the system and I hardened the system with pretty significant speed because I wasn't trying to so much demo the tool. What we just did was we went from a score of five point something to a score of eight point something almost nine and if I'd chosen something stricter than the defaults all along we'd actually have a higher score. And we can see and we can look at basically each question and say okay what got turned off and what got turned on. Does that make sense? Is that kind of the idea is there are tools that have been auditing there are tools that have been auditing before and there are tools that have been hardening before and now we're kind of doing both and that's got a certain advantage and one of the advantages is that you can motivate people to harden more because they're like wow hey look I can see my score or you can well I've got slides I'll show you but the idea is that it's a pretty useful thing to be able to even have tools line up. Well let me show you, let me show you slides. Okay, here now I can probably be heard a whole lot better. So in essence the first question is kind of why do you do assessment at all right we just I just showed you hey we build an audit tool and you're like wow gee I'm not an auditor why do I care right maybe you're not thinking that maybe you're thinking this is really cool and that's what I hope you're thinking but if you're not maybe I can tell you why it's useful can you hear me or am I still not eating the mic sufficiently well? Okay I will keep trying to eat the microphone. Okay so in terms of why you do assessment in the first place the first reason you do assessment is because it teaches the system in about things they could harden it teaches them about hardening settings they could apply they might not have known about before and one of the weird things in the Unix world is we kind of all feel like we know everything and it's hard to find out you don't that there's something you don't know if you feel like you know everything and so it's kind of a you know and so the idea of this is to show you what you might not know or at least what hasn't been done to the system yet best deals always have this education thing as a second purpose this is a this is a normal screenshot this is what I was going through but a little more blown up before if we look at this what we're doing is this goes and says hey do you want to turn on stack protection in the kernel here's the reason you want to do this it turns out you can break tons of buffer flow exploits you can break lots of buffer reflows one of the major kinds of exploits out there if you just turn on the stack protection here's when you don't want to gdb is a mode that it doesn't work with if you turn on stack protection what else well not much else okay so we can tell you we can tell you here's what we'd like to do and find out if you want to do it why else do you do assessment triage right you basically take each of your systems you're like you're like I'd like to harden my systems I don't know where to start I can start at my work station yeah that's good right but I don't know where to start I can go with the most vital servers how about which one's worse how about pick the one that's least harden I'll pick the one that's in least in worse need so you can basically go and take best deal and generate that score or look at that config file look at what things what things matter if you know what things matter you could set weights according to these are the things that matter and then score your systems right the score thing lets you start the score thing the user configurable score thing lets you start saying okay these systems are worse I'm gonna take care of them first or these systems are worse I'm gonna maybe do a little bit of incident response because they're so bad right does that make sense or maybe I'll maybe I'll start with you know running my running my end map scans running my NASA scans I'll look for vulnerabilities in the system I'll look for back doors on the system is really what I care about here okay what else another reason to do assessment is that auditing is that auditing happens you will be audited we all get audited at some point maybe you don't but a lot of us do a lot of my clients do right so the idea is okay you know you're you know you're gonna get audited it'd be nice to find out what's gonna what's gonna show up what's gonna happen and be able to work kind of proactively and so this the idea here is to give you a tool that's equivalent to your auditors tools and you can use a weights file again that's basically to find the same way your auditors is and that's our hope if anybody if anybody's with any of the major auditing organizations I've worked with CIS if you're with ISACA if you're with one of the other organizations and you want to contribute something I would love it if you would help contribute work on weights files just help help us tell okay what are others looking for but I mean we've got a framework now where we can do that what else best deal could be helpful here with compliance okay if you've got if you've just gotten hit over the head in the last year with new legislation that says okay we've got to care about security now or you know we're gonna get measured on it we already always cared about it well maybe best deal help you in figuring out how well how well you are compliance you're in compliance the weird thing is that some of these compliances are actually really kind of fuzzy they say that you've got to do due diligence that you've got to do a pretty good job right well what's that mean well if we've got an idea if we've got an idea how systems scored and we can show okay well we went from here to here or we can say listen most of our industry does this they score at this on this weights file well then you start being able to say that you're basically keeping up with your peers which is what due diligence means it doesn't mean that you did everything everything possible it just basically means you did what most everybody else who's doing a good job is doing that's kind of fuzzy but we'll try to help you with that anyway what else you could go and say this is another thing that comes up in universities network protection it's saying listen I'd like to make sure that before systems put on my network before Unix systems put on my network I want to make sure that it's well patched and I want to make sure that it's well hardened and if it's well hardened to basically these standards then I'll let it on the network and if it's not well I'm sorry you know just come back in a day when you're done or actually since hardening is pretty fast as you guys saw you know come back in five minutes does that make sense this kind of interesting you guys useful okay cool the other thing is scoring has this awesome psychological power okay I worked on a I worked on another tool like this and I remember when we were developing it was the CIS Unix scoring tool and when we were developing it they said we're going to give you a score you know you want to compute a score and I'm like a score one number I mean I studied mathematics okay you know like I did physics too we don't have one number I was like oh god at worst like making a 10 element vector and then like you know can you know compute some kind of a mean of that or whatever you know computer metric based on like weights of that so it's like no no no no one number and I'm like one number okay fine management folks will like one number that was my first thought it turns out geeks like one number two one number is really kind of useful okay the score thing is really nice because people are naturally competitive and geeks are naturally competitive and hackers are really naturally competitive right so so the idea is that first people get around to hardening sooner people are like you know I'm meaning to harden that system I'll get around to it later on all of a sudden when they're like confronted with you know a score that says mediocre they're like wait I'm not mediocre I kick ass you know that's not the way this should be I should never score a four I'm not getting around to that later I'm doing it right freaking now okay so I'll I'll give you an example we had a we had a security instructor who is a sands instructor you know is an instructor teaching lots of people things he thought a lot of himself of course as we all do right and he said okay um I'll you know I'll beta test your software so he's beta testing and he ran this thing on his work station and his work station came up about a six out of ten and he got peeved he's like what are you saying this is the mediocre issue he said I'm not a six out of ten screw that and he sat down he didn't even talk to us he just sat down and started hardening his system and ten minutes later he ran the tool again and they gave him an eight and he's like ah that's more like it I'm not a six a six is like you know sixty percent that's like a D no no I'm I'm much better than that it's nice play against people's ego he didn't see himself as a six out of ten kind of guy find by me whatever gets him to take proactive security measures is good okay this has happened lots of times when we were developing this previous scoring tool we talked to a bank and the bank had set up a scoring tool they'd created their security folks had like you know like many security folks and organizations had no power whatsoever we couldn't you know it wasn't like hand of God you know you will harden it's not like that they were like ah we'd like to help how can we help and that's what a lot of that's what a lot of security folks and organizations are like so they went to their system and they said here's this tool why don't you try and run it once okay and so they ran it once they didn't have any mandated high score they didn't have any mandated anything the only thing was can you try this tool once let us know how it goes and so they did start using it and different groups had different groups of sysadmins and different reactions they're basically all positive but there were some sysadmins who started voluntarily posting their scores up on a cork board like outside their cube okay I know that sounds really really nerdy but you know okay we're all really nerds here right we're just pretending to be cool okay maybe you all are cool I'm just not um right but the idea is like okay it'd be really great if we got people competing and they and they do okay the start the start Linux system scores around a five this doesn't work on Solaris yet but I wouldn't be surprised if like a Solaris 8 system scored around a three right Solaris has got freaking everything on by default we will get around to porting best deal to Solaris it's just a whole lot of work um anybody wants to help we've got two people who are working already and we'd love to help um but there's but the nice that so that's that's why you do that's why you do assessment it's why you do audit these are the these are the useful things about pushing an auditing tool in your organization or pushing whatever so so why do you why do you like the two together why did I why did I you know why did we add auditing to best deal instead of just creating a new auditing tool right that'd be kind of cool well the idea is that when you're hardening a system when you're hardening a system it creates a policy file when you go through this interactive yes no yes no yes no yes no you get a policy file whether you like it or not it just gets saved they get saved in this given place and you can take that policy file and do something with it well one of the things you can do with it is you can feed it back in you can feed it back in and see how well you're doing against that policy file you could say okay it's been three months I've been patching I have just you know ordinary system rot I'd like to know how far off I am the other thing in terms of that policy files if you create since we created a policy file by default every time you harden you harden we create a policy file you can take that policy file and say this is my policy file for all my web servers and now you don't have to run through the whole best deal thing again right it just it's got a back end where you just feed the policy file it sucks it in hardens the system and you know two minutes later you're ready right you can take that policy file and reuse it and there's a lot of there's a lot of reuse I was just talking about skew detection if you take that policy file you've said this is my web server template suppose you've got a web server that's older maybe you can't harden it maybe the boss has said listen we don't want anyone making any substantial changes to the system you can make changes one at a time by hand fine you say all our other web servers are here I've got a policy file that says how they were hardened let's see how this one stacks up so I take this one and I stack and and I run the auditing tool on it and says okay these are the four things that you normally do to all your other web servers do you haven't done to this one because it's older is that cool does that make sense so it's called skew detection and it's a it's a decent thing there are some politics to this there's a reason I keep talking about psychological powers psychology is a really weird thing to be talking about with regard to hardening not necessarily with regard to DEF CON right you're all psyching each other out all the time this psychological games eh this is the weird thing psychological games in the workplace right we're all used to it if we're in the workplace politics there are lots of there are lots of times where you can't harden a system by hand or with a tool because someone says oh no I think that might break things or you can't touch that that's my system no changes right the nice thing about this is that you can say we've taken we've got all of our web servers we've got four web servers that I built we've got the one that you know that mad max is still maintaining and mad max says anyone who touches his system gets his fingers chopped off okay well you know listen mad max's boss my boss can you just ask mad max if he'd run this tool for you once like just run it just auditing read only won't modify a system in any way and if you survive the account of requesting that he run it what do we find out well we find out mad max's system scores far worse than the rest of the systems that do the exact same thing oh great now we've got another way to get we've got another way to get the worst systems hardened I don't care about hardening so much right I care about hardening so much because while it's kind of you know one of the least exciting areas of computer security right next to like policy and logging you know it's still it's extremely effective you don't get boxes rooted it's really nice to not get boxes rooted it's not a lot of work either if you're using a tool for it so anyway you can read you can run best deal and basically other auditing tools read only and the idea is okay we'll learn something about the system without having to modify it this really helps when you have a shop that does manual hardening people say okay we only modify things by hand we don't trust any tool whatsoever we don't trust any tool that doesn't come with a million dollar warranty from the vendor and an oiler that says you know we'll of course take care of any losses you incur from bugs in our product right if you can only do manual hardening fine we'll tell you what to do read only means you don't have to stop doing manual hardening it just means we'll help you out and tell you what you should do toward that end we're working to create best delix I don't know we're going to have to call it something else but basically nopix plus best deal so you've got a system you've got a system and we will you've got a system we'll basically just let you you shut it down you bring it back up booting best delix or whatever we call it okay and it starts up it says okay it's I'm not going to mount the drives read right mount them read only run best deal here's your score here's your score report no changes ever made to the system you can do this you can do this to Mad Max's system he's on his lunch break we're taking a sick day right as long as you have someone's permission or something okay so I've been talking about I've been talking about trying to convince people to harden I've been talking about the psychology I've been talking about how it is you do it you can use this tool to do it you can use this tool to find out how well you've hardened but the big question always comes up why the heck do I harden in the first place okay basically if you don't if I haven't made it very clear what hardening is already I'm about to hardening is just the process of trying to make a system harder to break into and the idea is that you take any settings you can tweak and you tweak them you turn things off and you can figure stuff that you left on better okay so the biggest the first objection we always get to hardening hopefully not at Defconn is that people say my box isn't interesting enough we're just a little K through 12 school you know why are we gonna why is anyone gonna attack us we're just a paint thinner company you know why is anyone actually gonna attack our computers they're not interesting you're not gonna get any money out of attacking our computers worst case you might have some extra paint thinner shift to you you know what hacker wants that can you do anything with paint thinner that I don't know about okay I don't know anyway so but everyone says I'm not interesting enough I won't be targeted is anybody at Defconn still think this okay don't raise your hand but if you think this and you put your laptop on the wireless network well try running an IDS for a few minutes or a packet capture packet capture program you see some very interesting attacks coming your way I wonder how many port scans everyone on the Defconn network sees per I don't know minute anyway low value targets aren't okay most targets aren't low value this is something we should all understand your box is useful as the next hop on the way to the target just to make it a little bit tougher to track the attacker back your box is good as a peer to peer host your box is good as a wears distribution site heck you could be low bandwidth your box would be useful as an IRC bot your box will be useful to someone the thing is that your box isn't usually targeted anyway most of our attacks don't come from don't come from from being targeted and when they do half the time probably at least half the time we don't know that we've even been compromised because people are that good but most of the attacks that we see are these are these scripted kids coming after us most of the attacks that we see aren't targets of choice they're targets of opportunity okay there's some your attacker had an exploit against say you know one particular version of PHP so they go and they scan a large swath of the internet they go and scan the entire Comcast at home network and they find your box along with a hundred others and they take those hundred systems and they they take those hundred systems and they poem them and write you know these boxes now belong to them but it's not because you were targeted it's because you had an IP on Comcast that day and that was the guy attacking that day right that was the that was the network this guy was scanning does that make sense okay I think that's kind of obvious at DEFCON okay so we do tons of patching right we do tons of patching we're constantly patching I mean we're all I spent all of yesterday patching and all the day before that and every single day patching we all patch and patch and patch and patch right well okay not really but we do lots of patching the problem is that if you patch you still get compromised you're like wait I patch every single day why do they get compromised do I patch every single day at midnight well you still get patched because you've still got these windows of vulnerability a window of vulnerability is basically the time during which somebody's got a working exploit and the time and when your systems and when and your systems are still vulnerable so the time where someone has a working exploit and your system is vulnerable that's your window of vulnerability it's broken apart into three parts two of which you have no control over the first one is can you guys still hear me or am I not liking well enough sorry the first one is the first part of your window of vulnerability is where the exploit exists but the vendor doesn't even know about the issue call this O-Day right you can do nothing about that if nobody knows about if nobody knows about the vulnerability except the people with the exploit and they're hitting you well you're vulnerable whether you like it or not we can do something about that hardening actually works on this the next piece is an exploit exists and the vendor isn't creating a patch they're not done creating a patch it takes them a little while say it takes them you know a week but really nowadays it's about a month okay and then the third is patch exists and you haven't applied it yet most of us patch kind of closer to monthly or you know weekly maybe it would be nice if weekly right but some people only patch quarterly and God some people patch yearly and some people never patch at all but the issue is that because you've got these first two parts of that window even if you patch perfectly you still end up with a vulnerable machine now and then you still end up with a vulnerable machine you're just kind of like rolling the dice hoping that today your machine isn't vulnerable and attacked at the same time does that make sense so the idea is we like hardening because this is reactive reactive is going and patching reactive is going and saying oh God we just got attacked on this port where people are attacking on this port maybe I should set my firewall to start blocking to start blocking SQL server queries right that's kind of the reactive process the proactive process is configuring that firewall ahead of time and saying wait there's no reason for anyone to do SQL queries from outside my network into my network or better yet I don't use these are the protocols I allow in and I don't allow the rest in so if SQL ends up to being the being and ends up being the worm tomorrow not so much the worries okay the other thing we do is we harden a host because we harden a host maybe it won't be vulnerable okay hardening is just the process of configuring an assistant for better security it means you turn off things you're not using it means you're better configuring the stuff you are using it doesn't involve the kernel level modification of the system like sd linux or pitbull or trusted bsd celeris or whatever what have you it does involve going and looking at permissions access controls and looking at whether the permissions are appropriate or to lax remember a couple releases ago Apple my trusty Apple right had a wonderful vulnerability to let any user on the system backdoor a bunch of third party applications because the permissions were rolled rightable anybody remember that that was a really good one Dave G found that it was awesome it was awesome multi-user systems I'm sure some people at universities had a really great time with the Apple X serves what else it just the other side of it is it involves basically tweaking tweaking settings in the system and in the applications to give users one access they need not really any more of it okay it comes down to two principles ones least privilege the others minimalism least privilege says basically or user or whatever only grants whatever privilege the other users need that the users need to get it right the users only get what privilege we want to give them minimalism says we can figure the system for fewer features we say these are the features we're using let's better tune the system you'll get some nice speed out of this right because you won't be running 50 applications you'll be running five just the five that we're supposed to be running here in essence okay this is now there's there's one thing people ask well what about stuff kernel level stuff the kernel level stuff is basically complementary to hardening you can you can basically do both fedora my fedora core four system has se linux turned on and I'm hardening it with best deal okay the thing with kernel level is that sometimes is that kernel level can be really awesome because it can contain a lot you can't do with hardening on the other end hardening can do some things that kernel level can't do one is that one is that kernel level very often contains the attacker after they've taken down the after they'd compromise buying you know they compromise buying falls down they don't get their powerful route shell because they're se linuxed on the other hand if we can configure the thing that the the thing that was being attacked the exploit doesn't work or the code the exploit was trying to hit isn't available at all maybe it's turned off maybe it's removed well then we don't get compromised at all the buying the server never goes down the best example I can give you is Apache most of Apache's real functionality comes in these Apache modules that you can turn off at start time it's not a recompile it's just like comments something out it doesn't load you have code that doesn't load because you configured it not to Apache is a great example too because it comes with like red hat ships it with say thirty four different Apache modules of which you might need five depending on what kind of site you're running so if you can turn off the ones you're not using and a vulnerability comes out and one of the ones that the one of the ones that was on before congratulations you don't get nailed by it is that cool does that make sense so the other side of kernel level hardening is that it's hard kernel level I mean kernel level kernel level technologies are hard writing the profile saying this program needs to write to this needs to read to this it needs to be able to do this capability but not this capability that takes that takes a lot of that takes understanding it takes a whole bunch of training to learn how to do that red hats made that possible with se linux because they've said okay we'll write a really good profile for the users and not require them to do it on the other hand the profiles are a little looser than you'd want them to be because red has to make sure that whatever you're going to do with that web server it still works does that make sense you can learn to make your own profiles it just takes some real training I mean they're they're like there's a book on se linux okay anyway you should continue looking at kernel level solutions they're nice I really like gr security I like se linux these are good they're just I consider that they're they're complimentary you can still harden and probably still should it's not a difficult thing to do it's a little bit it can be a little tedious if you're doing it all by hand but well we've got a tool for that right but it's not hard to do see I asked the center for that security rights guides and the guides are the the guides are designed to be used by junior levels junior level system men's okay people who you know you might not even know entirely how to work their their favorite editor just yet okay and it's still this this stuff can still be done black hat has a two day course I teach it right and that two day course is does solaris and linux and it's comprehensive there are five day courses at other organizations but but the fact you can learn it that quickly says something I mean I could teach you one operating system how to manually harden a day okay we do two and two days this is not hard stuff this isn't rocket science this isn't anywhere near rocket science there's you know anyway it's pretty easy to do it's also really effective and I'll tell you about two examples the first is the CIS guide NSA's NSA's IAD the information assurance guys that they're around to stop machines from being broken into put basically took a benchmark and ran it against a window system and when they were done 90% of the vulnerabilities that were in that window system were mitigated you couldn't hit them okay they either you either couldn't use them or you couldn't get anywhere by using them you can do the same thing with Linux if you will use one of if you basically do all the hardening guides you don't have an extremely useful system but 90 to 95% of your vulnerabilities are gone so Bastia Linux is just awaited to this programmatically when we created it we created it before Red Hat right when Red Hat 6.0 came out we just did a normal audit of Red Hat 6.0 system very very standard just look okay we wrote a program to do it it basically stopped or contained every major vulnerability that was in the system which was really nice bind it had a remote root hole WUFT WUFTPD it had a remote root hole LPD plus send mail the combination of those two got you another remote root dump restore local privilege escalation GPM was a console level console level privilege escalation all of those things were stopped by Bestial that's not because Bestial is just amazingly wonderful right I'd like to think it is but they've got in books that we've got on documentation got on websites or whatever this is what happens there are only two we didn't nail and they were just little commands that if root ran them and somebody created and somebody been able to like say create a hostile man page well that's not anything we could really do anything about that's one of those things that hardening won't get ya but that's okay so Bestial can kinda lock down this is our complete list of what Bestial locks down right now it does Red Hat all the old ones and Enterprise and Fedora Core and I'll release Fedora Core for tomorrow for that HPUX Mandraker Mandriever whatever you call it Debbie and Susage and two Mac OSX Solaris need help again one of the differences with Bestial is that it educated the system in educating the system is really good if you say want the system in to not end up on the on the wall of sheep right if you want the system to stop using Telnet you have to tell them Telnet's bad because otherwise they'll say I've been using Telnet for 10 years what's wrong with Telnet and you say well I can take it over I can sniff it I can sniff it or take it over and when you got switches don't use it use SSH instead and your system says okay I'll let you turn off Telnet does that make sense yeah okay so people have found it very educational they're organizations that use Bestial entirely for the educational component and don't actually have it hard in the system because they want to do it manually hopefully the assessment mode makes things easier for that okay it's really easy to automate you create a config two commands you SCP config over to another system and run Bestial over an SSH pipe and you can apply it to another system if you're using one of those mass SSHers they'll let you SSH to a thousand system to want the systems at once congratulations this gets really scalable okay the whole thing is written so that it's very easy to script around Bestial it's very easy to add onto without them to know any pearl okay the nice thing is so why do you use Bestial or why do you use an automated system well one of the reasons you do it is for consistency if you don't have a thousand systems fine you like to do this do this do one the same way every time maybe you do it if you create a standard build config file maybe you make this part of your maybe you make this part of your build process all you have to do is every time you basically you only have to update these config files when you get a new distro or when you get a new release of the distro HPX makes this really easy there are four different ways part of their install process they've shipped they're shipping with Bastille with the operating system what I want to do is let's see we're running a little low on time what I've got is a list of modules and kind of what they do would you guys rather see a list of modules and what they do or would you rather kind of see how you add on to this add on okay works for me skip skip skip skip skip Bastille is actually really easy to add on to we wrote it and then like so many open source projects six months later we rewrote it entirely and the rewrite is just to make it was just to make it easier to maintain and that happens on a lot of open source projects probably happens on a lot of commercial software because once you've written it once you understand how to make it a lot better so what we did is the whole things in pearl but if you don't know pearl we actually work to make it really understandable we actually work to make it really understandable so that you could so that you could work on this even if you don't know pearl and I'll show you an example of how you kind of add to add something to turn off the set you ID bit okay so if you wanted to add an item the first major thing you have to do is create a question for that item basically that text the explanation here's why you should do this here's why you shouldn't what the question is what the what the default answer could be you can add modules and we've had we've had people contribute modules before and it's pretty easy here's a here's just the question type stuff this first one is just every every item gets its own name there's a short explanation you can have a long explanation so you can give the user more detail there's a little explain less explain more so that lets them granularly decide I know a lot about this kind of stuff so tell me less there's a question there's what distributions it works on there's a default answer there's a regular expression answers have to match if you don't know what that means don't worry about it you can skip that part and there's some stuff that says what the next question is and what the previous question is and you can actually skip that part if you want to if I wanted to create a new thing that turned off setuid for dump and restore this is the dump and restore action I've got this if get global config the module name the question name you could copy paste that right equals yes if they answered yes to this question then I run be remove suid remove setuid it's one line from dump and this is a path name but you can also if that path differs from operating system operating system you can put in one of our get global things it says this is in a table somewhere but you could just put user sbin dump okay does that make sense this is really easy I'll show you the API the API is really simple okay it's you can go and you know be chimad chimad changes the permissions chone changes the ownership chagroup remove setuid create sim link the reason we've ended up a lot of these things are things that were present in pearl already we rappered them so that you can undo the whole thing the idea behind best deals you can either granularly undo it or we've got a big red button called revert and that big red button yanks the system all the way back to where it was before you were running best deal it's not something you want to run six months later because that part's hard but if you just ran best deal and you're like wait I answered yes to everything and I should have read revert you hit your big red button and you start over or you hit your big red button and you throw a best deal and curse my name right doesn't matter whatever you want to do so these are other things be check and fig off turns things off and the RC scripts and all that you can copy files these are kind of the fun ones be a pen line just sticks a line on the end of a file if it's not already there this is all made so that if you run best deal you can run it 8,000 times again with the same config file and not break the system because best deal will look for the stuff that it's trying to add you can insert lines you can insert lines before a given line in the file you can prepend a line put it in the beginning of the file you can replace a given line these are all basically this matches the way the Unix config files are done be hash comment line what could be easier you want to you want to turn a line off you don't have to delete it just comment it out with hash comment it out delete line is another thing you can do and all of these work they all work on pro regular expressions if you don't know that you can kind of use exact matches but this is all really simple to do and that's the idea that's the that's the API for adding things for adding new items it's really actually quite easy if you don't know pearl you still have a pretty good chance of being able to add an item especially if you can copy and paste something similar I added something yesterday to remove I added something yesterday in about five minutes to remove mdns responder that that rendezvous zero conf bonjour thing that's on apple it's also on red hat fedora core now it was really easy to turn it off I copy and pasted something that turned off gpm because that use check config and turn off mdns responder it's another check config it was really really quick eight lines of pearl and like you know these kind of lines not the kind of lines you can't read right does that make sense doing the same thing you create an audit item for it you can you can create an audit and we want you to create an audit item for anything you create a hardening item for and all it is is you have this thing just like this global test the module name and then that that name of the that name of the question equals sub and you basically have a sub routine that does whatever it was that should be tested and you return ask or ask or skip so if where you return one or zero this is this says if B is suede if ping is set you ID or ping sticks is set you ID then I say okay the test fails it's really kind of that easy and you can do the same thing with match lines you can everything that we basically could do to something now has a corresponding check B is service off we'll go and tell you if something it's I net D based or X and D based or RC based is on or off return match line is there a line in this file that matches this pattern if I was hash commenting or deleting a line now I can check and see if it's present so now I have an easy quick way to write a check at the same time that I'm writing the fix that makes a lot easier to develop the tool it also it makes it easier to write the right things for your environment and the whole idea is that all these things should be pretty self explanatory B is package installed tells you if it tells you if something's installed is process running the idea is that it should sound like English the idea is that this should be really easy for you to look at a few and then make your own and you can make your own you can use it in your environment people have written whole modules actually got a module author in the front row my crash hello anyway he wrote the port scan attack detector which is like port century except 8,000 times better it's just it just is you can look into it you'll agree there's you know these tests are really easy to write I'm going to stop now because we're basically about a minute before but I've got some things to give out I've got books I've got t-shirts the goons are desperate for me to get rid of them because they don't want to take them all home because they've got they've already they've already taken their own stash and right they've got the extra ones I'm going to be doing a book signing in the Snort 2.1 book but here's another this is another book that I worked on called stealing the continent and here's the t-shirt but it says call it fiction it helps you sleep better anyway who wants a t-shirt? oh wow wow this is I've always wanted to be a baseball player okay I'll do that I'm going to do the books now no, these are signing books I've got somebody's asked questions wow that guy's getting one just gonna take that one I'm gonna check I've got a Snort 2.1 book which is one of the ones I'll be signing I've got Mike Rashes in the front row it shows you convention and active response and I've got the Linus Enterprise Cluster for people who don't know how to take ones okay you can have this one now I will take three questions and three questions we'll get three books so you know ask one can you check for password complexity? can you check for what? password complexity can you check for password complexity? we can implement password complexity and we can check for it we turn that check off for now and we're turning it back on we ran into a bug with how it works on one distro versus another that's a good question what are you intrusion prevention? okay another question over there wow that's a good point can we check for SSH version one versus version two better configuration than SSH not yet but if you want to write it or I want to write it we'll do it that's a bonus that one wow can we check SSH if it's target or permissive mode no I'd love to talk about it if you are exiting the room please exit this way


Welch chi'n gweithio, wrth gwrs, ni'n gwneud i'r stadion Chorol. James Mason, chi'n gweithio Chris Rutees. Chris, ei ddim yn ei ddweud. Felly, rwy'n gweithio, yn ysgrifo, yn ei ddweithio? Chilyn i, mae'r ddim yn gweithio? Yn gweithio, rwy'n gweithio, rwy'n gweithio. Rwy'n gweithio, rwy'n gweithio. Ac rwy'n gweithio, mae'n gweithio'r ddweithio, Llyr iawn i, yn unig iしました, dwi'n meddwl i mi i nifer hynny y dyma'r bwysig. Felly, y byw'r olygu Cymru haf hyn yn fawr i finnogi gweithio'r project? Felly, hefyd .. hefyd yn ei gweithio. Felly, rwy'n yn ôl ei wneud o beth yna. I think if everybody do that, we can be ready for it next time. What amazing season for you after the team? Yeah, I think for my first season, I think it was not the worst because everybody say, when I call me everybody say be careful if you call me in England because it should be really hard and now I know it's hard. A lot of friends ask me if you can come here or he ask me if it's hard. So I say, yeah, you can come but I hope you are ready. Now, yeah, it was a beautiful season for me. I'm happy for the finish because I play more after Christmas and now I feel better and better in these countries. I'm happy and for the team it was an unbelievable season. Just a little bit disappointed because we can go on the playoffs. But next season we can do that. Now it's the good objective for the lads, for the team and for the club. We need to go because when I see every game, 40,000 or 40,000 people at home and away it's same, a lot of time go to watch the game. So I think this club need to go on the championship now. Well, you mentioned the attendances. 1-4-9, hashtag 1-4-9, can you believe a season ticket at the cold window stadium next season will be 1-4-9? Yeah, so everybody can see that. I can't believe this price. I have a lot of people for that and I think 1-4-9 is really good price I think for the fans. It's unbelievable and now I hope we can play all the season. It should be with the full house, why not? That's good, I'm sure the chairman will be pleased that you want the full house.  The Sunderland, the Redding games, Barns Leven, the end of the season, big crowds? Yeah, it's unbelievable because in this stadium when it's 4 hours we have a really big atmosphere. I think the biggest I saw in England in this division. For me I remember the first game when I was on the bench against Leeds, against Leeds United. There was more atmosphere in Chelsea for that. I think for the player when we can see the full house we are everybody play out 100% every time.