Repent, O Holy Night

satan-1.1.1/Changes

@@ -7,14 +7,14 @@
 - bundled in ctime.pl and getopts.pl from the perllib.
 - trouble shooting docs now integrated with FAQ, and a full week of feedback
   processed into FAQ and troubkle entries.
-- added a 13th vulnerability page. Irony has it that SATAN is the subject.
+- added a 13th vulnerability page. Irony has it that SANTA is the subject.
   Surprise: CERT/CC posts advisory *before* a software update is available.
-- SATAN now detects that HTML clients reveal parent URL information.
+- SANTA now detects that HTML clients reveal parent URL information.
 - eliminated extraneous ping probes.
 - strerror() is provided whether or not the compiler understands ANSI.
 - prevent compiler warnings about "& before array" in rpcgen output.
 - use waitpid() to find out when the HTML browser terminates.
-- moved 'require getopts.pl' down in bin/*.satan scripts.
+- moved 'require getopts.pl' down in bin/*.santa scripts.
 - fixed typos/errors/omissions/ambiguities in the documentation.
 - the -c option now changes individual perl variables. Example:
   -c "dont_use_nslookup = 1; dont_use_icmp = 1". Useful for config
@@ -28,7 +28,7 @@
   now makes difference between "host trusts everyone" and "account
   trusts everyone". It would claim that hosts are open when they
   refuse access with a tcp wrapper banner message.
-- append dot in dns.satan query to avoid spurious name servers being
+- append dot in dns.santa query to avoid spurious name servers being
   listed. This also may make things faster.
 - avoid duplicate "exports to the world" message (shut up showmount
   message when running from an untrusted host).
@@ -52,7 +52,7 @@
 - dropped the unused rcmdinfo tool.
 - linked the troubleshooting guide.
 - deleted all references to set-uid tools - scripts cannot be made setuid.
-- added note about parallel runs to the satan.8 man page.
+- added note about parallel runs to the santa.8 man page.
 - will ask the user to set $dont_use_dns when nslookup fails.
 - README & TODO - added disclaimer on parallelism; added AFS & SNMP to our
   TODO list.
@@ -67,54 +67,54 @@
 - fixed "back to.." link in the system requirements.
 - gave the session key writeup a more architectural tone.
 - fixed another duplicate filtering bug in danger report.
-- SATAN no longer dies (undefined host) when given an incomplete database.
+- SANTA no longer dies (undefined host) when given an incomplete database.
 - clearer distinction of in-core and on-disk databases, and what happens
   when you load/merge/open/query them.
 - fixed some typos in the FAQ.
-- commented out offending commands in satan.ps
+- commented out offending commands in santa.ps
 - fixed some typos in sendmail check.
 
 0.91
 
-- docs: user_interface, the_main_parts, satan_reference, satan_overview,
-  satan.db, FAQ (incl. adding your stuff to FAQ)
+- docs: user_interface, the_main_parts, santa_reference, santa_overview,
+  santa.db, FAQ (incl. adding your stuff to FAQ)
 - rules - 2 more sendmail checks - (<= 5.60), (<=5.65 && dynix) in facts,
   improved DYNIX recognition
 - changed tutorial Sendmail_vulnerabilities.html
 
 0.90
 
-- more consistency (use of SATAN logo, intermediate headings).
+- more consistency (use of SANTA logo, intermediate headings).
 - broke down documentation into overview and reference.
 - fixed some dead links (_ instead of -).
 - figured out why lynx would not start up a problm.
 
-- put back in old/new satan.ps
+- put back in old/new santa.ps
 - writable-FTP tutorial - added cert link
 - reconfig - changed error msg to be more clear
 - minor changes to README
-- minor grammar and spelling changes to satan.8
+- minor grammar and spelling changes to santa.8
 - Changed several docs - clarity, expansion, etc.
 - put in the troubleshooting.html guide
 
 - figured out why nfs-chk/yp-chk had trouble with Solaris.
 
-- cloned nfs-chk.satan to yp-chk.satan for nis map accessibility test.
-- added -d (domain name) option to ypbind.satan.
+- cloned nfs-chk.santa to yp-chk.santa for nis map accessibility test.
+- added -d (domain name) option to ypbind.santa.
 - cloned nfs-chk to yp-chk and plugged in an YP client call.
-- Linux users are now instructed to copy BSD includes into the satan tree.
+- Linux users are now instructed to copy BSD includes into the santa tree.
 
 - found the nfs ghost - missing initialization in dynamic page.
 - why tcpscan was too quick claimin telnet on non-std port.
 - added <HTML><HEAD><BODY> to the dynamic HTML pages.
 - consistent spelling of names (caps).
-- copied the alpha satan.ps, the ./satan.ps was busted.
+- copied the alpha santa.ps, the ./santa.ps was busted.
 - changed font in acknowledgements from fixed width to something more
   palatable.
 
 - bold faced our names in authors.html
-- fixed satan => SATAN in satan.8
-- added satan.ps
+- fixed santa => SANTA in santa.8
+- added santa.ps
 - modified/added to html/docs/FAQ.html (red 'n' black dot controversy
   on a B/W screen, changing HTML viewers, etc.)
 - mv'd html/docs/admin_guide_to_cracking => $!.html
@@ -127,7 +127,7 @@
 - nuked the glossary - no time to finish it right.
 - Nuked *.orig, *.bak, *.old
 
-- satan ships with execute bits off, to avoid stupid questions from people 
+- santa ships with execute bits off, to avoid stupid questions from people 
   that did not run `reconfig' first, as described in the README file.
 - debugging mode is now off by default. You can tail -f the status_file
   to watch progress.
@@ -146,11 +146,11 @@
   a "root" severity problem, just because it's so ghastly, more than
   it being such a severe problem on that host.
 - fixed tftp to get /etc/group instead of /etc/passwd
-- html/docs/satan_doc.pl - added trust section
+- html/docs/santa_doc.pl - added trust section
 - html/docs/trust.html - discussion of trust
-- fixed names in satan.8
+- fixed names in santa.8
 - fixed my personal statement
-- FIXED (!!!) back the satan control panel.  Data management should NOT
+- FIXED (!!!) back the santa control panel.  Data management should NOT
   go first.
 - fixed grammar html/tutorials/vulnerability/REXD_access
 - uncommented root rsh and SGI rsh as guest
@@ -159,8 +159,8 @@
 - made links from tutorials to admin-guide-to-cracking
 - now show the current database name in the "open database" text field.
 - added -u (running from untrusted host) option and $untrusted variable.
-- changed wording of worldwide exports in nfs-chk.satan
-- moved umask 077 to main satan
+- changed wording of worldwide exports in nfs-chk.santa
+- moved umask 077 to main santa
 - tcpscan now continues after ICMP_UNREACH_NET or ICMP_UNREACH_PROTOCOL.
 - network targets didn't work anymore.
 - added "view primary target results" link.
@@ -175,14 +175,14 @@
 
 Satan beta 0.5
 
-- rescan is now default: before scanning, SATAN always drops old
+- rescan is now default: before scanning, SANTA always drops old
   information on primary hosts. Too many problems with todo rules 
   being skipped at a low attack level, and never being triggered 
   again whe the attack level was increased.
 - wrote a UNIX man page so we can tell them to Read the fine manual.
 - data mgt moved to the top - if you collect data first it does not
   make sense to change databases later.
-- added "back to SATAN report analysis" links to the report screens.
+- added "back to SANTA report analysis" links to the report screens.
 - worked around strange behavior when host or domain names end in au.
   fix: all dynamic URLs now end in a comma.
 - some error screens had a non-standard layout.
@@ -204,11 +204,11 @@ Satan beta 0.5
   look for remsh & if it exists, use it instead of rsh.  Changed top line
   to be a better way (you might check this out; this was suggested by
   tom christianson & larry wall, so I trust it.)
-- changed the satan.probes.html documentation significantly; minor change
-  to satan_documentation to reflect this.
+- changed the santa.probes.html documentation significantly; minor change
+  to santa_documentation to reflect this.
 - added grep into paths.sh
 - moved data management menu item below targeting and results on main
-  control panel (html/satan.pl) - I really want to have targeting first,
+  control panel (html/santa.pl) - I really want to have targeting first,
   then analysis, then the rest!
 - created a wu-archive ftp tutorial
 - small change in analysis.pl; "Widely" seems redundant, nuked it.
@@ -222,13 +222,13 @@ Satan beta 0.5
 - restored control panel order: choose data base before collecting data.
 - port scanners now take service names from config/services so that our
   inference rules will be more robust. The system services tables are
-  used for everything not found in SATAN's service tables.
+  used for everything not found in SANTA's service tables.
 - began cleaning up the html. Combining both quoting and italics on the
   same word is just too much.
 - some hosts would stay "unknown type" after rescanning. Fix: add an UNKNOWN
   pattern to rules/hosttype that matches both "" and "unknown type".
 - deleted the html/query subdirectory
-- SATAN now maintains a per-host last access time, displayed with host details.
+- SANTA now maintains a per-host last access time, displayed with host details.
 - faux-fping took only one argument and always did subnet expansion.
   I replaced it by an fping-compatible one-liner.
 - updated docs about current locations of files.
@@ -237,18 +237,18 @@ Satan beta 0.5
 - reconfig no longer needs to have #!/path/to/perl.
 - get_targets moved to bin.
 
-- fixed rsh.satan to not depend on remote location of commands
+- fixed rsh.santa to not depend on remote location of commands
 - can now merge data bases (GUI only).
 - fix_hostname.pl could map IP addresses to unqualified hostnames.
-- SATAN could skip hosts that were dead on a previous run.
+- SANTA could skip hosts that were dead on a previous run.
 - added support to rescan primary hosts (ignore old primary host results).
 - added -o option for 'scan only these'.
 - added -O option for 'skip these'.
 - added -c option for alternate config file.
 
 Satan 0.40 beta:
 
-- slightly changed -V flag to satan; prints out version, found in version.pl
+- slightly changed -V flag to santa; prints out version, found in version.pl
 - removed *box*.gif *triangle*.gif from images directory
 - removed all but black, red, pink, and purple dots from dots dir
 - swept through all html files with a fairly fine-toothed comb and
@@ -262,12 +262,12 @@ Satan 0.40 beta:
   it was symply too painful to get right.
 - config file edit script used the raw HTML attribute list with %hex codes.
 - generic editing of %hex codes emitted by web viewers.
-- GUI will now show a trace (with time stamps) of what satan is doing.
+- GUI will now show a trace (with time stamps) of what santa is doing.
 - configurable pathnames in sh scripts moved to central file.
 - lots of dead links in the docs fixed.
 - big one: separate directories for config, commands, rules, scripts.
 - added "make setuid" target to the main Makefile.
-- status file is now updated when satan terminates.
+- status file is now updated when santa terminates.
 - status file cannot be specified on the command line (for parallel runs).
 
 Satan 0.36 beta:
@@ -276,39 +276,39 @@ Satan 0.36 beta:
 - added a rules/trust file to classify trust relationships by type.
 - put back the "widely trusting hosts" link in the report table of contents.
 - added a $dont_use_ping flag (config file, docs and GUI) so you can make
-  SATAN believe that hosts are always reachable.
+  SANTA believe that hosts are always reachable.
 
 Satan 0.34 beta:
 
 - print an error when get_targets fails instead of mysteriously terminating.
 - all hostnames should now be translated to lowercase
 - zap all prixy environment variables except no_proxy.
 - numerical $dont_attack_these and $only_attack_these patterns now work.
-- the boot.satan will now fire only when the client hostname resolves
+- the boot.santa will now fire only when the client hostname resolves
 - DNS: added a $dont_use_nslookup flag (config file, docs and GUI).
 - made the rpcinfo tool more accurate.
 - use safe_finger instead of plain finger (thanks Lionel).
 - updated the documentation (fping is bundled, attack level probe lists).
 - fixed some list problems that Mosaic could choke on.
-- re-wrote the satan.cf attack level lists as per Lionel's suggestion.
+- re-wrote the santa.cf attack level lists as per Lionel's suggestion.
   This makes the portscanner implementation much cleaner. Tools are now 
-  listed _with_ arguments, so no more automatic ".satan" tricks.
+  listed _with_ arguments, so no more automatic ".santa" tricks.
 - rules.services claimed all gopher or www servers on non-standard ports.
-- fixed output flushing in *.satan tools.
+- fixed output flushing in *.santa tools.
 
 Satan 0.33 beta:
 
-- minor portscan.satan fix (will rewrite this according to Lionel's suggestion).
+- minor portscan.santa fix (will rewrite this according to Lionel's suggestion).
 - more reconfig fixes (would replace perl5 by perl55)
 - more shell command filtering
-- fixed timeout order in satan script
+- fixed timeout order in santa script
 - portability fixes for the tcp/udp port scanner (hp-ux)
 
 Satan 0.3 beta:
 
-- found why SATAN would no longer look up the host IP of unprobed hosts.
+- found why SANTA would no longer look up the host IP of unprobed hosts.
 - Doesn't die when reading malformed data
-- slight fix to nfs-chk.satan
+- slight fix to nfs-chk.santa
 - cleaned up some html stuff/dead links
 - Added a test for pre 2.4 wustl ftp servers
 - Ever so small correction to reconfig... (I'm going to rewrite this in perl.)
@@ -321,12 +321,12 @@ Satan 0.2 beta:
 - fixed the reconfig script so it won't mangle perl path names anymore
 - will now tell you to become root or to make fping, tcp_scan etc. set-uid.
 - added a -V (version) command-line option. Unfortunately, PERL still
-  dumps core on IRIX 5.3 when SATAN is given a command-line option.
+  dumps core on IRIX 5.3 when SANTA is given a command-line option.
 - added a $running_under_html flag for GUI diagnostics
 
 Satan 0.1 beta:
 
-- fping is now completely integrated with satan.
+- fping is now completely integrated with santa.
 - better support of recursive `make -n'.
 - queries by host now support FQDN completion.
 - several broken html links fixed.

satan-1.1.1/Makefile

@@ -70,10 +70,10 @@ clean:
 	cd src/yp-chk; $(MAKE) clean
 	cd src/fping; $(MAKE) clean
 	cd src/rpcgen; $(MAKE) clean
-	rm -f html/satan.html html/satan_documentation.html status_file \
+	rm -f html/santa.html html/santa_documentation.html status_file \
 	bit_bucket
 
 tidy:	clean
 	rm -f *.old *.bak *.orig */*.old */*.bak */*.orig tmp_file*
 	rm -rf results
-	chmod -x satan
+	chmod -x santa

satan-1.1.1/README

@@ -1,13 +1,13 @@
 
 In order get things up and running,
 
-- You need a UNIX system to run SATAN. In order to unpack the SATAN
+- You need a UNIX system to run SANTA. In order to unpack the SANTA
   archive,
 
-	compress -d <satan-X.X.tar.Z | tar xvf -
+	compress -d <santa-X.X.tar.Z | tar xvf -
 
 - You will need PERL 5.000 or better (perl5 alpha is NOT good enough),
-  and a WWW browser (Netscape, Mosaic, or Lynx). SATAN looks a lot
+  and a WWW browser (Netscape, Mosaic, or Lynx). SANTA looks a lot
   better on a color display. The FAQ gives hints for MONO screens.
 
 - When you collect or view data about hundreds of hosts you will need a
@@ -16,7 +16,7 @@ In order get things up and running,
 
 - Run the "reconfig" script. It will patch some scripts with the
   pathnames of your PERL 5 executable, and of your WWW browser.  If
-  SATAN does not find the WWW browser that you want to use, edit the
+  SANTA does not find the WWW browser that you want to use, edit the
   config/paths.pl file and change the line 
 
 	$MOSAIC="program_name";
@@ -32,26 +32,26 @@ In order get things up and running,
   etc.) and/or change your browser configuration to not use your SOCKS
   host or HTTP Proxy (see your HTML browser's option section.)
 
-- Run the "satan" script. When run without arguments, it will start up
-  a WWW browser. The command-line interface is described in the satan.8
-  manual page ("nroff -man" format). You must run SATAN as superuser if
+- Run the "santa" script. When run without arguments, it will start up
+  a WWW browser. The command-line interface is described in the santa.8
+  manual page ("nroff -man" format). You must run SANTA as superuser if
   you want to collect data.
 
-- You can run multiple SATAN processes in parallel to speed up data
+- You can run multiple SANTA processes in parallel to speed up data
   collection, but each process should be given its own database (via
-  the "-d" command-line option). We use one SATAN database per block of
-  256 addresses (satan -d x.x.x x.x.x). After data collection you can
-  merge SATAN databases in core with the HTML browser (see the
+  the "-d" command-line option). We use one SANTA database per block of
+  256 addresses (santa -d x.x.x x.x.x). After data collection you can
+  merge SANTA databases in core with the HTML browser (see the
   documentation on scanning and databases for more on this.) Parallel
   code and sharing of databases will come at a later date.
 
 - Use your browser's PRINT button to print reports.
 
 Most documentation is accessible via your WWW browser. 
 
-Last but not least, SATAN was written to improve Internet security.
+Last but not least, SANTA was written to improve Internet security.
 Don't put our work to shame.
 
 	Wietse Venema / Dan Farmer 
-	    (satan@fish.com)
+	    (santa@fish.com)
 

satan-1.1.1/TODO

@@ -1,7 +1,7 @@
-TODO list for future (SATAN version 1.1, 2.0, whatever)
+TODO list for future (SANTA version 1.1, 2.0, whatever)
 ----------------------------------------------------------
 
-o	Enable SATAN to fork and run several scans in parallel
+o	Enable SANTA to fork and run several scans in parallel
 o       Talk about sending mail/syslog to each host scanned
 o       Look at and deal with subnet masks properly...
 o       Put in a DNS walker