firewall freeBSD

Definisi Firewall :
adalah sebuah sistem atau perangkat yang mengizinkan lalu lintas jaringan yang dianggap aman untuk melaluinya dan mencegah lalu lintas jaringan yang tidak aman. Umumnya, sebuah tembok-api diterapkan dalam sebuah mesin terdedikasi, yang berjalan pada pintu gerbang (gateway) antara jaringan lokal dan jaringan lainnya. Tembok-api umumnya juga digunakan untuk mengontrol akses terhadap siapa saja yang memiliki akses terhadap jaringan pribadi dari pihak luar. Saat ini, istilah firewall menjadi istilah lazim yang merujuk pada sistem yang mengatur komunikasi antar dua jaringan yang berbeda. Mengingat saat ini banyak perusahaan yang memiliki akses ke Internet dan juga tentu saja jaringan berbadan hukum di dalamnya, maka perlindungan terhadap modal digital perusahaan tersebut dari serangan para peretas, pemata-mata, ataupun pencuri data lainnya, menjadi hakikat.



Syntax Firewall
IPFW :
COntoh :
Ipfw show : melihat perintah berjalan di firewall
ipfw 90 deny ip from 192.168.66.20 to any : Mengeblok ip 192.168.66.20
ipfw delete 90 : menghapus perintah ipfw dibaris 90
 Drop all www traffic from a network
– ipfw add deny tcp from 12.12.12.0/24 to www.ubc.ca 80
 Drop all telnet traffic from a bad host
– ipfw add deny tcp from bad.host.com to my.host.com 23
 Throw away RFC 1918 networks
– ipfw add deny all from 10.0.0.0/8 to any in via fxp0
– ipfw add deny all from 172.16.0.0/12 to any in via fxp0
– ipfw add deny all from 192.168.0.0/16 to any in via fxp0
 Allow ssh
– ipfw add allow tcp from any to any 22 in via fxp0 setup keep-state
 Limit WWW traffic to 100Mbps
 ipfw pipe 1 config bw 100Mbit/s
 ipfw add pipe 1 ip from any to any dst-port 80
 Prefer ssh to telnet traffic
 ipfw pipe 2 config bw 256kbit/s
 ipfw queue 1 config pipe 2 weight 7
 ipfw queue 2 config pipe 2 weight 3
 ipfw add queue 1 ip from any to any dst-port 22
 ipfw add queue 2 ip from any to any dst-port 23
Security :
1. Port (allow/deny) contoh allow : http port (80), ftp (21), ssh (22), telnet (23) Deny : netbios (port 135 – 139)
2. Arp
Arp -an
Arp -da
arp -f /home/atrih/arp-test
192.168.71.254 00:1b:b9:b2:07:e9
192.168.71.72 00:1c:25:5f:ab:b2
3. Monitoring besar paket (Iftop, ifstat), jenis paket (tcpdump)
4. Subneting (ip calculator)
255.255.240.0 /20
255.255.248.0 /21
255.255.252.0 /22
255.255.254.0 /23
255.255.255.0 /24
255.255.255.128 /25
255.255.255.192 /26
255.255.255.224 /27
255.255.255.240 /28
255.255.255.248 /29
255.255.255.252 /30
5. Ping (-n, -t, l)








Read More..

Posts filed under 'FreeBSD'

Pertama-tama konfigurasi kernel anda agar support pf :

#Packet Filter Options

device pf
device pflog
device pfsync

#Enabling ALTQ

options ALTQ
options ALTQ_CBQ # Class Bases Queuing (CBQ)
options ALTQ_RED # Random Early Detection (RED)
options ALTQ_RIO # RED In/Out
options ALTQ_HFSC # Hierarchical Packet Scheduler (HFSC)
options ALTQ_PRIQ # Priority Queuing (PRIQ)
options ALTQ_NOPCC # Required for SMP build

Berikut konfigurasi yg saya implementasikan pada box FreeBsd saya, buat para admin jaringan yang menggunakan box FreeBsd silahkan anda kopas. Tapi sesuaikan dengan kondisi box sampeyan..

### macros

# internal and external interfaces (ketikan ‘ifconfig’ buat lihat interface)

int_if = “vr0″

ext_if = “rl0″

# Port Yang Boleh Diakses dari Luar Box silahkan sesuaikan

tcp_services = “{ 80, 110, 25, 53, 113, 21}”

udp_services = “{ 53, 1194 }”

# ping requests

icmp_types = “echoreq”

# Private Network, Yg Mau di Blok Traffiknya

priv_nets = “{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }”

### options


set block-policy return

set loginterface $ext_if

set skip on lo0

### Scrub

scrub in all

### nat/rdr

# NAT traffic dari Internal Ke External

nat on $ext_if from $int_if:network to any -> ($ext_if)

# Port Redirector untuk Transparent Proxy & Transparent FTP

rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021

rdr on $int_if proto tcp from any to any port 80 -> 127.0.0.1 port 3128

### filter rules

block all

# Blok Traffik Dari Luar Yang Pake IP Private


block drop in quick on $ext_if from $priv_nets to any

# Blok Trafik dari Luar ke Internal

block drop out quick on $ext_if from any to $priv_nets

# Perbolehkan Akses ke TCP port tertentu

pass in on $ext_if inet proto tcp from any to ($ext_if) \

port $tcp_services flags S/SA keep state

# Perbolehkan Akses ke UDP port tertentu

pass in on $ext_if proto udp to any port $udp_services keep state

# Perbolehkan Akses FTP


pass in on $ext_if inet proto tcp from port 20 to ($ext_if) \

user proxy flags S/SA keep state

# Ping Reply OK

pass in inet proto icmp all icmp-type $icmp_types keep state

# Perbolehkan Traffik dari Internal ke Internal Interface

pass in on $int_if from $int_if:network to any keep state

pass out on $int_if from any to $int_if:network keep state

# Perbolehkan Traffik keluar melalui External Interface

pass out on $ext_if proto tcp all modulate state flags S/SA


pass out on $ext_if proto { udp, icmp } all keep state

Untuk ngecek nat dan konfigurasi anda silahkan gunakan perintah

# pfctl -Fn -Nf /etc/pf.conf

flush rules

# pfctl -f /etc/pf.conf

Dan untuk me-restart pf anda gunakan perintah

# pfctl -NORf /etc/pf.conf

Biar auto start, masukkan script berikut di rc.conf anda :

pf_enable="YES" # Enable PF (load module if required)
pf_rules="/etc/pf.conf" # rules definition file for pf
pf_flags="" # additional flags for pfctl startup
pflog_enable="YES" # start pflogd(8)
pflog_logfile="/var/log/pflog" # where pflogd should store the logfile
pflog_flags="" # additional flags for pflogd startup
gateway_enable="YES" # Enable as LAN gateway


Read More..

Install MySQL Server

First you need to login as root or run su in order to get the required permissions.
Then navigate to the ports folder for MySQL:

cd /usr/ports/databases/mysql50-server

Now run:

make install clean

in order to download and install MySQL.
Once the install is finished we install the databases by running:

mysql_install_db --user=mysql

If you get an error, run rehash in order to update FreeBSD's path environment variables.
Once this is done we want to grant permissions to the mysql user in /var/db/mysql.

chown -R mysql /var/db/mysql/
chgrp -R mysql /var/db/mysql/

Now we can start MySQL by running:

/usr/local/bin/mysqld_safe -user=mysql &

Since we probably want MySQL to start after a reboot we will drop a line to /etc/rc.conf

echo 'mysql_enable="YES"' >> /etc/rc.conf

By default MySQL's root account has no password, so we need to change it (If we want our system to be somewhat secure). To change the password for root we enter the following command:

mysqladmin -u root password newpassword

...where newpassword is the password of our choice.

Now we can start making use of our new database server.

If you want to tweak your machine there are different configuration files you can use with your MySQL Server depending on load and what it will be used for. They are located in /usr/local/share/mysql and are called:

my-huge.cnf
my-innodb-heavy-4G.cnf
my-large.cnf
my-medim.cnf
my-small.cnf

We make an example with my-medium.cnf and copy it to /var/db/mysql as my.cnf.

cp /usr/local/share/mysql/my-medim.cnf /var/db/mysql/my.cnf
Read More..

Manifesto Hacker

Ada semacam romantisme kenakalan remaja pada budaya hacker. Napas-napas pemberontakan yang memikat. Romantisme tersebut berasal dari idealisme kebebasan dan rasa ingin tahu. Seperti tercermin dalam dokumen 'The Conscience of a Hacker' (Hati Nurani Seorang Hacker) yang dituliskan seorang bernama Lyod Blankenship yang di kalangan undergroun lebih dikenal dengan sebutan The Mentor.
Berikut cuplikan dokumen yang kerap disebut 'Manifesto Hacker' itu :

Inilah dunia kami... dunia elektron dan switch, beauty of the baud. Kalian menyebut kami penjahat... karena kami menggunakan layanan yang sudah ada tanpa membayar, padahal layanan itu seharusnya sangat murah jika tidak dikuasai oleh orang-orang rakus. Kami kalian sebut penjahat... karena kami gemar menjelajah. Kami kalian sebut penjahat... karena kami mengejar ilmu pengetahuan. Kami ada tanpa warna kulit, tanpa kebangsaan, tanpa bias agama... tapi bagi kalian kami penjahat. Kami adalah penjahat... sedangkan kalianlah yang membuat bom nuklir, mengobarkan peperangan, membunuh, berbuat curang, berbohong, dan berusaha membuat kami percaya bahwa itu semua demi kebaikan kami.
Ya, aku adalah penjahat. Kejahatanku adalah keingintahuanku. Kejahatanku adalah menilai orang berdasarkan perkataan dan pikiran mereka, dan bukan berdasarkan penampilan mereka. Kejahatanku adalah menjadi lebih pintar dari kalian, sebuah dosa yang tak akan bisa kalian ampuni.
Aku adalah hacker, dan inilah manifestoku. Kau bisa menghentikan satu, tapi kau tak bisa menghentikan kami semuanya... Bagaimanapun juga, kami semua sama. (The Mentor, 1986)
Read More..

john the ripper

target

Sekarang kita akan mencari target. Biasa.. kita mampir ke rumahnya paman
Google (google.com). Ketik keyword berikut lalu klik tombol search:

Inurl:/etc/passwd/

Eits.. tunggu dulu.. maksudnya apaan nich?? Okay, gue jelasin yach ....
Untuk melakukan password cracking, kita khan harus tau dimana file password
yang mau di-crack. Naah, target kita kali ini adalah sistem operasi Linux.

Pada OS Linux, file passwordnya berada di lokasi /etc/passwd. Sedangkan
shadow passwordnya berada di /etc/shadow (baca arsip lama mengenai Shadow
Password ). Dengan bantuan paman google, kita berusaha mencari file password
dengan cara mengetikkan keyword diatas.

Well.. gimana nich hasil pencariannya? pasti muncul banyak khan.. ;) Klik
salah satu link, dan isi file /etc/passwd akan ditampilkan. oleh browser. Copy
- pastekan isi file tersebut pada notepad dan simpan dengan nama password.txt.

Sekarang, kita akan melihat isi file shadow passwordnya.Misalkan url situs
korban yang anda buka tadi adalah:

http://www.spyrozone.tk/spyrokid/config/etc/passwd-

Ubahlah alamat itu pada address bar menjadi:

http://www.spyrozone.tk/spyrokid/config/etc/shadow-

Naah, kini isi dari file etc/shadow akan ditampilkan oleh browser. Copy -
paste isi file tersebut pada notepad, lalu simpan dengan nama shadow.txt.



::--||-[3]. Password Cracking
-----------------------------

Eh, udah punya John The Ripper belum?? Kalau belum, kamu bisa download
John The Ripper di member area www.spyrozone.tk. Kalau sudah, saatnya kita
melakukan password craCKING!

Extract file hasil downloadnya ke suatu folder lalu buka lewat MSDOS. Biar
gampang,copy juga file password.txt dan shadow.txt tadi ke directory yang sama
dengan John The Ripper. Setelah itu, gabungkan file password.txt dan file
shadow.txt dengan menggunakan program unshadow.exe milik John The Ripper.
Perintahnya ialah:

unshadow password.txt shadow.txt >> crack.txt

Setelah itu, kita gunakan john-mmx.exe untuk mengCRACK file crack.txt
dengan menggunakan perintah:

john-mmx crack.txt

Tunggu dech.. lamanya hasil crack yang keluar tergantung dari seberapa
panjang password korban dan seberapa rumit karakter (special characters) yang
digunakan dalam password. Jika proses cracking berhasil, akan muncul:

username (password)



Read More..

SHADOW PASSWORD

Secara umum teknik "Shadow Password" di susun sebagai berikut:
Untuk semua entry dalam direktori '/etc/passwd_file' , password yang terenkripsi dipindah ke file yang lain, seperti '/etc/shadow'.
Sementara '/etc/passwd' dapat dibaca oleh tiap orang dalam sistem, 'etc/shadow' hanya dapat dibaca oleh group yang bersangkutan, bahkan mungkin hanya dapat dibaca oleh superuser. Hal ini diperlukan untuk mengantisipasi daftar password yang terenkripsi dipecahkan oleh program dictionary.
Ide pada "menyembunyikan informasi" (information hiding) adalah satu dari banyak teknik yang terkandung dalam kategori "Security through Obscurity". Menurut orang-orang komunitas LINUX, ada 2 opini tentang "Security through Obscurity", yaitu:

1. "Dapat membantu dan tidak dapat dirusak, maka marilah kita menggunakannya"
2. "Sebenarnya dapat dirusak, sebab dia membuat perasaan yang salah pada sekuriti, dan sebaiknya jangan digunakan"

Tetapi masih banyak lagi orang yang akan mengemukakan kebaikan dari menggunakan shadow password, maka akan dikemukakan ketidak-baikan dari shadow password. Asumsi utama ketika orang menggunakan sistem dengan shadow password adalah bahwa penggunaan sistem ini menjanjikan bahwa tidak seorang pun yang tidak mempunyai hak, akan dapat melihat daftar passwordnya.
Tetapi bagaimanapun juga, ada beberapa manusia dapat membuat kesalahan dengan melepas daftar password tersebut. Mungkin lawan (Adversary) yang mempunyai akses root sebelumnya, dengan menuju ke "tempat kerja" SysAdmin pada waktu yang tepat, ia akan dapat memperoleh informasi yang dibutuhkan. Adversary mungkin tidak cukup waktu untuk meng-install program "backdoor", tetapi dia dapat "melayangkan pukulan pada file password tersebut.
Atau dengan membuat sebuah error pada setting permission dari 'etc/shadow', atau memberi instruksi "chmod a+r /etc/*" tanpa memikirkan keterlibatannya pada'/etc/shadow'.
Atau kemungkinan lain yaitu terdapatnya problem sekuriti yang baru saja di perbaiki setelah menggunakan "CERT advisory", hal ini akan membuat daftar password akan terbaca oleh siapapun juga ! Dan masih banyak cara lagi untuk melepaskan isi dari '/etc/shadow', bila kita pernah menjadi seorang SysAdmin yang berpengalaman.
Masalah dengan menggunakan sistem seperti shadow password adalah system ini akan memberikan perasaan salah dari security (false sense of security). Pada kasus ini, mereka akan mengira bahwa daftar password sudah aman dan terproteksi. Perasaan ini sering membuat sysAdmin malas menggunakan metode yang lebih superior, dan lebih pro-aktif (pro-active method) untuk memproteksi file password.
Yang paling mudah dan yang paling murah pada metoda pro-aktif adalah cara menukar direktori password. Tidak ada sistem lain yang diubah, --hanya menukar posisi direktori '/bin/passwd'. Terdapat beberapa program dan utiliti UNIX untuk menukar default direktori password, seperti "Matt Bishop's passwd+" dari darmouth.edu:/pub/security dan "Mark Henderson's ANLpasswd" dari info.mcs.anl.gov:/pub/systems.
Pada dasarnya, tiap seseorang mengubah pasword, program-program tadi akan membandingkan dengan dictionary (dan ke gecos field), hal ini mirip dengan cara kerja program ceacker. Apabila user memilih password yang "lemah", program pro-aktif ini akan memaksa user untuk mengubah pilihan password mereka.
Tanpa menggunakan sebuah program pro-aktif, kita harus juga mengkawatirkan tentang serangan program cracker (pada risetm, lebih dari 15 tahun belakangan ini, tanpa program pro-aktif, sebagian besar user akan memilih password yang mudah, dapat di crack, sering berupa nama depan wanita). Apabila bergantung pada sebuah sistem shadow password untuk mengamankan password kita, maka direktory '/etc/shadow/' akan dijamin mudah diserang.
Bagaimanapun juga, ketika menggunakan sebuah pro-aktif password checker, kita dapat mengumumkan ke dunia luar nama-nama password yang mudah diserang. Memaksa user untuk mengganti password mereka secara berkala juga akan mengurangi kemungkinan bocornya sekuriti.
Read More..

How To Become A Hacker

Q: How do I tell if I am already a hacker?

A:Ask yourself the following three questions:

*Do you speak code, fluently?
*Do you identify with the goals and values of the hacker community?
*Has a well-established member of the hacker community ever called you a hacker?

If you can answer yes to all three of these questions, you are already a hacker. No two alone are sufficient.

The first test is about skills. You probably pass it if you have the minimum technical skills described earlier in this document. You blow right through it if you have had a substantial amount of code accepted by an open-source development project.

The second test is about attitude. If the five principles of the hacker mindset seemed obvious to you, more like a description of the way you already live than anything novel, you are already halfway to passing it. That's the inward half; the other, outward half is the degree to which you identify with the hacker community's long-term projects.

Here is an incomplete but indicative list of some of those projects: Does it matter to you that Linux improve and spread? Are you passionate about software freedom? Hostile to monopolies? Do you act on the belief that computers can be instruments of empowerment that make the world a richer and more humane place?

But a note of caution is in order here. The hacker community has some specific, primarily defensive political interests — two of them are defending free-speech rights and fending off "intellectual-property" power grabs that would make open source illegal. Some of those long-term projects are civil-liberties organizations like the Electronic Frontier Foundation, and the outward attitude properly includes support of them. But beyond that, most hackers view attempts to systematize the hacker attitude into an explicit political program with suspicion; we've learned, the hard way, that these attempts are divisive and distracting. If someone tries to recruit you to march on your capitol in the name of the hacker attitude, they've missed the point. The right response is probably “Shut up and show them the code.”

The third test has a tricky element of recursiveness about it. I observed in the section called “What Is a Hacker?” that being a hacker is partly a matter of belonging to a particular subculture or social network with a shared history, an inside and an outside. In the far past, hackers were a much less cohesive and self-aware group than they are today. But the importance of the social-network aspect has increased over the last thirty years as the Internet has made connections with the core of the hacker subculture easier to develop and maintain. One easy behavioral index of the change is that, in this century, we have our own T-shirts.

Sociologists, who study networks like those of the hacker culture under the general rubric of "invisible colleges", have noted that one characteristic of such networks is that they have gatekeepers — core members with the social authority to endorse new members into the network. Because the "invisible college" that is hacker culture is a loose and informal one, the role of gatekeeper is informal too. But one thing that all hackers understand in their bones is that not every hacker is a gatekeeper. Gatekeepers have to have a certain degree of seniority and accomplishment before they can bestow the title. How much is hard to quantify, but every hacker knows it when they see it.

Q: Will you teach me how to hack?

A: Since first publishing this page, I've gotten several requests a week (often several a day) from people to "teach me all about hacking". Unfortunately, I don't have the time or energy to do this; my own hacking projects, and working as an open-source advocate, take up 110% of my time.

Even if I did, hacking is an attitude and skill you basically have to teach yourself. You'll find that while real hackers want to help you, they won't respect you if you beg to be spoon-fed everything they know.

Learn a few things first. Show that you're trying, that you're capable of learning on your own. Then go to the hackers you meet with specific questions.

If you do email a hacker asking for advice, here are two things to know up front. First, we've found that people who are lazy or careless in their writing are usually too lazy and careless in their thinking to make good hackers — so take care to spell correctly, and use good grammar and punctuation, otherwise you'll probably be ignored. Secondly, don't dare ask for a reply to an ISP account that's different from the account you're sending from; we find people who do that are usually thieves using stolen accounts, and we have no interest in rewarding or assisting thievery.

Q:How can I get started, then?

A: The best way for you to get started would probably be to go to a LUG (Linux user group) meeting. You can find such groups on the LDP General Linux Information Page; there is probably one near you, possibly associated with a college or university. LUG members will probably give you a Linux if you ask, and will certainly help you install one and get started.

Q: When do you have to start? Is it too late for me to learn?

A: Any age at which you are motivated to start is a good age. Most people seem to get interested between ages 15 and 20, but I know of exceptions in both directions.

Q: How long will it take me to learn to hack?

A: That depends on how talented you are and how hard you work at it. Most people who try can acquire a respectable skill set in eighteen months to two years, if they concentrate. Don't think it ends there, though; in hacking (as in many other fields) it takes about ten years to achieve mastery. And if you are a real hacker, you will spend the rest of your life learning and perfecting your craft.

Q: Is Visual Basic a good language to start with?

A: If you're asking this question, it almost certainly means you're thinking about trying to hack under Microsoft Windows. This is a bad idea in itself. When I compared trying to learn to hack under Windows to trying to learn to dance while wearing a body cast, I wasn't kidding. Don't go there. It's ugly, and it never stops being ugly.

There is a specific problem with Visual Basic; mainly that it's not portable. Though there is a prototype open-source implementations of Visual Basic, the applicable ECMA standards don't cover more than a small set of its programming interfaces. On Windows most of its library support is proprietary to a single vendor (Microsoft); if you aren't extremely careful about which features you use — more careful than any newbie is really capable of being — you'll end up locked into only those platforms Microsoft chooses to support. If you're starting on a Unix, much better languages with better libraries are available. Python, for example.

Also, like other Basics, Visual Basic is a poorly-designed language that will teach you bad programming habits. No, don't ask me to describe them in detail; that explanation would fill a book. Learn a well-designed language instead.

One of those bad habits is becoming dependent on a single vendor's libraries, widgets, and development tools. In general, any language that isn't fully supported under at least Linux or one of the BSDs, and/or at least three different vendors' operating systems, is a poor one to learn to hack in.

Q: Would you help me to crack a system, or teach me how to crack?

A: No. Anyone who can still ask such a question after reading this FAQ is too stupid to be educable even if I had the time for tutoring. Any emailed requests of this kind that I get will be ignored or answered with extreme rudeness.

Q: How can I get the password for someone else's account?

A: This is cracking. Go away, idiot.

Q: How can I break into/read/monitor someone else's email?

A: This is cracking. Get lost, moron.

Q: How can I steal channel op privileges on IRC?

A: This is cracking. Begone, cretin.

Q: I've been cracked. Will you help me fend off further attacks?

A: No. Every time I've been asked this question so far, it's been from some poor sap running Microsoft Windows. It is not possible to effectively secure Windows systems against crack attacks; the code and architecture simply have too many flaws, which makes securing Windows like trying to bail out a boat with a sieve. The only reliable prevention starts with switching to Linux or some other operating system that is designed to at least be capable of security.

Q: I'm having problems with my Windows software. Will you help me?

A: Yes. Go to a DOS prompt and type "format c:". Any problems you are experiencing will cease within a few minutes.

Q: Where can I find some real hackers to talk with?

A: The best way is to find a Unix or Linux user's group local to you and go to their meetings (you can find links to several lists of user groups on the LDP site at ibiblio).

(I used to say here that you wouldn't find any real hackers on IRC, but I'm given to understand this is changing. Apparently some real hacker communities, attached to things like GIMP and Perl, have IRC channels now.)

Q: Can you recommend useful books about hacking-related subjects?

A: I maintain a Linux Reading List HOWTO that you may find helpful. The Loginataka may also be interesting.

For an introduction to Python, see the introductory materials on the Python site.

Q: Do I need to be good at math to become a hacker?

A: No. Hacking uses very little formal mathematics or arithmetic. In particular, you won't usually need trigonometry, calculus or analysis (there are exceptions to this in a handful of specific application areas like 3-D computer graphics). Knowing some formal logic and Boolean algebra is good. Some grounding in finite mathematics (including finite-set theory, combinatorics, and graph theory) can be helpful.

Much more importantly: you need to be able to think logically and follow chains of exact reasoning, the way mathematicians do. While the content of most mathematics won't help you, you will need the discipline and intelligence to handle mathematics. If you lack the intelligence, there is little hope for you as a hacker; if you lack the discipline, you'd better grow it.

I think a good way to find out if you have what it takes is to pick up a copy of Raymond Smullyan's book What Is The Name Of This Book?. Smullyan's playful logical conundrums are very much in the hacker spirit. Being able to solve them is a good sign; enjoying solving them is an even better one.

Q: What language should I learn first?

A: XHTML (the latest dialect of HTML) if you don't already know it. There are a lot of glossy, hype-intensive bad HTML books out there, and distressingly few good ones. The one I like best is HTML: The Definitive Guide.

But HTML is not a full programming language. When you're ready to start programming, I would recommend starting with Python. You will hear a lot of people recommending Perl, and Perl is still more popular than Python, but it's harder to learn and (in my opinion) less well designed.

C is really important, but it's also much more difficult than either Python or Perl. Don't try to learn it first.

Windows users, do not settle for Visual Basic. It will teach you bad habits, and it's not portable off Windows. Avoid.

Q: What kind of hardware do I need?

A: It used to be that personal computers were rather underpowered and memory-poor, enough so that they placed artificial limits on a hacker's learning process. This stopped being true in the mid-1990s; any machine from an Intel 486DX50 up is more than powerful enough for development work, X, and Internet communications, and the smallest disks you can buy today are plenty big enough.

The important thing in choosing a machine on which to learn is whether its hardware is Linux-compatible (or BSD-compatible, should you choose to go that route). Again, this will be true for almost all modern machines. The only really sticky areas are modems and wireless cards; some machines have Windows-specific hardware that won't work with Linux.

There's a FAQ on hardware compatibility; the latest version is here.

Q: I want to contribute. Can you help me pick a problem to work on?

A: No, because I don't know your talents or interests. You have to be self-motivated or you won't stick, which is why having other people choose your direction almost never works.

Try this. Watch the project announcements scroll by on Freshmeat for a few days. When you see one that makes you think "Cool! I'd like to work on that!", join it.

Q: Do I need to hate and bash Microsoft?

A: No, you don't. Not that Microsoft isn't loathsome, but there was a hacker culture long before Microsoft and there will still be one long after Microsoft is history. Any energy you spend hating Microsoft would be better spent on loving your craft. Write good code — that will bash Microsoft quite sufficiently without polluting your karma.

Q: But won't open-source software leave programmers unable to make a living?

A: This seems unlikely — so far, the open-source software industry seems to be creating jobs rather than taking them away. If having a program written is a net economic gain over not having it written, a programmer will get paid whether or not the program is going to be open-source after it's done. And, no matter how much "free" software gets written, there always seems to be more demand for new and customized applications. I've written more about this at the Open Source pages.

Q: Where can I get a free Unix?

A:If you don't have a Unix installed on your machine yet, elsewhere on this page I include pointers to where to get the most commonly used free Unix. To be a hacker you need motivation and initiative and the ability to educate yourself. Start now...

Read More..