HDTenEightyP/NetNews huggingface dataset:
From: jfh@rpp386.lonestar.org (John F. Haugh II)
Newsgroups: comp.security.misc
Subject: Re: Shadow password file software for BSD 4.2
Date: 8 Sep 92 23:42:43 GMT
Reply-To: jfh@rpp386.cactus.org (John F. Haugh II)
Organization: River Parishes Programming, Austin, Republic of Texas

In article <Bu9ILz.4Fy@cck.coventry.ac.uk> ccx009@cch.coventry.ac.uk (Adam Bentley) writes:
>I've got  John F. Haugh II's  package but its way off being ready to go 
>especially on an old 4.2 unix without things like password aging.

You can just turn aging off when you build Shadow.  If there are other
problems, please report them to me as bugs and I'll get them fixed.

Actually, a better person to get ahold of is Steve Simmons.  He did a
significant amount of work in that area.  I don't know where he is
hiding these days ...
-- 
John F. Haugh II                   | "The US Government has the Midas Muffler
Ma Bell: (512) 251-2151            |  touch: everything they touch turns to
UUCP: ...!cs.utexas.edu!rpp386!jfh |  shit."
Domain: jfh@rpp386.cactus.org      |                  -- Jay Maynard
Newsgroups: comp.security.misc
From: S_TITZ@iravcl.ira.uka.de (Olaf Titz)
Subject: Re: Locking terminals (was Re: New Princeton Policy)
Organization: Fachschaft Informatik, Uni Karlsruhe
Date: Fri, 11 Sep 1992 16:29:13 GMT
X-News-Reader: VMS NEWS 1.23

In <9225518.22142@mulga.cs.mu.OZ.AU> fjh@munta.cs.mu.OZ.AU writes:

>  Here at Melbourne Uni on one of the student machines, the lock command
>  has a default time-out of 15 minutes.
>  
>  After 15 minutes, lock terminates and drops back into your shell, leaving
>  your account wide open.

You could as well have not mentioned that it was a *student* machine
;-)

Of course 'real' users would never accept such a security hole...
(Then I would prefer the automatic logout after 15 minutes...)

MfG,
        Olaf
-- 
    o     Olaf Titz - comp.sc.student - univ of karlsruhe - germany
 _ /<_    s_titz@iravcl.ira.uka.de - uknf@dkauni2.bitnet - praetorius@irc
(_)>(_)   +49-721-60439 - did i forget something?
In hardware engineering, Ohm's law and Maxwell's equations pale in
  importance and influence next to Murphy's law. - Gordon Bell
Newsgroups: comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: Hiding Processes from ps -ax
Date: 11 Sep 92 04:48:16 GMT

avalon@coombs.anu.edu.au (Darren Reed) writes:
>Some people reported that "ps" showed "rn ut".

I never saw those articles; on what system does it do this??!??!?  That is, if
you zero out the rest of the name as my article said.  This would be extremely
bizarre behaviour and I'm quite sceptical that it exists.

>Here, it shows "rn (a.out)".
>eg, I commonly have this:
>18570 p8   I     0:01 -tcsh (tcsh)

This is not the same situation.  Did my program actually show "rn (a.out)" or
are you extrapolating?  On what OS?  There is a kludge in ps for when the
argv[0] begins with a minus sign.  On SunOS 4.1.1 at least, it also seems to be
triggered by having a completely empty name, as you create later.  Neither of
these are methods I suggested because neither of them achieves the desired
results.

>However, if you can get the pid of a process then you can also
>get the inode number of it too

Processes don't have inode numbers.  Files have inode numbers.

>and if you have a decent OS, it shouldnt let you delete it while its running
>(SunOS allows you to unlink running processes :-/).

If you have a decent OS, it shouldn't try to second-guess you to death.  Unix
has always (well for a very, very long time at least) permitted you to unlink
files which are currently being executed, and to kill processes.  Neither of
these is an undesirable feature; the second is essential; if you don't like the
first, just don't invoke it.

>Just now I tried the following:
>	for (s = argv; *s; s++)
>		for (t = *s; *t;)
>			*t++ = '\0';
>	pause();

Yes, as I originally posted, this is not useful.


And to continue the confusion, gay@moebius.loria.fr (Gay Stephane) writes:
>ok, name is changed. but you can have the real name using ps -axc.
>still waiting for *the* solution.

*The* solution to hiding names from ps -ax?  As I posted.  Some other solution?
I guess it depends on to which problem.  If you want to change the name that
ps -axc reports, change the name of the program before executing it.  Using
symlinks may help but this is not an essential component.
Newsgroups: comp.security.misc
From: fjh@munta.cs.mu.OZ.AU (Fergus James HENDERSON)
Subject: Re: Locking terminals (was Re: New Princeton Policy)
Organization: Computer Science, University of Melbourne, Australia
Date: Fri, 11 Sep 1992 08:28:37 GMT

S_TITZ@iravcl.ira.uka.de (Olaf Titz) writes:

>>  In article <CKD.92Sep9143724@loiosh.eff.org>, ckd@eff.org (Christopher Davis) writes:
>>  |>  Olaf> This means: 'If you must go to the restroom you HAVE to leave the
>>  |>  Olaf> terminal open, so that other users can terminate your session if
>>  |>  Olaf> they need the machine.' This is IMO simply unacceptable. Other
>>  |>  Olaf> policies would REQUIRE to lock the terminal to prevent tampering
>>  |>  Olaf> with your account.
>>  |> 
>>  |> MIT's Athena workstation policy is that you can lock it for no more than
>>  |> 20 minutes before someone can feel free to reboot it or otherwise
>>  |> "forcibly unlock" it.  The "standard" screenlocker has a displayed timer
>
>Rebooting is not the way of choice, I think...
>
>>  |> of "how long I've been locked".
>>  |> 
>>...  
>>  At Rice, we have an X windows lockscreen program with a twenty minute
>>  timer.  After twenty minutes, the lockscreen itself logs the user out.
>>  The logout is pretty clean.  The only thing we haven't solved yet is
>>  how to get the user's .logout file to be read on logout by the
>>  lockscreen program.
>
>What about the following?
>
>A locking program that 
>- displays the time it is running,
>- after N minutes provides a button which will log the user out (with
>N preferrably to be specified in a configuration file),
>- perhaps communicates with other workstations in the cluster, to
>enable the logout only when no other workstation is idle.
>
>I leave the gory details of the implementation to the people who know
>X (that excludes me, unfortunately ;-)

Here at Melbourne Uni on one of the student machines, the lock command
has a default time-out of 15 minutes.

After 15 minutes, lock terminates and drops back into your shell, leaving
your account wide open.

-- 
Fergus Henderson             fjh@munta.cs.mu.OZ.AU      
This .signature virus is a self-referential statement that is true - but 
you will only be able to consistently believe it if you copy it to your own
.signature file!
Newsgroups: comp.security.misc,alt.security
From: lorrayne@smiley.mitre.org (Lorrayne Schaefer)
Subject: Anyone know of an audit tool that runs on OS/2?
Organization: The MITRE Corporation, McLean, VA
Date: Tue, 15 Sep 1992 12:56:35 GMT


The subject says it all.  I'm looking for an audit tool that runs on an
OS/2.  If you know of one, if possible, please include a point of contact
and a phone number.

Thanks

Xref: sparky comp.security.misc:1226 alt.security:4331 alt.sources.d:1128 comp.sources.testers:24 comp.unix.admin:4982
From: jfh@rpp386.lonestar.org (John F. Haugh II)
Newsgroups: comp.security.misc,alt.security,alt.sources.d,comp.sources.testers,comp.unix.admin
Subject: Re: Beta testers needed for security tool
Date: 10 Sep 92 12:34:41 GMT
Reply-To: jfh@rpp386.cactus.org (John F. Haugh II)
Organization: River Parishes Programming, Austin, Republic of Texas

In article <1992Sep8.144541.2091@ms.uky.edu> morgan@ms.uky.edu (Wes Morgan) writes:
>In article <sims.715743134@starbase> sims@drake.mitre.org (Jim Sims) writes:
>>(buncha stuff about a utility to diff files as a security measure deleted)
>>
>> It seems to me rather useless and extremely CPU and I/O expensive to diff
>>files as a security measure. 
>
>Well, every little bit helps.  If I can run this thing once or twice per
>week without melting my CPU or I/O controller, it's worth it.

I run something like this nightly.  It checks UID, GID, mode bits, sizes,
creation and update times, and the checksum.  It has yet to find an
intruder, but then the system hasn't been broken into in 3 or 4 years now.

You'd be surprised how much idle CPU time you have at 2am ;-)
-- 
John F. Haugh II                   | "The US Government has the Midas Muffler
Ma Bell: (512) 251-2151            |  touch: everything they touch turns to
UUCP: ...!cs.utexas.edu!rpp386!jfh |  shit."
Domain: jfh@rpp386.cactus.org      |                  -- Jay Maynard
Xref: sparky comp.security.misc:1198 alt.security:4299 alt.sources.d:1118 comp.sources.testers:13 comp.unix.admin:4934
From: karger@osf.org (Paul A. Karger)
Newsgroups: comp.security.misc,alt.security,alt.sources.d,comp.sources.testers,comp.unix.admin
Subject: Re: Beta testers needed for security tool
Date: 8 Sep 92 16:41:08 GMT
Organization: Open Software Foundation

In article <WESOMMER.92Sep7144915@bill-the-cat.mit.edu>, wesommer@mit.edu (Bill Sommerfeld) writes:
|> In article <18g4c7INNihj@matt.ksu.ksu.edu> holland@matt.ksu.ksu.edu (Rich Holland) writes:
|> 
|>    Ross Ridge <ross@zooid.guild.org> writes:
|> 
|>    >While this would be what I'd do, even this isn't 100% guaranteed if
|>    >someone has broken security on the machine.  It's possible, for instance,
|>    >that the mount command, shell or even kernel has been hacked to prevent
|>    >tripwire from doing it's job properly.
|> 
|>    *shaking head*  Man, some people can get just a LITTLE too paranoid!
|> 
|>    ...
|> 
|>    ...some people need a better sense of reality! 
|> 
|> You're one of them :-) 
|> 
|> For the record, there have been a number of instances of break-ins on
|> the Internet involving hacked operating systems software..  typically
|> /bin/login and/or telnet and/or telnetd.
|> 
|> Hacking the shell isn't too much harder than hacking any other
|> user-mode program.
|> 
|> It's a *lot* harder to replace write-protected boot media in a locked
|> cabinet through the network.
|> 
|> Multics, one of the most usable of secure systems (and most secure of
|> usuable systems), was always booted from a write-protected *tape*,
|> which contained the boot loader, kernel-equivalent, shared libraries,
|> and critical commands.
|> --

And even Multics fell victim to a hacked shell at one point in its life.
I recall a case back in '69 or thereabouts when one of the system 
administrators was given a hacked shell that displayed a convincing
error message and then hung up the modem.   That administrator spent
several days looking for a system bug, before discovering the hacked
shell.

Just because you're paranoid, DOESN'T mean that they aren't out to
get you, anyway!
Xref: sparky comp.security.misc:1202 alt.security:4302 alt.sources.d:1120 comp.sources.testers:15 comp.unix.admin:4938
From: davidsen@ariel.crd.GE.COM (william E Davidsen)
Newsgroups: comp.security.misc,alt.security,alt.sources.d,comp.sources.testers,comp.unix.admin
Subject: Re: Beta testers needed for security tool
Date: 8 Sep 92 19:37:51 GMT
Reply-To: davidsen@crd.ge.com (bill davidsen)
Organization: GE Corporate R&D Center, Schenectady NY

In article <h+y1H-q$h9@atlantis.psu.edu>, barr@pop.psu.edu (David Barr) writes:

| So flip the write-protect switch on the floppy.  No program is a
| panacea.  This sounds like a wonderful tool, regardless.
| 
| Without knowing the full mechanism by which tripwire works, discussions
| like this are of limited usefulness.  If your system regularly has been
| compromised to the point that you can't trust your kernel, you
| shouldn't be trusting Tripwire alone anyway.  If we're going to be
| paranoid, make a miniroot disk, and put all the stuff on there.  I
| kinda doubt it would all fit, however.  A floppy with tripwire, related
| programs, a known good copy of the runtime C library, and the database
| should be enough.

  I have used the free brik program for some time, as a protection
against corruption rather than breakin, although it certainly is useful
there, too. I list all the files which are critical and create a master
list using the "generate list" mode. Then I check all of those files
from time to time, and after every boot.

  This may do more than that, I'm not sure.

-- 
bill davidsen, GE Corp. R&D Center; Box 8; Schenectady NY 12345
    I admit that when I was in school I wrote COBOL. But I didn't compile.
From: jmaynard@oac.hsc.uth.tmc.edu (Jay Maynard)
Newsgroups: comp.security.misc
Subject: Re: Beta testers needed for security tool
Date: 10 Sep 1992 15:34:29 GMT
Organization: UT Health Science Center Houston

In article <6662@vtserf.cc.vt.edu> valdis@vttcf.cc.vt.edu (Valdis Kletnieks) writes:
>In article <mccoy.716057636@ren.cs.iastate.edu> mccoy@cs.iastate.edu (Chris McCoy) writes:
>>After all, everyone can trust the compiler, right !?!  ;-)  
>I assume that Chris put the smiley on there because he's read
>Ken Thompson's Turing Award Lecture "On Trusting Trust".
>Those who haven't read it *should*.

The hack that Valdis is referring to is also described in the Jargon File,
available for anonymous FTP from pit-manager.mit.edu in pub/jargon. The smiley
is fully warranted, and maybe an evil grin too.
-- 
Jay Maynard, EMT-P, K5ZC, PP-ASEL | Never ascribe to malice that which can
jmaynard@oac.hsc.uth.tmc.edu      | adequately be explained by stupidity.
 "Keep in mind that Amateur Radio As We Know It Today will cease to exist
            at midnight tonight." -- Dave Newkirk, WJ1Z
Newsgroups: comp.security.misc
From: geyer@is.morgan.com (Steven Geyer)
Subject: Re: Hiding Processes from ps -ax
Organization: Morgan Stanley
Date: Sat, 12 Sep 1992 13:49:50 GMT

>flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
>>avalon@coombs.anu.edu.au (Darren Reed) writes:
>>Some people reported that "ps" showed "rn ut".
>
>I never saw those articles; on what system does it do this??!??!?  That is, if
>you zero out the rest of the name as my article said.  This would be extremely
>bizarre behaviour and I'm quite sceptical that it exists.
>
>>Here, it shows "rn (a.out)".
>>eg, I commonly have this:
>>18570 p8   I     0:01 -tcsh (tcsh)
>
>This is not the same situation.  Did my program actually show "rn (a.out)" or
>are you extrapolating?  On what OS?  There is a kludge in ps for when the
>argv[0] begins with a minus sign.  On SunOS 4.1.1 at least, it also seems to be
>triggered by having a completely empty name, as you create later.  Neither of
>these are methods I suggested because neither of them achieves the desired
>results.

How about... the minus sign means that it is a login shell.

>>However, if you can get the pid of a process then you can also
>>get the inode number of it too
>
>Processes don't have inode numbers.  Files have inode numbers.

One can still dump an core image of the process and rummage through to
find out who and what was happening.  Still not safe for a hacker.

Well Jay, it looks like we are out of luck (or not! ... depending on
which side of the line you reside ;-)

-- 
Steven A. Geyer <geyer@is.morgan.com> // if (get_standard_disclaimer())
UNIX IS Dept.                        //           USE_IT(); else
Morgan Stanley & Co., Inc.          // it_is_only_my_unforced_opinion();
Organization: Freshman, MCS general, Carnegie Mellon, Pittsburgh, PA
Newsgroups: comp.security.misc,alt.security
Date: Fri,  4 Sep 1992 17:08:09 -0400 
From: Nicholas Marshall Kramer <nk24+@andrew.cmu.edu>
Subject: Re: Software Copyright protection devices
	<1992Sep4.004055.27836@iti.gov.sg>

 You said it yourself. Software piracy is a problem when users pirate
software INSTEAD of buying it. But how often is this really the case?
Remember, we're talking lost sales here. You can go on and on all you
want about the morality of it, but a software company does not lose ONE
CENT when someone pirates something they wouldn't have otherwise bought.
(That's why companies aren't terribly reluctant to give out demo
copies... Because the users wouldn't have actually bought it if they had
to pay for it.)

 Given that, the question is, "How many sales will be lost due to
piracy?" This depends a lot on the product, of course (games are
infinitely more vulnerable to piracy than anything else). But for most
business products, the lost sales are negligible. Companies can get in
some real deep crap if caught with pirated software, and very few
companies are willing to risk that.

 As a classic example, Banyan Vines comes with a dongle. Brilliant.
Yeah, like a company with the bucks to set up a local area network with
a dedicated server really cares about those three thousand dollars for a
legit copy of Vines.

							Nick
Newsgroups: comp.security.misc
From: rackow@altair.mcs.anl.gov (Gene Rackow)
Subject: Re: hushlogin
Keywords: motd,hushlogin,login,find
Organization: Argonne National Laboratory, Chicago, Illinois
Date: Tue, 8 Sep 1992 02:31:59 GMT

The problem with both methods listed below is what happens in an NFS
environment where you may be logging into any one of 10 or 20 or 1000 different
machines with different and possibly meaningful motd files on them.
Adding a ".`hostname`" to the stored file name in the scripts would sure help.

find /etc/motd -newer ~/.hushlogin.`hostname` -exec more {} \; -a -exec touch\
   ~/.hushlogin.`hostname` \;

In article <Bu6xn0.B76@usenet.ucs.indiana.edu> teg@usenet.ucs.indiana.edu (Tim Gurbick) writes:
>In article <36961@uflorida.cis.ufl.edu> spp@crane.cis.ufl.edu (Stephen Potter)
>> writes:
>> ...
>># Show motd only if it has changed
>>cmp -s ~/.hushlogin /etc/motd
>>if ($status != 0) then
>>  tee ~/.hushlogin < /etc/motd | more
>>endif
>
>Which could also be somewhat streamlined into:
>
>find /etc/motd -newer ~/.hushlogin -exec cat {} \; -a -exec touch  \
> ~/.hushlogin \;
>
>(note the trailing semi is really on the same line, and is required for
>proper command termination)
>
>=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>Tim Gurbick a.k.a. teg@peabody.iusb.indiana.edu Dept of Math & CS: 237-GEEK
> Help: 911  d.b.a. teg@natasha.iusb.indiana.edu  `whois \!TEG12` Traci:0x45
>#include <fnord.h> tgurbick@indiana.edu Chi mi frena in tal momento? emacs!
>Me: International Unix Standards Bored, educational division: (219)237-IHEX
>address: CS Dept IUSB POB 7111 1700 Mishawaka Avenue, South Bend, IN  46634
>"Work FOR?  I don't work FOR anybody...  I'm just having fun." - The Doctor


Xref: sparky comp.security.misc:1163 alt.security:4257 alt.sources.d:1104 comp.sources.testers:1 comp.unix.admin:4893
From: ckd@eff.org (Christopher Davis)
Subject: Re: Beta testers needed for security tool
Organization: Electronic Frontier Foundation Tech Central
	<Bu6r2q.AG5@mentor.cc.purdue.edu>
Date: Mon, 7 Sep 1992 02:22:04 GMT

Gene> == Gene Kim <genek@mentor.cc.purdue.edu> 

 Gene>     You are right in pointing out that Tripwire is only as
 Gene> reliable and secure as the database and Tripwire executable
 Gene> files.  Therefore, putting these files on the local system where
 Gene> they can be tampered with would be a bad idea.

<unlock SysAdm Cabinet>
<remove "special" floppy>
<insert "special" floppy>
mount -r /dev/fd0c /floppy
/floppy/tripwire

This is one possible way to do it on floppy-equipped systems (say, an
SS2 or IPX or whatever).  Maybe this should go in the docs?
--
Christopher Davis   | ]CALL -151       
<ckd@eff.org>       | *300: 20 DD FB 60
System Administrator| *3D0G            
EFF +1 617 864 0665 | ]CALL 768        
Newsgroups: comp.security.misc,alt.security,alt.sources.d,comp.sources.testers,comp.unix.admin
From: ckd@eff.org (Christopher Davis)
Subject: Re: Beta testers needed for security tool
Organization: Electronic Frontier Foundation Tech Central
	<CKD.92Sep6222202@loiosh.eff.org>
	<1992Sep7.102653.18888@zooid.guild.org> <18g4c7INNihj@matt.ksu.ksu.edu>
	<WESOMMER.92Sep7144915@bill-the-cat.mit.edu>
Date: Mon, 7 Sep 1992 19:49:08 GMT

Bill> == Bill Sommerfeld <wesommer@mit.edu> 

 Bill> It's a *lot* harder to replace write-protected boot media in a
 Bill> locked cabinet through the network.

Especially if the boot media is a CD-ROM.  Then you don't even have the
"they hacked the kernel then re-wrote the boot tape I left in the drive"
problem :-)

This is one nice side-effect of Sun's move to CD-ROM for software
distribution, IMHO.  Not the main one (portability and durability are
somewhat higher up), but it's on the list.

(Hm, maybe we can get Sun to put tripwire on the CD-ROM...)
--
Christopher Davis   | ]CALL -151       
<ckd@eff.org>       | *300: 20 DD FB 60
System Administrator| *3D0G            
EFF +1 617 864 0665 | ]CALL 768
From: spp@crane.cis.ufl.edu (Stephen Potter)
Newsgroups: comp.security.misc
Subject: Re: hushlogin
Date: 6 Sep 92 21:23:01 GMT
Reply-To: spp@crane.cis.ufl.edu (Stephen Potter)
Organization: U of Florida. Computer Science Dept.

In article <1992Aug27.214859.8408@das.harvard.edu>, adam@calliope.uucp (Adam Shostack) writes:
|> In article <1992Aug27.200330.24859@news.duc.auburn.edu> hendefd@woof.duc.auburn.edu writes:
|> >What is a .hushlogin file and why does my system have an empty 
|> >one in /usr/spool/uucppublic?
|> 

Here's an interesting little hack that one of our consultants here at UF came up with.  This is nice for those of us that have to use public workstations, and have to log on and off a lot, or for windowing environments.

# Show motd only if it has changed
cmp -s ~/.hushlogin /etc/motd
if ($status != 0) then
  tee ~/.hushlogin < /etc/motd | more
endif

Steve

-- 
"There are worlds out there where the sky is burning.  The sea's asleep, and
the rivers dream.  People made of smoke and cities made of sound.  Somewhere
there's danger.  Somewhere there's injustice.  Somewhere else the tea's getting 
cold. 	Come on Ace, we've got work to do." -Dr Who, spp@reef.cis.ufl.edu
Xref: sparky comp.security.misc:1187 alt.security:4281 alt.sources.d:1113 comp.sources.testers:10 comp.unix.admin:4921
From: wesommer@mit.edu (Bill Sommerfeld)
Newsgroups: comp.security.misc,alt.security,alt.sources.d,comp.sources.testers,comp.unix.admin
Subject: Re: Beta testers needed for security tool
Date: 7 Sep 92 18:49:26 GMT
	<CKD.92Sep6222202@loiosh.eff.org>
	<1992Sep7.102653.18888@zooid.guild.org> <18g4c7INNihj@matt.ksu.ksu.edu>
Organization: Massachusetts Institute of Technology

In article <18g4c7INNihj@matt.ksu.ksu.edu> holland@matt.ksu.ksu.edu (Rich Holland) writes:

   Ross Ridge <ross@zooid.guild.org> writes:

   >While this would be what I'd do, even this isn't 100% guaranteed if
   >someone has broken security on the machine.  It's possible, for instance,
   >that the mount command, shell or even kernel has been hacked to prevent
   >tripwire from doing it's job properly.

   *shaking head*  Man, some people can get just a LITTLE too paranoid!

   ...

   ...some people need a better sense of reality! 

You're one of them :-) 

For the record, there have been a number of instances of break-ins on
the Internet involving hacked operating systems software..  typically
/bin/login and/or telnet and/or telnetd.

Hacking the shell isn't too much harder than hacking any other
user-mode program.

It's a *lot* harder to replace write-protected boot media in a locked
cabinet through the network.

Multics, one of the most usable of secure systems (and most secure of
usuable systems), was always booted from a write-protected *tape*,
which contained the boot loader, kernel-equivalent, shared libraries,
and critical commands.
--
Organization: Middle East Technical University - Computer Center
Date: Tuesday, 15 Sep 1992 16:07:58 TUR
From: <C51885@TRMETU.BITNET>
Newsgroups: comp.security.misc
Subject: How can I get MD-4 & MD5 & DES source codes

I want to get the source code of the MD4, Md5 & DES Algorithms.(As a C Code)
What are the FTP addresses. Please send me.
                                Thanks, Ismail..
Xref: sparky comp.security.misc:1224 alt.security:4328 alt.sources.d:1127 comp.sources.testers:23 comp.unix.admin:4978