LINUX NEWS
Resources & Links From Cramsession.com
Thursday, June 20, 2002TABLE OF CONTENTS
1) Sean’s Notes
2) Linux News
Mandrake on WalMart PCs
Slackware 8.1 Released
Apache Security Advisory
Linux And Healthcare3) Linux Resources
Templates Compared
Database Performance Tuning
Spam Prevention With Postfix
Handy Use of Diff
It's the Latency, Stupid4) App o’ the Week
~~~~~~~~~~~~~~~~~~~~~~~~ ADVERTISEMENT ~~~~~~~~~~~~~~~~~~~~~~~~~~
Try Our IT Certification Courses FREE! SmartCertify Direct gives you classroom-quality IT training at a fraction of the cost of traditional courses. You’ll get 24-hour online mentoring from certified advisors, hands-on interactive exercises, the popular Test Prep exams and more! Choose from MCSE, Cisco, A+, CIW, Linux, and many other courses. Click below to try them all FREE and register to WIN a state of the art Dell PC!
http://ad.brainbuzz.com/?RC06&AIS89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
For information on how to advertise in this newsletter please contact mailto:adsales@CramSession.com or visit http://cramsession.com/marketing/default.asp
1) Sean’s Notes
It’s a situation you’re going to run into at least once in your life – you’ve got a Linux box, and you don’t know what the root password is. Short of trying to crack into your own machine (but you’re up on your patches, aren’t you?), you won’t be able to get that password back.
Fortunately, you can get back in by booting to single user mode. In single user mode, you’re logged in as root automatically, and you can change root’s password. (Note, you can’t recover the old password since it was hashed. All you can do is change it).
Booting to single user mode is pretty easy, all you do is pass “single” to the kernel. In LILO, this is usually as easy as typing “linux single” at the LILO prompt. With the newer GRUB, you have to hit ‘e’ to edit the boot entries, and add in “single” by hand before booting. It’s all documented here:
http://www.redhat.com/docs/manuals/linux/RHL-7.3-Manual/custom-guid e/s1-rescuemode-booting-single.html
The only security in this, though, is that you have to be at the console to do it. Get the procedure down pat, and it only takes about a minute. One minute for someone to walk into your server room and have root level access to your computer, either by changing the password or adding a new root level user. Something has to be done about it.
The solution is to lock down the options you can pass to your kernel. Doing so means that if anyone wants to change the way the kernel is booted, then they’ll need a password.
LILO is pretty easy to do. In /etc/lilo.conf, simply add:
password=secret restricted
to the top and then run /sbin/lilo to rebuild the boot sector.
That will make “secret” the password to boot into Linux. Adding “restricted” only makes the password apply if options were passed to the kernel. If the box were rebooted for some reason, then “restricted” will let it boot without a password. However, if someone tries to type “linux single”, then they’ll need to provide that password.
One thing to note about LILO is that the password is stored in clear text. chmod 700 /etc/lilo.conf to prevent anyone from snooping that password!
GRUB is just as easy. It uses MD5 password hashes, meaning that the password is never stored in the file, just a one-way representation of it. If someone snarfs grub.conf, then the password hash won’t help them.
First, run /sbin/grub to enter the grub shell. At the grub> prompt, enter the command “md5crypt”, and then give it your password as follows (I used “secret” if you’re following along)
grub> md5crypt
Password: ****** Encrypted: $1$xDuOL/$DM8lVGaSRqltmiUxQJhc..
In /etc/grub.conf, add the following line:
password –md5 $1$xDuOL/$DM8lVGaSRqltmiUxQJhc..
Save the file, and you’re done (that’s one thing I like about GRUB–you don’t have to rebuild the boot sector every time.)
Reboot, and you’ll notice that the “press e to edit the command line” is replaced with something like “press p to enter a password and access advanced options”. Without that password, you can’t pass options to the kernel.
GRUB has a lot more security features, you can read about them here:
http://www.gnu.org/manual/grub-0.90/html_chapter/grub_toc.html
Protecting your boot manager is only half the story. Someone with a few more minutes on their hands could use a boot disk (either floppy or CD) with their own boot loader or kernel. For PCs, the best thing to do is protect against this at the BIOS level. Make the hard drive the first bootable device, and protect the BIOS settings with a password.
Of course, proper physical security of your servers is a necessity. The measures I described above will make a lot of hassle for someone sitting at your console to get in, but the best way to do it is to prevent them from getting there in the first place.
Finally, write down the boot manager and BIOS passwords, and keep them in a safe place. If you lose those, it isn’t going to be any fun getting back into your system. A sealed envelope in a locked area is a good choice.
We spend so much time worrying about network based attackers that we forget about the damage that people can do with their hands. Protecting your system from a console-based attacker is relatively painless, and goes a long way toward better security.
Long live the Penguin,
Sean mailto:swalberg@cramsession.com
2) Linux News
Mandrake on WalMart PCs
As you’ve probably heard from other sources, WalMart is selling PCs without an OS in their stores. Mandrake will soon become an option for these. Lindows, which promises Microsoft Windows integration on a Linux platform, was also recently announced as an option.
http://newsforge.com/article.pl?sid/06/19/1519219
Slackware 8.1 Released
Slackware is the oldest distribution of Linux, known for its bare bones approach to the installation process. The latest release, 8.1, features JFS and XFS filesystems, the latest GUIs, and a revamped package manager. Also of note is ZipSlack, a 38MB .ZIP file that promises to let any FAT partition be up and running with Linux in 5 minutes (no GUI, but all the networking is there). It also fits on a ZIPdisk, to make your Linux box portable.
http://www.slackware.org/
Apache Security Advisory
Incorrect parsing of some invalid requests leads to some problems. On most platforms it leads to the child process dying, but on 64-bit UNIX platforms, it could possibly be exploited to execute arbitrary code. Pick up 1.3.26 or 2.0.39 depending on which stream you’re following.
http://httpd.apache.org/info/security_bulletin_20020617.txt
Linux And Healthcare
The modularity of Linux makes it a natural fit for embedded applications. This time, a medical device was developed using Linux called EasyDose. It is “a unit that monitors, displays and manages X-ray exposure data automatically through hospital networks.” It also supports standards like DICOM, which is handy to have when linking different hospital systems together.
http://zdnet.com.com/2100-1104-935737.html
3) Linux Resources
Templates Compared
Templates let you build web pages more efficiently, either by embedding some logic on the server side, or reusing code. Not surprisingly, there is a lot of template software out there. This document compares some of the better ones with an eye to how they are built, and the relative performance you can expect.
http://perl.apache.org/features/tmpl-cmp.html
Database Performance Tuning
Here is another article from SUN, this time it is on database tuning. Again, it’s for Solaris, but many of the things in the article still apply.
http://www.sun.com/solutions/blueprints/0602/816-7191-10.pdf
Spam Prevention With Postfix
This article is the first in a three-part series on spam prevention using Postfix. Postfix is a sendmail alternative that is gaining popularity because of its focus on security and simplicity. This installment looks at using some of the static maps to filter out undesirable sites. Future articles will deal with procmail to perform context based filtering.
http://online.securityfocus.com/infocus/1593
Handy Use of Diff
diff is a utility I’ve written about before that reports the differences between versions of files. This article shows a pretty interesting way of using it to make changes to multiple files, which looks a bit easier than using patch.
http://linux.oreillynet.com/pub/a/linux/lpt/33_06.html
It’s the Latency, Stupid
The difference between “bandwidth” and “latency” is rarely well understood. This piece tries to point out the ill effects of latency on a network connection. It’s a bit dated (it’s rather funny to see his predictions on cable modems), but the concepts are sound.
http://www.stuartcheshire.org/rants/Latency.html
4) App o’ the Week
I’m always on the lookout for cool groupware applications, especially those that take advantage of the web. This one is a group calendaring system. Its big draw is that it only requires Perl, which means you’ll be up and running in no time at all.
http://www.math.utexas.edu/webcalendar/
(C) 2002 BrainBuzz.com, Inc. All Rights Reserved.
This message is from CramSessionYou are currently subscribed to the following list Hottest Linux News and Resources as: sean@ertw.com
To un-subscribe from this newsletter by e-mail, send a blank email message to: mailto:leave-linuxnews-3825955Y@list.cramsession.com
To subscribe to this newsletter and many others visit our site at: http://newsletters.cramsession.com/signup/default.asp