LINUX NEWS
Resources & Links From CramSession.com
Thursday, November 29, 2001TABLE OF CONTENTS
1) Sean’s Notes
2) Linux News
Bill Gates Gives Open Source A Boost
Red Hat to Provide Support to IBM
Another Linux Success Story
WU-FTP Remote Root Vulnerability3) Linux Resources
Linux Tips
Destination NAT-ting
Build A Better Web Server
Query Tools
Sharpen Up Those Regex Skills4) App o’ the Week
~~~~~~~~~~~~~~~~~~~~~~ ADVERTISEMENT ~~~~~~~~~~~~~~~~~~~~~~~
Try Our IT Certification Courses FREE! SmartCertify Direct gives you classroom-quality IT training at a fraction of the cost of traditional courses. Youll get 24-hour online mentoring from certified advisors, hands-on interactive exercises, the popular Test Prep exams and more! Choose from MCSE, Cisco, A+, CIW, Linux and many other courses. Click below to try them all FREE and register to WIN a state of the art Dell PC!
http://ad.brainbuzz.com/?RC06&AID96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
For information on how to advertise in this newsletter please contact mailto:adsales@CramSession.com or visit http://cramsession.com/marketing/default.asp
1) Sean’s Notes
A UNIX system is bound to have many processes running at the same time, many of which will be running as something called a daemon. The purpose of a daemon is to run detached from a terminal and do…something. I’ve talked about daemons in the past, such as syslog, which is used for centralized logging, and cron, which executes tasks at predetermined times. Other examples of daemons are services like telnet and ftp. However, if you check through your process listing, the chance of you having a telnet daemon actually running is remote. In fact, unless someone is telnetted into your machine at the moment, you won’t see any telnet daemons.
Telnet is one of the many services handled through the inetd daemon, otherwise known as the “Internet Super Server”. Inetd is a daemon that waits for connections on behalf of many programs, passing off control once the connection has been established. Rather than having the telnet daemon running in the background waiting for a connection, plus an FTP daemon, and a dozen other ones, it’s a lot easier to have one process listen on all the appropriate ports and then run the appropriate daemon when necessary.
Another advantage of centralizing all of this is that you can also centralize the logging and security. It’s much easier to say “only these hosts can connect to my system” for one program than it is to do the same for every single daemon you want to run.
Most of you running a current distribution will see “xinetd” rather than inetd. “xinetd” is a newer daemon that expands on what inetd can do. You can choose to rate limit the amount of connections that can be started (to prevent DOS attacks), not to mention have more control over how the child processes themselves get configured. Another feature I thought was pretty slick is that you can get xinetd to accept a connection on a certain port, and then forward it to another machine. Don’t get me started on how insecure this could be, but properly implemented I see some good applications for it.
A full description of xinetd can be found at its home page:
http://www.xinetd.org/
I’m going to postpone an article about xinetd configuration for later. This week, I thought I’d explain a bit about how applications that run out of something like xinetd are different from those that listen on the port themselves (such as apache). Then, I’ll show you how you can exploit these differences to make some of your shell scripts and interactive programs network-enabled with virtually no effort!
In network programming, a program has to bind to a socket and then let the operating system know that it wants to listen on that socket. When a connection comes in, the operating system lets the application know, and the application accepts the socket. In C, it looks something like this (note: this is fairly incomplete; socket programming involves a lot of complicated structures).
int socketfd, childfd; socketfd = socket( … ); bind(socketfd, … ); listen(socketfd, … ); childfd = accept(socketfd, … );
A socket is created with the socket() system call. This creates a file descriptor (a handle) for the created socket. This file descriptor is then bound to a port with the bind() system call. If we were writing a web server, we’d bind() to port 80. If this socket was to be outbound (ie connecting to a web server), we’d bind to socket 0, meaning that the operating system picks an appropriate port. Then, we tell the operating system that we intend this socket to wait for connections with listen().
The last thing we do is to accept() the connection. Assuming there is none, we get blocked (put on hold) until one comes in. Upon return from accept(), we’re given a file descriptor for the newly created connection. We can read and write to it just like we were reading and writing to the terminal.
As you can see, network programming is a headache, and should be avoided if possible. Besides the code above, there is a lot of other considerations, such as making sure that when you wrote 1,000 bytes, that 1,000 bytes were actually sent.
The Internet Super Server makes life easier. It hinges on the design of Unix – A file descriptor looks the same to an application, be it writing to a file, a socket, or the screen. Remember, “everything is a file” in Unix.
When a program is run, it has three file descriptors already opened, 0, 1, and 2. These correspond to the standard input (stdin), the standard output (stdout), and the standard error (stderr) respectively. In a nutshell, the descriptors required to write to the terminal. inetd takes advantage of this by mapping the daemon’s stdin and stdout to the socket that was built with the remote host. Put even simpler– write to the terminal, it goes to the network. Read from the terminal, it reads from the network. An example will illustrate.
Create a file - /usr/sbin/test.pl (you’ll need to be root to do most of this)
!/usr/bin/perl
$|=1; # Flush output print “What is your name?\n”; $in = <STDIN>; print “Hello, $in\n”;
Make sure it is executable:
chmod +x /usr/sbin/test.pl
Try it out from the command line:
/usr/sbin/test.pl
What is your name? Sean Hello, Sean
We’re going to add a new service to xinetd. Each file in /etc/xinetd.d corresponds to a service, so create /etc/xinetd.d/test:
service test { socket_type = stream wait = no user = root server = /usr/sbin/test.pl disable = no }
Here a service called “test” is created on a stream (TCP) port, and is associated with our script. The last thing to do is tell the operating system what port test is on: I used 34343. /etc/services contains the mappings of port names to numbers. I simply added a line as such:
test 34343/tcp #test
And then restarted xinetd to enable the test service:
/etc/rc.d/xinetd restart
Now, we can telnet to our new service:
telnet localhost test
Trying 127.0.0.1… Connected to localhost. Escape character is ‘^]’. What is your name? Sean Hello, Sean
Connection closed by foreign host. #
By using xinetd, we’ve turned a regular terminal-based application into a network application without any extra code. test.pl could have just as easily been a script that gets information from the user, and modifies entries in the DNS table. The user never has to login to the system or touch a configuration file, and you can use the same script you normally would have. Standard disclaimers apply about security–limit access to only the addresses you trust to connect, and run the application with the least privileges necessary!
Not only does inetd/xinetd reduce the resources needed to have many daemons running at the same time, but it facilitates the creation of the daemons by eliminating the need to worry about network programming.
Before signing off, I’d like to welcome new readers that found this list through the Lockergnome Penguin Shell newsletter. Tony was kind enough to link to an older newsletter which brought in a lot of viewers. He’s currently doing a review of the major Linux distributions – if you’re still up in the air about which one to use, you can count on sound advice from him:
http://www.lockergnome.com/issues/penguinshell.html
Long live the Penguin,
Sean swalberg@cramsession.com
Visit the Linux News Board at http://boards.cramsession.com/boards/vbt.asp?b2
2) Linux News
Bill Gates Gives Open Source A Boost
According to this article, the release of XP is a good thing for Open Source, since the restrictiveness may send people toward Free and Open alternatives. I don’t think it’s quite as drastic as they make it out to be, but I wouldn’t be surprised to see some action on this front.
http://www.business2.com/articles/web/print/0,1650,35655,FF.html
Red Hat to Provide Support to IBM
IBM has been pushing Linux on their servers and mainframes for a while now. In a bid that will surely see improved support for IBM hardware, Red Hat has announced that it will be partnering with IBM to provide a customized version of Red Hat Linux, along with the associated support.
http://www.redhat.com/about/presscenter/2001/press_ibmzip.html
Another Linux Success Story
This time, it’s google.com, the preferred search engine of many (myself included). Owing partly to using Linux (can you imagine what 6,000 NT licences would cost!?), google.com has become the dominant search technology.
http://www.newsalert.com/bin/story?StoryId=CparVuaicreeTr09pr0Xf
WU-FTP Remote Root Vulnerability
This one really hurts: a remote root exploit in WU-FTPd. A package plagued by holes, I don’t understand why Red Hat even distributes it. Nevertheless, upgrade if you need to, and be extra careful in the future if you’re offering FTP services.
http://www.securityfocus.com/archive/1/242590
3) Linux Resources
Linux Tips
This site is chock full of handy information, and is constantly updated. It seems to be focused on providing the answers to everyday things, like finding what user has a file open, to customization tweaks.
http://www.linux-tips.net/
Destination NATting
- 2 kernels used the ipmasqadm command to forward an external port to an inside address, and all was well. Enter 2.4 kernels, with the new and improved iptables, and this technique doesn’t work any more. It’s now called “Destination NAT”, and some helpful hints on its use can be found in this thread.
http://www.linuxquestions.org/questions/showthread.php?threadid53
Build A Better Web Server
I really like reading about the way people choose the hardware for web site upgrades, mostly because they tend to get into the various tradeoffs. This one covers Aces Hardware upgrade from a Sparc 20 to a spiffy new Sun Blade.
http://www.aceshardware.com/read.jsp?idE000240
Query Tools
One of the things I find myself doing quite regularly is trying to find out where a certain IP address or name comes from, such as when some obnoxious person is probing my network. Geektools.com has all the tools I need in one place, and with a good interface.
http://www.geektools.com/
Sharpen Up Those Regex Skills
To overcome a problem with Perl CGI scripts in IIS, someone put together a one line statement that added the program’s directory to the module search path. The fix itself isn’t so much the focus of this article, as is the explanation of how it works, and what Perl features it takes advantage of.
http://www.rcbowen.com/imho/perl_cwd_iis.html
4) App o’ the week
The Cisco-centric Open Source Initiative is here to provide free tools to help you manage your Cisco network. Some of the utilities in it are quite innovative! The fellow running the project works for Cisco, so even though it’s not officially endorsed, it should have better access to documentation and the way things work.
http://cosi-nms.sourceforge.net/
(C) 2001 BrainBuzz.com, Inc. All Rights Reserved.
This message is from CramSession.com.You are currently subscribed to the Hottest Linux News and Resources as: sean@ertw.com
To un-subscribe from this newsletter by e-mail: send a blank email message to: mailto:leave-linuxnews-3825955Y@list.cramsession.com
To Subscribe to this newsletter by e-mail: send a blank email message to: