|
|
 |
Version 0.1, last update 2003/12/9
Introduction
This section wants to provide a practical example on system hardening.
As the base operating system I am using gentoo Linux. But it should be easy to port
this example, although with little changes, to other Linux distributions.
Here I want to show how to run the ssh server openssh
as a nonprivileged user. This should result in greater security, because if someone
was able to use the running service to break into the system, then he can only act with the rights of the running process.
Normally, ssh runs with root privileges. This configuration example is only useful, if ssh is used for system administration,
because it will accept only one user.
Configuring openssh
First we have to make a suitable configuration for our non-privileged ssh server. We can
find the main configuration in /etc/ssh/sshd_config. Here we bind the server to the address 192.168.1.2 and let
the server listen on the non-provoleged port 61524. You are free to use any port above 1024. We allow access only for the user nikolei
and enable rsa-authentication. See table 1 for details.
| Table 1: /etc/ssh/sshd_config |
Port 61524
Protocol 2
ListenAddress 192.168.1.2
AllowUsers nikolei
PermitRootLogin no
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile /etc/ssh/authorized_keys2
Subsystem sftp /usr/lib/misc/sftp-server
|
The user nikolei has the home directory /home/nikolei and the shell /bin/su. So, after logging into the system
using a cryptographic key, the user nikolei has to give the root password. Under gentoo linux, we have to put the user nikolei into
the group wheel. Otherwise he would not be able to use /bin/su.
After that we have to change the ownership of all the configuration files to the user nikolei. This can be done by executing
chown -R nikolei /etc/ssh
The Runscript
In oder to start the openssh server at system startup, we have to make some changes to the runscript /etc/init.d/sshd.
Table 2 show the whole runskript for running openssh non-privileged.
| Table 2: /etc/init.d/sshd |
#!/sbin/runscript
depend() {
use logger dns
need net
}
checkconfig() {
if [ ! -e /etc/ssh/sshd_config ] ; then
eerror "You need an /etc/ssh/sshd_config file to run sshd"
eerror "There is a sample file in /usr/share/doc/openssh"
return 1
fi
gen_keys
}
gen_keys() {
if [ ! -e /etc/ssh/ssh_host_key ] ; then
einfo "Generating Hostkey..."
/usr/bin/ssh-keygen -t rsa1 -b 1024 -f /etc/ssh/ssh_host_key -N ''
fi
if [ ! -e /etc/ssh/ssh_host_dsa_key ] ; then
einfo "Generating DSA-Hostkey..."
/usr/bin/ssh-keygen -d -f /etc/ssh/ssh_host_dsa_key -N ''
fi
if [ ! -e /etc/ssh/ssh_host_rsa_key ] ; then
einfo "Generating RSA-Hostkey..."
/usr/bin/ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ''
fi
}
start() {
checkconfig || return 1
ebegin "Starting sshd"
# if [ -f /var/run/sshd.pid ]; then
# echo "PIDFile var/run/sshd.pid already exists!!!"
# echo "Cannot start sshd!!!"
# fi
start-stop-daemon --start --quiet --pidfile /var/run/sshd.pid \
--startas /usr/sbin/sshd --chuid nikolei
eend $?
}
stop() {
ebegin "Stopping sshd"
start-stop-daemon --stop --quiet --pidfile /var/run/sshd.pid
eend $?
}
|
There is one problem with this configuration. The openssh daemon wants to create the pid-dile
/var/run/sshd.pid. But only root is allowed to do so, not the user nikolei the server is running as.
The are three ways to handle this problem:
- You can go into the source and change the directory, the openssh server wants to create his pid-file,
- You can change groupmemberships or similar things, so that the user nikolei is able to create a file in /var/run/,
with all consequences,
- or you just run the runscript above (not very clean, but it works, as long as you do not restart the service).
Last but not least we have to assign the runscript to a runlevel, i.e.:
rc-update add sshd default
and execute it:
/etc/init.d/sshd start
Finished. On other systems, some steps might be different.
back to top
|
|
| Whats New |
| [2005-02-18] mp3riot version 1.3 released | | [2004-10-08] mp3riot version 1.2 is out. | | [2004-04-30] Added section Bridging | | [2004-01-09] working progress on mp3riot version 1.2 |
|
| The LWN.net Weekly Edition for September 9, 2010 is available.
|
| [$] LWN.net Weekly Edition for September 9, 2010 |
|
| The Mozilla project has released firefox 3.6.9
and 3.5.12and SeaMonkey 2.0.7. These
updates fix a relatively long list
of scary security problems; the firefox 3.6.9 update also add support
for X-Frame-Options,
which can be used by web sites to prevent their content from being trapped
inside another site's frames.
|
| Firefox and SeaMonkey updates released |
|
| Debianhas updated typo3-src(fix
regression from previous update),
freetype(multiple vulnerabilities), and
xulrunner(multiple vulnerabilities).
Gentoohas updated sarg(buffer
overflows - vulnerability from 2008),
acroread(multiple vulnerabilities),
and clamav(multiple vulnerabilities).
openSUSEhas updated kernel(multiple vulnerabilities) and sudo(local privilege escalation).
Red Hathas updated seamonkey(RHEL3-4: multiple vulnerabilities),
firefox(RHEL4-5: multiple
vulnerabilities), and
thunderbird(RHEL4-5: multiple
vulnerabilities).
SUSEhas updated kernel(multiple
vulnerabilities).
Ubuntuhas updated lftp(remote file
creation).
|
| Wednesday's security updates |
|
| The second
alpha version of the revised Mozilla Public Licensehas been posted;
the text has been annotated to make it relatively easy to see what has been
changed. "The most significant change in this draft is the patent
language. We have made it easier to read but also, we hope, better at
protecting communities who choose to use the MPL. It should also have the
side effect of making the license Apache-compatible, allowing projects
licensed under the next MPL release to include Apache-licensed code in
their code bases." |
| Mozilla Public License Alpha 2 |
|
| The Mozilla Labs Gaming project has announced
its existence. "Modern Open Web technologies introduced a
complete stack of technologies such as Open Video, audio, WebGL, touch
events, device orientation, geo location, and fast JavaScript engines which
make it possible to build complex (and not so complex) games on the Web.
With these technologies being delivered through modern browsers today, the
time is ripe for pushing the platform. And what better way than through
games?"The project is starting with a competitionto see who can
build the best web-based game.
|
| Mozilla Labs Gaming launches |
|
| Microsoft's CodePlex foundationCodePlex.com has announcedthe donation of $25,000 to support the development of the Mercurial source
code management system. "While Team Foundation Server is still the
most used version control system on CodePlex, our users are clearly
benefiting from having access to Mercurial for their open source
projects. The CodePlex team is happy to be able to offer our community of
more than 17,000 projects a choice. With Mercurial as an important feature
of CodePlex, we are excited to be making this donation to help support the
Mercurial project." |
| CodePlex.com donates $25,000 to Mercurial project |
|
| Mozilla has released Thunderbird 3.1.3 and Thunderbird 3.0.7 with security
and stability updates. See the release notes for details (3.1.3and 3.0.7).
|
| Thunderbird 3.1.3 and 3.0.7 security updates now available |
|
| Watching Ubuntu and Fedora development is something like watching episodes
of Iron Chef: Given roughly the same ingredients and the same
amount of time, the two projects produce vastly different dishes. The
Fedora 14 and Ubuntu 10.10 release cycle is particularly pronounced in this
regard, with Ubuntu's focus largely on refining improvements from 10.04 and
Fedora introducing major changes to the infrastructure. Subscribers can
click below for the full story from this week's Distributions page.
|
| [$] Looking at Fedora 14 and Ubuntu 10.10 |
|
| Debianhas updated quagga(denial of
service).
Gentoohas updated maildrop(privilege escalation) and sudo(privilege
escalation).
openSUSEhas updated xorg-x11-server(privilege escalation).
Red Hathas updated sudo(privilege
escalation), kernel(RHEL 4, RHEL 4.7: privilege escalation),
and rpm(RHEL 4, RHEL 5: privilege escalation).
Ubuntuhas updated sudo(privilege
escalation).
|
| Security advisories for Tuesday |
|
| Your editor had the good fortune to be able to attend the first LinuxCon
Brazil event, held in São Paulo. There were a number of interesting
talks to be seen, presented by speakers from Brazil and far beyond. This
article will cover three in particular (by Jane Silber, Vinod Kutty, and
Jon 'Maddog' Hall) which were interesting as a result
of the very different views they gave on how Linux users work with their
systems.
|
| [$] LC Brazil: Consumers, experts, or admins? |
|
| The 1.10.0 release of the Cairo graphics library has finally been released.
"One of the more interesting departures for cairo for this release is
the inclusion of a tracing utility, cairo-trace. cairo-trace generates a
human-readable, replayable, compact representation of the sequences of
drawing commands made by an application. This can be used to inspecting
applications to understand issues and as a means for profiling real-world
usage of cairo."The profiling feature has evidently been used to
improve performance in a number of areas. There is also improved printing
support, better 16-bit buffer support, and better use of hardware
acceleration.
|
| Cairo 1.10.0 available |
|
| Martin Graesslin looksat problems with the interaction between KWin and some graphics drivers.
"Now that I have explained all our checks we did to ensure a smooth
user experience, I want to explain how it could happen that there are
regressions in 4.5. In 4.5 we introduced two new features which require
OpenGL Shaders: the blur effect and the lanczos filter. Both are not hard
requirements. Blur effect can easily be turned off by disabling the effect
and the lanczos filter is controlled by the general effect level settings
which is also used for Plasma and Oxygen animations. Both new features
check for the required extensions and get only activated iff the driver
claims support for it. So everything should be fine, shouldn't it?
Apparently not when it comes to the free graphics drivers (please note and
remember: we do not see such problems with the proprietary NVIDIA
driver!)."(Thanks to Jos Poortvliet)
|
| Graesslin: Driver dilemma in KDE workspaces 4.5 |
|
| Debianhas updated smbind(sql
injection).
Fedorahas updated pam_mount(F13, F12:
arbitrary code execution), libhx(F13, F12:
arbitrary code execution), F13: python(multiple vulnerabilities), and F12:
sblim-sfcb(arbitrary code execution).
Mandrivahas updated lvm2(privilege
escalation).
Pardushas updated phpmyadmin(cross-site scripting) and mysql(multiple
vulnerabilities).
|
| Monday's security updates |
|
| Fedora will be holding
a Systemd test dayon September 7, 2010. "This
week's Test Day, which will take place on Tuesday 2010/09/07 rather than the more usual Thursday, is on systemd, so it's a very important one! It will also serve at least two functions: as usual, the testing will help us to improve the code so that if it does go into the final Fedora 14 release it will work as well as possible, but the Fedora steering committee will also be using the results of the Test Day to help inform their final decision as to whether to go ahead with systemd for the Beta and final release, or whether to revert to upstart. So there's a lot riding on this Test Day." |
| Systemd Test Day on Tuesday 2010/09/07 |
|
| Version 7.2 of the GDB debugger is out. New features include support for
the D language, some C++ improvements, better Python support, better
tracepoint support, and more; see the announcement for the details.
|
| GDB 7.2 released |
|
|
-->
