[akonstam: Re: A security flaw question - a clarification]
by akonstam@trinity.edu
> >
> > I have a security question for the group. We have ~50 Linux machines
J> > that are NIS clients of out server. The idea as you know is that any
> > of are students can log in to any of the machines and have the same
> > home directory and the same passwd.
> >
>
> This would only happen if you have givin all the students the same user
> account and password which is a bad idea from the start. Each student should
> have their own user account and password, which would give each student their
> own home directory.
I guess I am not clear. The students have different user accounts and
passwds but their user accounts and passwds work on all the NIS
clients.
>
> > Ok, now the question. I have been hearing from people about security
> > flaws. Well what about about this. A number of our faculty have set up
> > their personal machines as NIS clients. It makes it easier to get to
> > their class related files. My feeling this is a tremendous security
> > hole, since a first important step in hacking a machine might be logging in
> > to the machine. Making faculty personal machines NIS clients
> > means that any of the 1000 or so students can log in to the faculty
> > machine. Does any one else think that this is a bad idea, or am I
> > confused?
> > --
> It is only a security hole "if" the teacher remains logged in while away from
> their machine. if so, anyone could use the machine and would be logged in as
> the instructor. If the instructor logs out, then the students would not have
> access to the computer. to prevent this you could have the computer log them
> out after a certain time out and stress to the instructors that for security
> it is important for them to log out of their machine.
>
> James Carver
No that is not the problem I am talking about. To hack a machine
remotely is a hell of a lot harder to do from a different machine
than it is if you are logged on to the machine you want to hack. It
has nothing to so with whether or not the instructor leaves his
machine logged on. Well not nothing but I am not talking about that
situation.
I am not concerned if people disagree with me but I am frustrated that
I can't clearly formulate my question so people see what I am asking.
--
=======================================================================
If you want to know how old a man is, ask his brother-in-law.
-------------------------------------------
Aaron Konstam
Computer Science
Trinity University
telephone: (210)-999-7484
18 years, 10 months
Cannot login with selinux on
by Ian Puleston
Since updating to Kernel 2.6.11-1.1366_FC4, and now 2.6.11-1.1369_FC4, I
haven't been able to login as root or any other user, getting error
message "No shell: permission denied" on login followed by the login
prompt again. This only happens with selinux, and does not happens if I
boot with "selinux=no" - then it works fine and I can login OK. This is
with login from the console after booting to level 3 (no X).
In /var/log/messages I'm seeing the following when this happens:
Jun 1 00:21:45 localhost login(pam_unix)[2704]: session opened for user
ian by (uid=0)
Jun 1 00:21:45 localhost login[2704]: Warning! Could not
relabel /dev/tty1 with user_u:object_r:tty_device_t, not
relabeling.Permission denied
Jun 1 00:21:45 localhost -- ian[2704]: LOGIN ON tty1 BY ian
Jun 1 00:21:45 localhost login(pam_unix)[2704]: session closed for user
ian
And I also see the following in there - don't know if this is relevant:
Jun 1 00:21:28 localhost kernel: audit(1117610487.009:3): avc: denied
{ sys_admin } for pid=2078 comm="consoletype" capability=21
scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t
tclass=capability
Jun 1 00:21:28 localhost kernel: SELinux: initialized (dev rpc_pipefs,
type rpc_pipefs), uses genfs_contexts
Any ideas anyone (other than permanently turning off selinux)?
Ian
>From Ian Puleston:
>
> Now, with the new Kernel, I cannot login in at all. Trying to login as root
> or another user gives an error "no shell" and then back to the login prompt.
>
> Is there any way to get round this other than a full re-install?
>
> Ian
>
18 years, 10 months
About firefox-1.0.4-4 CSS history exploit
by Rogelio Jacinto
Marcus wrote:
> I've visited this browser test: http://gemal.dk/browserspy/css.html
I visited the page and read the source.
> with the latest firefox-1.0.4-4 and wonder me, why the script can
read my browser >history?! Is it a general firefox feature or a bug?
What the script is doing is the following:
1. Sets up a list of popular pages, this is hardcoded in the script.
2. Writes the HTML code including in line CSS styles for the link list:
{position: absolute; top: 0} for the unvisited anchor elements (links)
and {top: 100px; color: #660001;} for the visited anchors.
3. Examines the anchor elements to determine if the CSS style contains
any of the properties and values assigned through the in line styles.
If the condition is met then writes out: "Yes you have been visiting the
site lately!".
I think this is -not- a bug, it's just a clever use of javascript and
CSS that exploits the well known CSS behavior of styling a visited link
differently than a unvisited link.
The script does not read the browser history nor does it access any
cookies.
Regards,
Rogelio
18 years, 10 months
Cannot login after updating yesterday
by Ian Puleston
Hi,
I've been running FC4 test 2, and figured that with FC4 release imminent
things should be pretty stable by now, so yesterday I ran up2date to update
everything, initially bar the Kernel. Mostly went OK but there were a few
problems afterwards:
- GNOME desktop icons had vanished and I couldn't find a way to recreate
them.
- Right-click on GNOME desktop didn't bring up usual menu.
- I couldn't login to CUPS.
Then I decided to update the remaining items (kernel, kernel-devel, etc.)
too. This update went OK except that up2date hung at the end of the
installation phase. On re-running it, it told me everything was up to date
so I rebooted.
Now, with the new Kernel, I cannot login in at all. Trying to login as root
or another user gives an error "no shell" and then back to the login prompt.
Is there any way to get round this other than a full re-install?
Ian
18 years, 10 months
ATI drivers and FC4t3
by Rodd Clarkson
I know this isn't the place to discuss proprietary drivers, but I'm
feeling envious as those NVIDIA guys stuggle with their card while
there's no word regarding ATI cards
Has anyone managed to get the ATI drivers working?
I seem to remember something about problems with it not compiling with
gcc4.0, but could be wrong.
Rodd.
--
"It's a fine line between denial and faith.
It's much better on my side"
18 years, 10 months
Missing Dependency: libgs.so.7 is needed by package ImageMagick
by Peter Ennis
--> Running transaction check
--> Processing Dependency: libgs.so.7 for package: ImageMagick
--> Finished Dependency Resolution
Error: Missing Dependency: libgs.so.7 is needed by package
ImageMagick
root:/adaept/lfs6/scripts#
When I try to login to bugzilla on the FC4T3/Rawhide box
(now FC5 develpoment with the updates ???) I get this
message:
Alert
You cannot connect to bugzilla.redhat.com because SSL
is disabled.
I guess the failed yum update turned it off.
PFE
18 years, 10 months
rawhide report: 20050605 changes
by Build System
Updated Packages:
metacity-2.10.0-2.fc5
---------------------
* Mon May 30 2005 Warren Togami <wtogami(a)redhat.com> 2.10.0-2
- raise demands attention (#157271 newren)
18 years, 10 months
FC4 on June 6?
by Tim Taranov
Hi -
I'm just curious - is FC4 on scheduled for the June 6 release date?
Thanks,
Tim
18 years, 10 months
rawhide report: 20050604 changes
by Build System
Updated Packages:
GFS-kernel-2.6.11.8-20050601.152643.FC4.2
-----------------------------------------
at-3.1.8-78
-----------
* Fri Jun 03 2005 Jason Vas Dias <jvdias(a)redhat.com> 3.1.8-78
- fix bug 159220: add pam_loginuid to pam session stack in /etc/pam.d/atd
- fix bug 102341: add '-r' synonym for '-d' / atrm for POSIX / SuS conformance
cman-kernel-2.6.11.5-20050601.152643.FC4.2
------------------------------------------
dlm-kernel-2.6.11.5-20050601.152643.FC4.2
-----------------------------------------
eclipse-cdt-1:3.0.0_fc-0.M6.8
-----------------------------
* Fri Jun 03 2005 Jeff Pound <jpound(a)redhat.com> 3.0.0_fc-0.M6.8
- Patch refactoring/build.properties to include plugin.properties.
- Temporarily move all *.so's to *.so.bak due to native compilation bug.
- Temporarily remove gcj .jar -> .so db population.
gamin-0.1.0-1.1
---------------
* Fri Jun 03 2005 Elliot Lee <sopwith(a)redhat.com> 0.1.0-1.1
- Add the .la file back in for now (FC-4)
ghostscript-8.15-0.rc3.1
------------------------
* Fri Jun 03 2005 Tim Waugh <twaugh(a)redhat.com> 8.15-0.rc3.1
- Switch to ESP Ghostscript.
- 8.15rc3.
- Lots of patches dropped. Perhaps some will need to be re-added.
gnbd-kernel-2.6.11.2-20050420.133124.FC4.35
-------------------------------------------
kernel-2.6.11-1.1369_FC4
------------------------
* Wed Jun 01 2005 Dave Jones <davej(a)redhat.com>
- Fix up ALI IDE regression. (#157175)
* Mon May 30 2005 Dave Jones <davej(a)redhat.com>
- Fix up VIA IRQ quirk.
python-urlgrabber-2.9.6-2
-------------------------
* Fri Jun 03 2005 Phil Knirsch <pknirsch(a)redhat.com> 2.9.6-2
- Fixed the reget method to actually work correctly (skip completely transfered
files, etc)
18 years, 10 months
Fedora Core 4 delayed until June 13
by Bill Nottingham
Due to some unforseen complications, Fedora Core 4 is now
scheduled for general availability on June 13. We apologize for
the inconvenience.
Bill
18 years, 10 months