Fedora Security Process Model Question
by Chris Strzelczyk
Hello,
I am a BSD user who inherited a couple Fedora web servers machines. I
have a couple of questions on
how to best get security updates in the quickest possible manner. I
have been through the FAQ however, it
doesn't answer my questions and I would like to get some real world
answers from sys admins. I also want to
decide if to keep Fedora on these machines or migrate to BSD.
1. What is the best/quickest way to get security updates for Fedora
Linux? Although Redhat mentions to get errata
thourgh redhat.com I see nothing for Fedora on the redhat support page.
Is yum or up2date the only way to go?
2. Once Fedora goes to a new revision level (i.e. from core 3 to core
4) when do the experts recommend we update Fedora
core 3? I believe updates stop a few months after the new revision is
release. Does this include security updates?
3. When upgrading a Core version up a level how painless/painful is
it? FreeBSD makes upgrading through ports a walk in the
park I would just like to know what the real world thinks.
Thank you for any help you can offer me.
-cs
19 years, 3 months
Re: LDAP tcp ports not open!
by Daniel Durgin
>what does netstat -lp say ?
>Yang
On Thu, 3 Mar 2005 06:34:45 -0800 (PST), Daniel Durgin
<nu1sg(a)yahoo.com> wrote:
> Hi,
>
> I been running this ldap server for about a month
now.
> Last night it died for some reason. So I restarted
> the service. No errors on start up.
>
> But, now I can't connect with any client. Here's
the
> kicker. The slapd is running, but port 389 and 636
> are closed. I used nmap, those ports open.
Telneting
> into those ports was also futile.
>
> This should not be a firewall issue. I have already
> opened the ports and have been using ldap for about
a
> month.
>
> I also tried starting slapd manually with all debug
> info. I haven't seen any errors yet.
>
> I have check /var/log/messages too, nothing.
>
> Any Ideas?
>
> - Dan
>
> P.S. FC3, standard ldap rpm: openldap-2.2.13-2
Hi Yang,
Thanks for replying.
Netstat doesn't show any reference to slapd or its
pid.
-Dan
__________________________________
Celebrate Yahoo!'s 10th Birthday!
Yahoo! Netrospective: 100 Moments of the Web
http://birthday.yahoo.com/netrospective/
19 years, 3 months
RE: Keep Authorization
by GONZALEZ, Jose A.
I guess maybe I'm not explaining myself correctly. It doesn't let me do
anything in my local user account either. I get the prompt for password
and then the Key Authorization comes up and then nothing happens. The
panel I requested never comes up. For example I wanted to change my
screen resolution so I clicked on Display settings menu item. That is
when this Key Authorization issue started happening.
-----Original Message-----
From: fedora-list-bounces(a)redhat.com
[mailto:fedora-list-bounces@redhat.com] On Behalf Of Matthew Miller
Sent: Thursday, March 03, 2005 2:39 PM
To: For users of Fedora Core releases
Subject: Re: Keep Authorization
On Thu, Mar 03, 2005 at 02:18:14PM -0500, GONZALEZ, Jose A. wrote:
> Thanks that was clearer and helpful in understanding what it is doing.
> However, I'm actually logged in as root getting the Key authorization
> prompt. After accepting the Keep authorization I still can't open any
> of the system admin panels. I'm beginning to think I may have a
> permission problem. After I built the machine I went back and changes
> the IP address and the network name. Could that cause an issue with
> root access?
If you're logged in as root, you shouldn't need extra authentication to
run
these programs. But, you shouldn't be logged in as root.
--
Matthew Miller mattdm(a)mattdm.org
<http://www.mattdm.org/>
Boston University Linux ------>
<http://linux.bu.edu/>
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
19 years, 3 months
Re: Security Breach?
by Guy Fraser
On Wed, 2005-02-03 at 19:05 -0600, Jess Anderson wrote:
> Alexander Dalloz:
> >Chris Strzelczyk:
>
> >>I will start by looking at all those for recent security
> >>postings. Since the program in /tmp was owned by apache:apache
> >>I would imagine that the intruder used httpd to preform their
> >>exploit. That is where I'm at so far.
>
> >See Dave's and Leonard's replies. Your system is owned! :( And
> >as it looks it is the worm / trojan known to come in by weak
> >phpBB installs. [...]
>
> Getting owned (alas, I know first-hand) is one of the worst
> feelings a computer person can have, I think. It has been
> 5.5 years (knocks wood) since it happened. But I remember how
> I felt, so my sympathies go out to Chris Strzelczyk.
>
> It's painful and horribly inconvenient, but there really is no
> reasonable alternative to taking the box offline at once and
> doing a complete reinstall, reformatting all partitions.
>
> (I'm not sure, but isn't possible even then to have a worm or
> virus left in the boot sector of the hard disk, one that
> only a low-level format could remedy?)
>
> As a result of my own experience with getting cracked, I
> decided to dedicate a separate machine to running a very tough
> firewall at the network access point of my building. Most
> fortunately, I don't need to offer any services to the outside
> world, hence am invisible to port scanners, which removes
> probably half or more of the vulnerabilities.
>
> I don't worry much now (knocks wood again), but I still get
> nervous when I read accounts like the preceding.
>
> Be careful out there, it's a bad, bad world and getting worse.
>
...snip..
If your machines have access to external sites, they can be just
as vulnerable. One of my customers had a Windows box that was
infected with a trojan. The trojan allowed a hacker to break into
their SCO accounting server. I discovered the problem when the
customer complained that their connection was slow. After
analyzing some network flows I discovered some strange traffic.
After getting permission from the customer to investigate the
source of the traffic, I started sniffing the traffic. To my
amazement I saw what looked like names interspersed with binary
data. I called the customer and asked if the any of the names I
captured meant anything to them; it was staff members. After going
to the customer site I quickly found the machine that was
compromised and after analyzing there internal traffic I discovered
a connection to there accounting server that was not supposed to
be accessed from that machine. After I unplugged that machine
their bandwidth returned to normal. It would appear that the
hacker used the trojan to gain control of that machine, then
used that machine to find the unprotected SCO box inside the
firewall and tunnelled the data from the SCO box back to a machine
in Philadelphia, from their I have no idea what happened to the
data. I gave the information I collected to the customer, and
suggested they contact the Computer Crimes devision of the RCMP
if they wanted to take further action. Being a public company
they did not follow up with the police, due to concerns that the
information that was compromised could cause problems if people
found out about it. Their was a bunch of porn that had been deleted
recently on the machine, and my guess was that someone sent
an unsolicited email to the person on that machine with a link to
a porn site with the trojan embedded in the site, once accessed
the trojan was delivered and the rest is history. Although conjecture
on my part, it is a likely guess since that company is also behind
a firewall using NAT and has no ports that are forwarded.
I suggested a consultant for them to secure their site. They were
extremely thankful that I went out of my way to assist them.
19 years, 3 months
Evolution Email Import
by Greg Viola
Hi:
How do I import my address book from MS Outlook 2002 SP3 (which is a CSV
file with about 500 entries). There doesn't seem to be an import option
in Evolution to support this.
Thanks
Greg Viola
19 years, 3 months
FC2 -DELL 8400 Integrated Ethernet gigabit controller problem
by Ahamarshan jn
Thanks,
I am nearly stressed up because i am fighting with
this connection for nearly a month, I dont find
Broadcom Netextreme either in the list of adapters.
Also i tried to download the latest kernel RPMs
2.6.10... as adviced but when trying to install rpm -i
kerlnelxxx All i get is a warning message and no
further installation takes place.
I am mailing by booting with winxp and my FC2 is
still dormant in the other side of my harddisk.
How do i probe for findingout what NIC type i have(ie
what linux detects my NIC type is).
thank you
- ash
--- Jan Morales <jan(a)geezjan.org> wrote:
> Ahamarshan jn wrote:
> > Hello,
> > I have a DELL-8400 Series PC with SATA drive
> and I dual booted it
> > with winxp-prof and FedoraCore2 , there was and
> still a problem with the
> > sata drive not getting recognised by FC2, i have
> overcome this by
> > changing the settings in bios (i need to do this
> everytime i boot!),
> > also while booting it says Unrecognised
> board/chipset, but the real
> > problem is that when i try to connect to the
> internet, i get an error
> > message that my device is not recognised. From the
> start->
> > system-> Network connection, i selected the eth0
> and the device type as
> > Intel Gigabit 1000.
> > (Even after configuring the IP and settings)
> > I also tried to build the kernel to 2.6.9.XX from
> 2.6.5 but all i got is
> > Kernel panic and FC2 fail to boot.
> > Can anyone help me solve this problem.
> > I am new to Fedora.
> > My system details are
> > DELL-8400
> > INTEL-925X Express chipset with ICH6-R
> > INTEGRATED RAID CONTROLLER WITH INTEL Matrix
> storage
> > INTEGRATED GIGABIT NETWORK CONTROLLER
> > INTEL PENTIUM 4 PROCESSOR 550 WITH HT technology
> > Serial ATA Hard drive with 8mb burst cache.
> > 3GB DDR RAM.
> >
> > Any help
> > Thank you
> > - ash
> >
> >
>
------------------------------------------------------------------------
> > Celebrate Yahoo!'s 10th Birthday!
> > Yahoo! Netrospective: 100 Moments of the Web
> > <http://birthday.yahoo.com/netrospective/>
>
> I have a month-old 8400, and the integrated gigabit
> NIC is detected as a
> Broadcom Corporation NetXtreme (Trigon3).
>
> Jan
>
> --
> fedora-list mailing list
> fedora-list(a)redhat.com
> To unsubscribe:
> http://www.redhat.com/mailman/listinfo/fedora-list
>
__________________________________
Celebrate Yahoo!'s 10th Birthday!
Yahoo! Netrospective: 100 Moments of the Web
http://birthday.yahoo.com/netrospective/
19 years, 3 months
login manager
by jim lawrence
I have Entrance installed on my notebook. I would like to know where
and what file i need to edit do that entrance is the default login
manager.
--
Jim Lawrence
Registered Linux User: #376813
********************************************************
When I'm feeling down, I like to whistle.
It makes the neighbor's dog run to the end of his chain and gag himself.
************************************
19 years, 3 months
RE: Keep Authorization
by GONZALEZ, Jose A.
James,
Thanks that was clearer and helpful in understanding what it is doing.
However, I'm actually logged in as root getting the Key authorization
prompt. After accepting the Keep authorization I still can't open any
of the system admin panels. I'm beginning to think I may have a
permission problem. After I built the machine I went back and changes
the IP address and the network name. Could that cause an issue with
root access?
-Joe
-----Original Message-----
From: fedora-list-bounces(a)redhat.com
[mailto:fedora-list-bounces@redhat.com] On Behalf Of James Wilkinson
Sent: Thursday, March 03, 2005 12:58 PM
To: For users of Fedora Core releases
Subject: Re: Keep Authorization
GONZALEZ, Jose A. wrote:
> I'm new to Linux and I don't think I understand your responses. Does
> this mean there's a bug here or something I changed that made this Key
> authorization issue take place? Is there a fix? - Joe
It's the way it works. It's not a bug.
There are some things that you can't do as a normal user (add packages,
reconfigure parts of the system, add users, etc).
You could log in as root and do them all. That's a bad idea: it means
that everything you do is done as root, which has the power to destroy
the system. It's better to only be root when you need to be.
So the standard graphical admin utilities (that need root access) prompt
for you to enter the root password. Then they only do the absolute
minimum they have to as root.
But sometimes you'll want to do a number of system admin jobs at once.
That normally means that you'd have to enter your root password for each
program you want to run. That gets boring.
So Gnome will "remember your root password" for a short while. When you
open a system administration program (and only then) it will
automatically authorise the program to act as root (if necessary).
It puts that little key in the toolbar to remind you that it's "holding
your root password". You can tell Gnome to forget the password ("Forget
Authorization") when you've finished doing system admin things. That's
the popup message you were seeing.
After a while, it will forget anyway, and remove the key.
A lot of the rest of the discussion revolved around whether the
mechanics of this could work better, especially if you run programs from
the command line.
I hope this is clearer!
James.
--
E-mail address: james | In poker you have to show your hand eventually
if
@westexe.demon.co.uk | called. So far SCO have with great reluctance
shown
| only one card, which turned out to be "Mr Bun,
The
| Baker". -- Electric Dragon on groklaw.net
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
19 years, 3 months
Threaded Perl
by Henry Hartley
I've set up a FC3 box and want to run Interchange
(http://www.icdevgroup.org/) on it. The default perl on Fedora Core
(and this was true with RHL since 8) has threading turned on.
Interchange requires that threading be dissabled in order to run. Now,
I've grabbed the source and rebuilt perl and things are basically
working but out of curiosity, is the decision to enable threads in FC's
perl one that anyone would be willing to reconsider? Is threaded perl
required by enough people at this point to justify it? Here's a piece
of a thread (admitedly it's a bit old - from April 2003) discussing the
topic.
-- Begin Quoting Mike Heins -------------
Interchange doesn't use threads; but there are (as the authors of it
would readily admit) quite a few bugs in Perl's threads implementation.
It appears that Perl 5.8.0's ithread implementation is much better than
previous ones, which wouldn't even begin to run Interchange properly.
But it is not good enough to work well under all conditions. Randy
Moore of the core group discovered a case where vec() lost its map, and
I am positive there are many other little problems especially in
PreFork mode. Interchange pushes Perl pretty hard.
In fact, I wouldn't doubt that some of the locking problems people
are now having on Red Hat weren't due to this; I run some very
busy IC sites and don't see them at all.
Thus the new enforcement of the requirement. Before it was enforced
by the fact that noone distributed a Perl with threads enabled, and
the fact that Interchange wouldn't even start with threads enabled
should someone build such a Perl.
Red Hat distributed their perl for 8.0 and 9.0 with threads enabled,
which is *not* the default. This is an extremely bad decision; the
number of Perl scripts and programs which use threads must be far less
than one in 1,000, and anyone seriously using such a program must keep
up with the latest builds and modules to fight bugs.
It is another in a long line of bad Perl distributions by Red Hat.
While I like the Linux produced by my former employer and have been
using it exclusively for years, I abhor their Perl builds and when I
install a new system the first thing I do is build a new one.
In fact it sometimes seems as if the Python-heads there are trying to
sabotage Perl. I don't think that is the case; but there is no rational
reason to enable threads on Perl unless you are doing thread-based
program development. I know of no such programs in the Red Hat
distribution; it would surprise me greatly if there are any.
Someone made the suggestion we try to make Interchange thread-safe and
actually use them. While this is a noble goal, it is simply not
practical. Leaving aside the work that would need be done on
Interchange itself, IC uses or can use dozens of other Perl modules,
each of which would need to be vetted. The types of problems caused by
defects in threadsafeness (sic) are also notoriously hard to debug.
-- End Quoting Mike Heins ---------------
original here
http://www.icdevgroup.org/pipermail/interchange-users/2003-April/032700.
html
--
Henry
19 years, 3 months
FC3 : USB DSL Modem installation problem
by Ahmed Abdel-Aliem
Hi,
i am trying to get my usb dsl modem to work on fedora core 3
my dsl modem type is D-Link DSL-210 ADSL Modem
i plugged it and started linux and searched through to the menus to
find how i can make the settings for it, but i failed,
how can i know if linux recognized it or not ??
now i am getting the connection from a router so the connection is
detected automatically.
how can i install my usb dsl modem?
any idea ?
--
Ahmed Abdel-Aliem
Web Developer
www.ApexScript.com
0101108551
registered Linux user number 382789
19 years, 3 months