headers
Janusz | 1 Mar 2002 18:26
Picon

Wrong entries in wtmp

Just a short description of the problem.

1. I log in as usually:
Using username "januz".
januz <at> owldevel's password:
owldevel!januz:~$ 

2. Check who is logged on:   [last | less]
januz    pts/0        me               Fri Mar  1 20:26  still logged in
reboot   system boot  2.2.19           Fri Mar  1 20:24          (00:02)

3. Then su and check again:
root     pts/0        localhost        Fri Mar  1 20:26 - 20:27  (00:00)
januz    pts/0        me               Fri Mar  1 20:26 - 20:26  (00:00)
reboot   system boot  2.2.19           Fri Mar  1 20:24          (00:03)

Looks as if I've just logged out and root came into my place from
localhost. And this is obviously a lie.

4. the end of root's session, and another check:
januz    pts/0        me               Fri Mar  1 20:27   still logged in
root     pts/0        localhost        Fri Mar  1 20:26 - 20:27  (00:00)
januz    pts/0        me               Fri Mar  1 20:26 - 20:26  (00:00)
reboot   system boot  2.2.19           Fri Mar  1 20:24          (00:03)

This time it reports my ,,come back'' from machime ,,me''.

The version of Owl is the newest one.

Janusz
(Continue reading)

Permalink | Reply | 3 comments |
headers
Solar Designer | 1 Mar 2002 19:38
Favicon

Re: Wrong entries in wtmp

On Fri, Mar 01, 2002 at 06:26:55PM +0100, Janusz wrote:
> Just a short description of the problem.

Yes, thanks.

> 4. the end of root's session, and another check:
> januz    pts/0        me               Fri Mar  1 20:27   still logged in
> root     pts/0        localhost        Fri Mar  1 20:26 - 20:27  (00:00)
> januz    pts/0        me               Fri Mar  1 20:26 - 20:26  (00:00)
> reboot   system boot  2.2.19           Fri Mar  1 20:24          (00:03)
> 
> This time it reports my ,,come back'' from machime ,,me''.

Well, while this "su -" behavior is a little unusual, I don't see
anything obviously wrong with it.  What behavior would you prefer?
Not logging the su sessions into wtmp at all (which I believe is the
case for most other implementations)?

The part of our su logging that really is questionable is that it adds
new entries to utmp (not wtmp, for which that is fine) for "su -"
sessions.  This makes you appear to be logged in twice.  Perhaps it
should replace the existing entry and restore it when the su session
ends.  This has been on TODO for a while now.

--

-- 
/sd
Permalink | Reply | 2 comments |
headers
Janusz | 1 Mar 2002 20:05
Picon

Re: Wrong entries in wtmp

> > 4. the end of root's session, and another check:
> > januz    pts/0        me               Fri Mar  1 20:27   still logged in
> > root     pts/0        localhost        Fri Mar  1 20:26 - 20:27  (00:00)
> > januz    pts/0        me               Fri Mar  1 20:26 - 20:26  (00:00)
> > reboot   system boot  2.2.19           Fri Mar  1 20:24          (00:03)
> > 
> > This time it reports my ,,come back'' from machime ,,me''.
> 
> Well, while this "su -" behavior is a little unusual, I don't see
> anything obviously wrong with it.  What behavior would you prefer?
> Not logging the su sessions into wtmp at all (which I believe is the
> case for most other implementations)?
> 
I'd prefer not logging these at all, or with some indication that
it was a su session.
Having information that root logged on from _localhost_ is a bit
confusing, even though I can see it was on pty/0, not a tty.
So is the information about my "second" login.

But of course I'm not saying that my point of view is the best one.

Janusz
Permalink | Reply | 0 comments |
headers
Solar Designer | 1 Mar 2002 21:26
Favicon

Re: Wrong entries in wtmp

On Fri, Mar 01, 2002 at 09:38:36PM +0300, Solar Designer wrote:
> The part of our su logging that really is questionable is that it adds
> new entries to utmp (not wtmp, for which that is fine) for "su -"
> sessions.  This makes you appear to be logged in twice.  Perhaps it
> should replace the existing entry and restore it when the su session
> ends.  This has been on TODO for a while now.

OK, I think I've fixed this one.  Will be in the next snapshot.

* Fri Mar 01 2002 Solar Designer <solar <at> owl.openwall.com>
- Pick the best match utmp entry to replace when ut_id's don't match; if
that was the case, leave ut_id at what it was in utmp such that the entry
may be manipulated with pututline(3).

We could enforce some ut_id conventions for Owl, but we also want to
co-exist with software which isn't a part of Owl (such as xterm's).

--

-- 
/sd
Permalink | Reply | 0 comments |
headers
Solar Designer | 4 Mar 2002 02:26
Favicon

Linux 2.2.20-ow2, NordU2002 presentation slides on Owl

Hi,

I've just released Linux 2.2.20-ow2.  This version of the patch fixes
an x86-specific Linux kernel vulnerability where local users could
abuse a binary compatibility interface (lcall) to kill processes not
belonging to them (including system processes).

The patch is available at the usual location:

	http://www.openwall.com/linux/

Both Owl-current and Owl 0.1-stable have been updated to include this
version of the patch.  (There's no updated Owl-current ISO image yet,
though, but once there is it will have the new patch.)

As promised, I've also released our NordU2002 presentation slides on
Owl, as well as an updated version of the SSH Traffic Analysis slides
(as used at NordU2002).  The URL is:

	http://www.openwall.com/presentations/

--

-- 
/sd
Permalink | Reply | 0 comments |
headers
Stephan Lagerholm | 14 Mar 2002 18:37
Picon

Installing on old machine

Hi there,

Im trying to install OWL on an old x86-P90 with 16 meg memory that are
unable to boot via CD-rom.

Questions:

1. I have bootable redhat on the hd, can that be used in some way to
   force the machine to boot from cdrom?

2. Is it possible at all to install on that machine? Performance is not
   an issue here. As far as I remeber RedHat told me that it needed to
   turn on swap right away during installation in order to succed.

3. The boot floppy don't give the cdrom as an option to boot from. Have I
   missed something here?

Thanx in advance
-----------------------------------------------
Stephan Lagerholm
Consultant
Nexus Security, Uppsala
Technology Nexus AB
tel: +46 705-270114
Permalink | Reply | 4 comments |
headers
Michael Tokarev | 15 Mar 2002 00:54
Picon

Re: Installing on old machine

Stephan Lagerholm wrote:
> 
> Hi there,
> 
> Im trying to install OWL on an old x86-P90 with 16 meg memory that are
> unable to boot via CD-rom.
> 
> Questions:
> 
> 1. I have bootable redhat on the hd, can that be used in some way to
>    force the machine to boot from cdrom?

If the kernel that is on your machine has CD-rom drivers compiled in
(default for RedHat), you should be able to do so -- maybe.  Telling
lilo to pass appropriate `root=/dev/hdX' argument to the kernel so
it will try to mount your cdrom as root filesystem.  Better yet is
to copy kernel from installation CD to your harddrive and tell lilo
to use it as well as your RedHat's kernel, and use it to boot off the
CD.  Just add

  image=/boot/owl-boot-kernel append="root=/dev/your-cd-rom"

to /etc/lilo.conf and call lilo to write new table.

But I can't say what other parameters should be passed to boot kernel,
and where it can be found (I never installed Owl or any other linux
distro this way, all my installations was done manually copying appropriate
files to new HD and making it bootable).

> 2. Is it possible at all to install on that machine? Performance is not
(Continue reading)

Permalink | Reply | 2 comments |
headers
Michael Tokarev | 15 Mar 2002 03:38
Picon

Re: Installing on old machine

Michael Tokarev wrote:
> 
> Stephan Lagerholm wrote:
> >
> > Hi there,
> >
> > Im trying to install OWL on an old x86-P90 with 16 meg memory that are
> > unable to boot via CD-rom.
> >
> > Questions:
> >
> > 1. I have bootable redhat on the hd, can that be used in some way to
> >    force the machine to boot from cdrom?
> 
> If the kernel that is on your machine has CD-rom drivers compiled in
> (default for RedHat), you should be able to do so -- maybe.  Telling
> lilo to pass appropriate `root=/dev/hdX' argument to the kernel so
> it will try to mount your cdrom as root filesystem.  Better yet is
> to copy kernel from installation CD to your harddrive and tell lilo
> to use it as well as your RedHat's kernel, and use it to boot off the
> CD.  Just add
> 
>   image=/boot/owl-boot-kernel append="root=/dev/your-cd-rom"
> 
> to /etc/lilo.conf and call lilo to write new table.
> 
> But I can't say what other parameters should be passed to boot kernel,
> and where it can be found (I never installed Owl or any other linux
> distro this way, all my installations was done manually copying appropriate
> files to new HD and making it bootable).
(Continue reading)

Permalink | Reply | 1 comment |
headers
Solar Designer | 15 Mar 2002 08:42
Favicon

Re: Installing on old machine

On Thu, Mar 14, 2002 at 06:37:03PM +0100, Stephan Lagerholm wrote:

Hi Stephan,

Michael has already posted several useful hints, so I'll just provide
some official answers.

> Im trying to install OWL

It's Owl, please. ;-)

> on an old x86-P90 with 16 meg memory that are unable to boot via CD-rom.

That's fine.

> Questions:
> 
> 1. I have bootable redhat on the hd, can that be used in some way to
>    force the machine to boot from cdrom?

As Michael has explained, yes.  But an easier way should work, see below.

> 2. Is it possible at all to install on that machine? Performance is not
>    an issue here. As far as I remeber RedHat told me that it needed to
>    turn on swap right away during installation in order to succed.

I _think_ 8 MB is the minimum for our installation CD.  But I haven't
actually tested with so little memory myself.  If you do, please let
us know the results.  If there're any problems installing with your
16 MB, we'll fix that as a bug.  That is clearly a reasonable amount
(Continue reading)

Permalink | Reply | 0 comments |
headers
Solar Designer | 15 Mar 2002 08:46
Favicon

Re: Installing on old machine

On Fri, Mar 15, 2002 at 05:38:48AM +0300, Michael Tokarev wrote:
> Michael Tokarev wrote:
> > Stephan Lagerholm wrote:
> 
> > > 3. The boot floppy don't give the cdrom as an option to boot from. Have I
> > >    missed something here?
> 
> A guess.  Should another boot-image be inside cd-rom?  I.e., when ISO gets
> created, something should be placed into it's boot area -- something that
> is sutable for booting off the cdrom, yes (El-torio boot ext)?  So such an
> image should be available somewhere, and if one writes it to a floppy...

That is the only floppy image available there, and its use for when CD
booting isn't directly supported is in fact documented for Owl.

That's the way to go.

--

-- 
/sd
Permalink | Reply | 0 comments |

Gmane