Openwall GNU/*/Linux Users Mailing List

Mike Belopuhov | 16 Oct 2004 22:18

Picon

sudo: why not?

Hi.

I'm just skipping some gratitudes to Owl team  and just asking
a question: why sudo is not in Owl?  Always when I install Owl I
can't guess why it is so.  It works fine with tcb.

I have working srpm of sudo with .pam and .control files included
(tested on 1.1-release on i386).  It's sudo-1.6.7p5.  You can get
SRPM here:
     http://openbsd.hnet.spb.ru/files/sudo-1.6.7p5-owl1.src.rpm

(sorry if it happens to be broken 

Suppose there is much to be done, but imho sudo is a good candidate
for the owl-current, isn't it?

PS.
Of course I googled for a such discussion, but hasn't found
anything relevant.

--

-- 
 Mike Belopuhov
 * ТХИС МЕССАГЕ ВАС ВРИТТЕН УСИНГ ЖИМ *

misiu_ | 20 Oct 2004 18:29

Picon

Picon

installed and chrooted and now?

Hello list,

this is my first contact with Owl. Now I installed the system as in the
install-doc than I issued a chroot /owl
and no? how do I set up the kernel? install lilo? 
do you have any documentation?

thanx,
misiu

gremlin | 20 Oct 2004 18:48

Picon

Re: installed and chrooted and now?

misiu_ wrote:

> this is my first contact with Owl. Now I installed the system as in the
> install-doc than I issued a chroot /owl
> and no? how do I set up the kernel? install lilo?
> do you have any documentation?

Simplest way:
1. Copy kernel from CD
# cp /boot/bzImage /owl/boot/
2. Setup LILO
# make setup
# vi /owl/etc/lilo.conf
3. Install LILO
# chroot /owl lilo

Then boot up from hard disk and build custom kernel usual way.

--

-- 
Alexey V. Vissarionov aka Gremlin from Kremlin

misiu_ | 20 Oct 2004 19:02

Picon

Picon

Re: installed and chrooted and now?

Am Mi, den 20.10.2004 schrieb gremlin um 18:48:

> Simplest way:
> 1. Copy kernel from CD
> # cp /boot/bzImage /owl/boot/
o.k.
> 2. Setup LILO
> # make setup
> # vi /owl/etc/lilo.conf
after /sbin/lilo
i get 
Warning: LBA32 addressing assumed
lilo: fatal: geo_query_dev HDIO_GETGEO(dev 0x1600):Invalid argument

any suggestions?

misiu
> 3. Install LILO
> # chroot /owl lilo
> 
> Then boot up from hard disk and build custom kernel usual way.
>

gremlin | 20 Oct 2004 19:13

Picon

Re: installed and chrooted and now?

misiu_ wrote:

> > 1. Copy kernel from CD
> > # cp /boot/bzImage /owl/boot/
> o.k.
> > 2. Setup LILO
> > # make setup
> > # vi /owl/etc/lilo.conf
> after /sbin/lilo
> i get
> Warning: LBA32 addressing assumed
> lilo: fatal: geo_query_dev HDIO_GETGEO(dev 0x1600):Invalid argument
> 
> any suggestions?

Hmm... AFAIR, 0x1600 is a sort of SCSI disk - possibly, you have to edit
/owl/etc/lilo.conf to suit your needs.

> > 3. Install LILO
> > # chroot /owl lilo

--

-- 
Alexey V. Vissarionov aka Gremlin from Kremlin

gremlin | 20 Oct 2004 19:20

Picon

Re: installed and chrooted and now?


> > after /sbin/lilo
> > i get
> > Warning: LBA32 addressing assumed
> > lilo: fatal: geo_query_dev HDIO_GETGEO(dev 0x1600):Invalid argument
> >
> > any suggestions?
> 
> Hmm... AFAIR, 0x1600 is a sort of SCSI disk - possibly, you have to edit
> /owl/etc/lilo.conf to suit your needs.
> 
> > > 3. Install LILO
> > > # chroot /owl lilo

[I'll never post drunk messages to list! I'll never post dru...]

0x1600 is /dev/hdc (22,0) - is that your hard disk device, or is it a
CD-ROM?

--

-- 
Alexey V. Vissarionov aka Gremlin from Kremlin

Solar Designer | 20 Oct 2004 21:55

Re: sudo: why not?

Hi Mike,

On Sun, Oct 17, 2004 at 12:18:02AM +0400, Mike Belopuhov wrote:
> I'm just skipping some gratitudes to Owl team  and just asking
> a question: why sudo is not in Owl?  Always when I install Owl I
> can't guess why it is so.  It works fine with tcb.

Yes, but unfortunately both su and sudo are subtly but fundamentally
flawed.

Presently, the only safe use for su is to switch from a more
privileged account to a less privileged one (whenever this distinction
can be made) in a non-interactive script (without a tty).  As soon as
a tty is used, there is a security problem.  As soon as you su to a
more privileged account, there is another security problem.

We've been discussing privately how we might re-design su (or
improve Linux kernel interfaces) such that su would become safe in
presence of tty's.  However, even if that is done, su would still be
unsafe for accessing more privileged accounts from less privileged
ones.

Yes, it used to be common sysadmin wisdom to "su root" rather than
login as root.  Those few who, when asked, could actually come up with
a valid reason for this preference would refer to the better
accountability achieved with this approach.  Yes, this really is a
good reason in favor of this approach.  But it's also the only one.
And the reason I give against using this approach is that it
effectively allows anyone who could have compromised the otherwise
non-privileged user account used to su from to gain root (at the

(Continue reading)

Steven Lembark | 20 Oct 2004 22:36

Re: sudo: why not?


> Presently, the only safe use for su is to switch from a more
> privileged account to a less privileged one (whenever this distinction
> can be made) in a non-interactive script (without a tty).  As soon as
> a tty is used, there is a security problem.  As soon as you su to a
> more privileged account, there is another security problem.

Catch: priv'd accounts can depend on context. What may be
less priv'd in one context (say, dba access vs. reformat the
disks) can be more priv'd in another (say, modify someone's
payroll record).

> Yes, it used to be common sysadmin wisdom to "su root" rather than
> login as root.  Those few who, when asked, could actually come up with
> a valid reason for this preference would refer to the better
> accountability achieved with this approach.  Yes, this really is a
> good reason in favor of this approach.  But it's also the only one.

You can also refuse superuser logins over the network (from
the root username or any other with UID 0). At that point
someone has to compromise the system enough to modify the
login rules before they can get in as root via the network.

You can restrict the number of users with simple access to
the command via mods, which allows revoking access to the
command by removing a user from one group (vs. having to
change the password). While not perfect, this does simplify
the most common cases where ex-employees have su access
because Jow Bloe in accouting couldn't be notified of the
change.

(Continue reading)

misiu_ | 20 Oct 2004 23:59

Picon

Picon

Re: installed and chrooted and now?

hi, i guess it is my cdrom...
but in my lilo.conf
is  
"boot=/dev/hda1"
"root=/dev/hda"

misiu

Am Mi, den 20.10.2004 schrieb gremlin um 19:20:
> > > after /sbin/lilo
> > > i get
> > > Warning: LBA32 addressing assumed
> > > lilo: fatal: geo_query_dev HDIO_GETGEO(dev 0x1600):Invalid argument
> > >
> > > any suggestions?
> > 
> > Hmm... AFAIR, 0x1600 is a sort of SCSI disk - possibly, you have to edit
> > /owl/etc/lilo.conf to suit your needs.
> > 
> > > > 3. Install LILO
> > > > # chroot /owl lilo
> 
> [I'll never post drunk messages to list! I'll never post dru...]
> 
> 0x1600 is /dev/hdc (22,0) - is that your hard disk device, or is it a
> CD-ROM?

Andreas Ericsson | 21 Oct 2004 00:06

Picon

Re: sudo: why not?

Steven Lembark wrote:
> 
>> Presently, the only safe use for su is to switch from a more
>> privileged account to a less privileged one (whenever this distinction
>> can be made) in a non-interactive script (without a tty).  As soon as
>> a tty is used, there is a security problem.  As soon as you su to a
>> more privileged account, there is another security problem.
> 
> 
> Catch: priv'd accounts can depend on context. What may be
> less priv'd in one context (say, dba access vs. reformat the
> disks) can be more priv'd in another (say, modify someone's
> payroll record).
> 

The root user could access the database files physically 
(binaryphorically speaking) and thus already has this privilege. There 
is really no such thing as security against the superuser.

>> Yes, it used to be common sysadmin wisdom to "su root" rather than
>> login as root.  Those few who, when asked, could actually come up with
>> a valid reason for this preference would refer to the better
>> accountability achieved with this approach.  Yes, this really is a
>> good reason in favor of this approach.  But it's also the only one.
> 
> 
> You can also refuse superuser logins over the network (from
> the root username or any other with UID 0). At that point
> someone has to compromise the system enough to modify the
> login rules before they can get in as root via the network.

(Continue reading)

Group

gmane.linux.openwall.user.

Project Web Page

Openwall GNU/*/Linux Users Mailing List

Search Archive

Page

1 | 2 | 3 | 4

Articles in period: 35

October 2004

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

Anyone has Owl image for Raspberry Pi? (13 May 2013)
software raid with device busy status (7 May 2013)
Owl encrypted / and tcplay (4 May 2013)
openvz kernel (4 May 2013)
Owl-current and 3.0-stable 2013/04/08 snapshot (11 Apr 2013)
Manage network interfaces (20 Feb 2013)
/etc/inittab exisits, yet reports none! (3 Jan 2013)
virtualization in openwall (3 Jan 2013)
Owl kickstart - Owl-current (VirtualBox Guest Additions) (18 Dec 2012)
Owl2 VirtualBox Guest additions (17 Dec 2012)
OWL development snapshots on an ALIX 2d2 board (15 Dec 2012)
Owl kickstart (15 Dec 2012)
python pre-packaged? (15 Nov 2012)
Owl-current 2012/08/18 snapshot (19 Aug 2012)
New kernel (8 Jun 2012)
Owl OpenVZ template - strange network configuration (4 Jun 2012)
making installation flash (29 May 2012)
Error in installworld (27 May 2012)
new Owl-current snapshot (9 May 2012)
screen termcap warning (5 Apr 2012)
Upgrading to current gives dependency problem after kernel upgrade and (3 Apr 2012)

Archives

16	May 2013
1	April 2013
3	February 2013
5	January 2013
19	December 2012
2	November 2012
1	August 2012
7	June 2012
8	May 2012
23	April 2012
12	March 2012
2	February 2012
2	January 2012
1	December 2011
22	November 2011
7	October 2011
8	September 2011
23	July 2011
1	June 2011
20	May 2011
8	April 2011
13	March 2011
7	February 2011
7	January 2011
16	December 2010
2	October 2010
8	September 2010
6	August 2010
6	July 2010
2	June 2010
1	May 2010
15	March 2010
5	January 2010
14	December 2009
3	November 2009
10	October 2009
15	September 2009
4	August 2009
5	July 2009
3	June 2009
7	April 2009
2	March 2009
3	February 2009
3	January 2009
1	August 2008
10	July 2008
1	May 2008
5	April 2008
9	March 2008
1	November 2007
1	October 2007
1	September 2007
6	August 2007
3	July 2007
36	June 2007
7	May 2007
26	April 2007
6	March 2007
16	February 2007
7	January 2007
1	December 2006
25	November 2006
7	October 2006
1	September 2006
11	August 2006
27	July 2006
11	June 2006
8	May 2006
11	April 2006
1	March 2006
27	February 2006
10	January 2006
14	December 2005
2	November 2005
17	October 2005
18	September 2005
1	July 2005
13	June 2005
19	May 2005
8	April 2005
8	March 2005
11	February 2005
15	January 2005
11	December 2004
29	November 2004
35	October 2004
11	September 2004
7	August 2004
4	July 2004
20	June 2004
9	May 2004
11	April 2004
14	March 2004
28	February 2004
8	January 2004
11	December 2003
8	November 2003
2	October 2003
9	September 2003
11	August 2003
9	June 2003
3	May 2003
12	April 2003
16	March 2003
11	February 2003
21	January 2003
13	December 2002
23	November 2002
46	October 2002
5	September 2002
7	August 2002
15	July 2002
12	June 2002
6	May 2002
2	April 2002
10	March 2002
3	February 2002
1	January 2002
2	December 2001
33	November 2001
44	October 2001
2	September 2001
6	August 2001
7	July 2001
10	May 2001

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template