From: Digestifier To: Linux-Admin@senator-bedfellow.mit.edu Reply-To: Linux-Admin@senator-bedfellow.mit.edu Date: Mon, 18 Oct 93 03:46:32 EDT Subject: Linux-Admin Digest #114 Linux-Admin Digest #114, Volume #1 Mon, 18 Oct 93 03:46:32 EDT Contents: Re: [Summary] /etc/shutdown by non-root (news@cs.mu.OZ.AU) Multiple groups (Scott Drassinower) Routing problems (Michael Aos) Re: Multiple groups (Joseph Womack - EECS) Re: Multiple groups (John Paul Morrison) *** Survey Summary of Questions Posted to c.o.l.d and c.o.l.a *** (Byron A Jeff) Re: Laser priter queries (Jeffrey Wescott) QIC-02: HELP! (Robert Broughton) UNIX sysadmin FAQ- proposal and volunteer (Dan Mosedale) ---------------------------------------------------------------------------- Crossposted-To: comp.unix.admin From: news@cs.mu.OZ.AU Subject: Re: [Summary] /etc/shutdown by non-root Date: Sun, 17 Oct 1993 17:03:34 GMT Path: munta.cs.mu.OZ.AU!fjh From: fjh@munta.cs.mu.OZ.AU (Fergus James HENDERSON) tytso@athena.mit.edu (Theodore Y. Ts'o) writes: >So if someone modified Linux to allow >setuid shell scripts, and they created a setuid shell script, I could >break into that machine while holding my breath(*): Assuming that they did so without making it secure, as you describe below, then someone could definitely break into the machine while holding their breath. But they would have to exploit the race condition - the method you suggested using execve("-", ...) doesn't work. (Try it!) >How can you have truely secure setuid shell scripts? There are three >possible ways: > >(2) Same as (1), but modify the kernel to pass "/proc/self/fd/3" as the > shell script to be interpreted. > > Disadvantage: Depends on /proc being mounted; until /proc is > mounted, shell scripts won't work at all. The way I implemented it, the kernel only passed /proc/self/fd/3 to set[ug]id scripts, not to all scripts, so normal shell scripts would still work if /proc is not mounted. > Also, if /proc isn't mounted yet and /proc is writeable, you will > have a security hole. That is true, but it shouldn't be any worse than the danger of having / or /etc writeable. > Further disadvantage: Nothing else in the kernel needs to know > anything about where various filesystems (including /proc) is > mounted. This makes the proc filesystem, and the magical /proc > location, pretty magical. From a purely architectural point of > view, this is extremely ugly. I agree that it is somewhat ugly, but the startup code contains some magic filenames: /dev/tty1, /etc/init, etc., so this is not completely unique. On the other hand, I think that from an architectural point of view it doesn't make sense for the kernel to support #! interpreter scripts if it's only going to do a half-hearted job (i.e. not support setuid #! scripts). The disadvantage you didn't mention is setuid shell scripts can't use $0 to print out error messages, etc., since $0 is now /proc/self/fd/3. Also it looks a little bit ugly in your ps listings. Oh well, you can't have everything. >(3) Continue to have the kernel not allow setuid shell scripts, but > continue to allow them to be run. Modify each interpreter to > follow the "perl" setuid algorithm. > > * The interpreter checks to see if the setuid bit is set > on the shell script has just opened. > * If the shell script has the setuid bit set, then exec > a setuid version of the interpreter ("tperl" in > perl's case) with the same arguments. > * The setuid version of the interpreter opens the shell > script again, and the fstat()'s the file. If > the file still has the setuid bit, then go > ahead and execute it. If it does not, > it should print an error message about someone > switching binaries on it, and error out. > >Disadvantage: You have to modify each interpreter differently. Two >different versions of the interpreter has to be saved --- the normal >interpreter and the setuid trusted interpreter. Further disadvantage: you need to have a setuid root interpreter, even if the shell scripts are only setgid to unimportant groups. To some extent, the security of your system is inversely proportional to the number of setuid root executables on it ;-), so this is undesireable. -- Fergus Henderson fjh@munta.cs.mu.OZ.AU ------------------------------ From: scottd@panix.com (Scott Drassinower) Subject: Multiple groups Date: 17 Oct 1993 13:20:50 -0400 Is it possible for me to have a user belong to 2 or more groups under Linux? I am running SLS 1.03 pl12. If not, will this be considered for future releases? ------------------------------ From: aos@rainbow.sosi.com (Michael Aos) Crossposted-To: comp.unx.admin Subject: Routing problems Date: 17 Oct 1993 11:14:13 -0700 I have 6 machines in a local network connected via SLIP to the internet. The one machine with the SLIP and ethernet talk beautifully to everyone locally and everyone on the outside. The local machines have arbritrary IP numbers, on a different network than the SLIP connection. If I put all the machines on the same "network" as the SLIP connection, nothing works. If I try to access the SLIP connection from another machine I get "network unreachable". Can someone with some experience with this sort of thing PLEASE give me some hints? Thanks, Mike -- AMN Michael S. Aos aos@rainbow.sosi.com This egf-bbs.uucp PSC Box 70989 msaos@nyx.cs.du.edu message Sun 2/120 Peterson AFB rainbow.sosi.com!egf-bbs!mike delayed (719) 573-5761 CO, 80914-5630 rainbow!egf-bbs!dormrat!mike 24 hrs Login as 'guest' ------------------------------ From: jwomack@yoda.eecs.wsu.edu (Joseph Womack - EECS) Subject: Re: Multiple groups Date: Sun, 17 Oct 93 20:24:45 GMT In article <29ruti$dhb@panix.com> scottd@panix.com (Scott Drassinower) writes: >Is it possible for me to have a user belong to 2 or more groups under Linux? >I am running SLS 1.03 pl12. If not, will this be considered for future >releases? Add there login name to /etc/group for the groups you want them to be able to newgrp to. i.e. give juser acces to wheel group wheel::100:juser[,root,etc] ^-----------------user's login id ( more than one followed by comma) ^---------------------groupid (does not have to be 100) ^----------------------------group name This entry should be in the file somewhere jwomack ========================================================================= - Joe Womack EECS - - CS 495 Consultant - - Washington State University - - Department of Electrical Engeering and Computer Science - - - - Linux: The Way of the Future! DOS: Out the Door! _ ========================================================================= ------------------------------ From: jmorriso@rflab.ee.ubc.ca (John Paul Morrison) Subject: Re: Multiple groups Date: 17 Oct 1993 22:18:32 GMT In article <29ruti$dhb@panix.com>, Scott Drassinower wrote: >Is it possible for me to have a user belong to 2 or more groups under Linux? >I am running SLS 1.03 pl12. If not, will this be considered for future >releases? > yes, it is possible. but the SLS shadow passwd login is broken and doesnt set the user's groups properly when he logs in. poeigl login works out of the box. I had to patch the shadow login to set the groups properly. -- ___________________________________________________________________________ John Paul Morrison | University of British Columbia, Canada | Hey hey!! Ho ho!! Electrical Engineering | Tax & spend liberals jmorriso@rflab.ee.ubc.ca VE7JPM | have got to go!! ________________________________________|__________________________________ ------------------------------ From: byron@cc.gatech.edu (Byron A Jeff) Crossposted-To: comp.os.linux.development,comp.os.linux.help,comp.os.linux.misc Subject: *** Survey Summary of Questions Posted to c.o.l.d and c.o.l.a *** Date: 18 Oct 93 05:17:56 GMT Well if you've been reading any of the linux newsgroups you are aware of the raging debate going on about the quantity and types of questions to the newsgroup comp.os.linux.development. I decided to start asking folks who post questions on c.o.l.d and c.o.l.admin why they put their questions there. I've done this simply by E-mailing a survey question to the original poster and saving the replies. Maybe we can use this info to make some intelligent decisions about how to manage questions in the linux hierarchy. Here is the summary so far. Anonymous of course. I have been indiscriminate of the type of question posted. Every new question that has been posted to c.o.l.d or c.o.l.admin I've send a survey to. This is about 5 days of summaries. I plan to continue my survey and post a cumulative summary every week or so. All followups to this post should go to comp.os.linux.misc so as not to stir up any more traffic in the other groups. I've set the follow to c.o.l.m. Please feel free to comment on the contents of this. I've asked the respondents if they minded an anonymous summary and no one has objected so far. First the survey E-Mail: ========================================================================== Hi, I can't help on your problem. I'm conducting an informal survey. I wanted to know why you posted a question to comp.os.linux.development when the comp.os.linux.help group is specifically for questions? It's no problem to me and no flame to you. I'm just trying to gather info so that I can intelligently respond to folks when they ask me this question. There is a big debate going on in the linux newsgroups over this topic. Also I wanted to know if you objected to an anonymous summary of your answer at some later time. Thanks and waiting for your reply, BAJ ========================================================================== Now here are the answers I got so far. Topic, date and reply only. I've edited as appropriate. My comments are in [brackets]. ========================================================================== Wed Oct 13 13:22:23 1993 Subject: Re: Xconfig! > > > If anyone has Linux configured with the trident 8900c 1meg > >and they have a Microsoft Busmouse working could you please post your > >xconfig. > > Even if you've just got a trident svga 8900c 1meg configured > >properly and have a mouse (any mouse) could you post your xconfig. > > > [ Survey question ] Well I'm new to the Lunix world and have just started to see what the internet can do for you. I thought if I posted my question across all the bases I`d get a faster reply. ========================================================================== Thu Oct 14 03:57:46 1993 Subject: Re: xarchie: UDP > 1024??? > >Hi all, > > > >I've tried to install xarchie, but the problem is that linux seems to > >be not able to handle an udp-port larger thatn 1024 . The testprogramm > >supplied by xarchie (udp.c) gives only an result when invoked as udp > >-d, which means that an port smaller than 1024 is used. > > > >Can someone tell me, how I can enable supprot for higher ports (linux > >0.99.pl13/slackware) > [Survey question] Hi Byron, well before posting this message to *.admin I thought about where to post it. I was not not sure if to post it to *.help or even to *.developement. What made me to post it to *.admin was finally the instructions for installation of xarchie, which said it UDP-ports larger than 1024 arn't support I should contact my local systemadministrator. ========================================================================== Thu Oct 14 11:38:27 1993 Subject: Re: Linux version of "select" > [Survey Question] Comp.os.linux.help is overwhelmed with questions about SLS and other non- programming related topics. Since I'm developing a game which will run on Linux and since the question was specifically releated to a Linux system call, I thought comp.os.linux.development was the right group to post to. > It's no problem to me and no flame to you. No problem. Oh, by the way, I always have my asbest and shrapnel vests on ! Just kidding .. *<8O) ========================================================================== Thu Oct 14 12:16:19 1993 Subject: Re: Has anyone written a Mac FS or Mac FS Access utilities for Linux or 386BSD? I posted it to the .development groups because we are interested in developing such a file system and don't want to duplicate the work of other developers. .help usually deals with completed, or at least released work. ========================================================================== Fri Oct 15 14:13:46 1993 Subject: Re: **** GCC 2.4.5 and Profiling ***** [ In my opinion I think the poster thought I was flaming him. I'm leaving the entire post including the survey question because of this. ] > > Hi, > > I can't help on your problem. I'm conducting an informal survey. I wanted > to know why you posted a question to comp.os.linux.development when the > comp.os.linux.help group is specifically for questions. > > It's no problem to me and no flame to you. I'm just trying to gather info > so that I can intelligently respond to folks when they ask this question. ~~~~~~~~~~~~~ You imply my question to be dump ? > There is a bit debate going on in the newsgroups over this topic. > Hi Byron, I believe I can post for requesting help in c.o.l.d because I have problem with gcc and profiling, and I need profiling to do development under linux. Do you understand the term development only kernel hacking or those who attempt to do that or who already contributed a lot to LINUX, e.g. Linus T. ? The compiler is one of the central part of an OS, maybe my request points out a general problem, a feature leak and so it is of common interest. Due to this it is not only a help request ! Just remember it went fine with gcc 2.3.3. Hope, You means the same thing as I do, with profiling I surely do not mean .profile for bash (actually in discussed in c.o.l.help) but execution profile of a program at runtime, how often a function was called and how much time it consumed. Because you ask me to post to c.o.l.help and in the context of the actual discusion on c.o.l.d (see "Questions are permitted on c.o.l.d") I feel very confused, sad and a bit ill about that what is going on and due to this you receive this flame like reply. BTW, I am the one of many who voted for the c.o.l.* and believe to know where questions should be posted to. Before my posting I already investigate lots of time to find out what are missing, I compliled gcc my self and check every files to find out if I could generate the needed files myself. Hope, You will be aware by judging what should belong to c.o.l.d and what not. Sory, You will receive this email with a bit delay. My own private host is connected via uucp, I use to call out only once a day for emails and news. If you can, your help will be greatly appreciated. ========================================================================== Fri Oct 15 19:50:44 1993 Subject: Re: [Q]: PCMCIA driver for Linux? Ah... Reason for posting to c.o.l.d. Seemed to be the best place to ask on a question about development of hardware... I wasn't too sure about posting it myself, which is why I made it short and simple. ========================================================================== Sun Oct 17 18:00:13 1993 Subject: Re: How Do I make a boot disk? > [Survey deleted] Didn't notice the group .help, and frankly wasn't looking if an admin group exists for a specific OS then I use that because it tends to be the place most of the expertise is. ========================================================================== Sun Oct 17 07:32:22 1993 Subject: Re: Quota os NFS ? > [Survey Deleted] Pure sfortune...I do not know very well quotas or nfs handling, so errounesly I thought that this limitation was caused by the nfs-software of linux not enough advanced. About 15 minutes AFTER I posted the article I discovered that this is in fact normal behaviour and NOT a Linux-problem :( ========================================================================== Sat Oct 16 14:08:11 1993 Subject: Re: Shadow Passwords? > [Survey deleted] Becuase password problems are an administrative issue, are they not? If the .admin group is NOT for administrative concerns, then perhaps it should be rm'd. ========================================================================== Sat Oct 16 11:42:07 1993 Subject: Re: cross-referencing > [Survey deleted] Simply because I was under the impression that development also referred to applications development under Linux. And I was under the impression that the help group was more oriented towards user-type questions, such as network setup, Xwindows setup, etc., etc. ========================================================================== Sat Oct 16 06:08:28 1993 Subject: Re: lost+found cleanup ? > [ Summary deleted ] I thought my question was a pure administration problem - not installation or bug problem. It is sometimes hard to tell apart then one uses c.o.l.misc... :) ========================================================================== Fri Oct 15 21:22:58 1993 Subject: Re: Dos + Linux 2 Controllers > [ Survey deleted] Because, at least to me, this seems like an ADMIN type problem. The Help group would seem to be one where people would ask "how does 'ls' work" or what file do I edit when I want aliases to be recognized upon login? Aren't questions about administration type problems supposed to be asked in an admin group? I don't believe that you will be able to gear all the questions that people will ask to a certain news group just by posting "post only discussion about X here" because possibly people, like me, may not read these messages due to time/work whatever. BTW: Should ALL linux questions go to linux.help? This seems rather unreasonable. ========================================================================== Fri Oct 15 20:13:15 1993 Subject: Re: Is a MAC FS under development? > [ Survey Deleted ] No problem. The reason for this post in c.o.l.d was basically because of topic. This particular group was created for communication on system development issues (kernel, file systems, device drivers, difficult porting, etc). Since this question concerned the development of a particular fs support, I posted it here. Simple enough? :) AS to the c.o.l.h vs c.o.l.h... c.o.l.h is for general help, ie, 'how do I get such and such a program to work?', 'why am I getting this error?', 'how can I make this compile', etc, etc. Any issue that relates to LINUX DEVELOPMENT belongs in here (c.o.linux.development :). There are in fact some questions that may fit into both groups, as they have a fine overlap area. Unlike c.o.l.a there was no condition stating that no questions of any sort would be allowed in c.o.l.d when we voted/split. It is my personal opinion that questions definately contribute to the developmental process, so long as they are appropriate. As to the occasional 'off-topic' posts that end up in c.o.l.d. I just don't read them, or if I do, I respond via email. There is no reason to generate even more garbage in the group. 'off-topic' is not defined (defining it in a weekly post of some sort would be a good idea), and therefore opinions will vary. There will always be a stray post or two (or three, or four), especially with new lnux users every day. There is no reason to discourage these new users with 'flames', or irk your fellow c.o.l.d reader with more off-topic posting. Simply moving off-topic discussion to other c.o.l or private channels will maintain efficiency. ========================================================================== --- Another random extraction from the mental bit stream of... Byron A. Jeff - PhD student operating in parallel! Georgia Tech, Atlanta GA 30332 Internet: byron@cc.gatech.edu ------------------------------ From: wescott@spectrum.cs.bucknell.edu (Jeffrey Wescott) Subject: Re: Laser priter queries Date: 18 Oct 1993 06:09:26 GMT Reply-To: wescott@spectrum.cs.bucknell.edu >>>>> On Fri, 15 Oct 93 11:17:30 GMT, hare@mathi.uni-heidelberg.de (Hannes Reinecke) said: > to 1) Any printer emulating PCL should work with the Laserjet-Driver. > Another possibility is to generate a PostScript-File, and print > it through Ghostscript. try 'gs -h' to get a list of supported > printers. Where can I get this Laserjet Driver? I am currently using a print filter that is just a small C program someone wrote that resets the printer. I have a LaserJet Series II compatible. Any help would be appreciated. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ _/_/_/_/_/ _/ _/ wescott@bucknell.edu _/ _/ _/ Jeffrey Wescott (1995) _/ _/ _/ Computer Science & Engineering _/ _/ _/ _/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ _/ _/ _/_/ _/_/ "Ask not what your country can do for you ... _/_/_/ _/ _/ Ask how much it will cost!" -- Me ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ------------------------------ From: Robert_Broughton@mindlink.bc.ca (Robert Broughton) Subject: QIC-02: HELP! Date: 18 Oct 93 06:18:05 GMT I have an Everex QIC-02 tape drive, and I'm using Linux 0.99pl12. My tape devices are configured like this: crw-r--r-- 2 root root 12, 6 Sep 7 21:08 /dev/tape crw-r--r-- 1 root root 12, 136 Sep 11 01:31 /dev/tape-d crw-r--r-- 1 root root 12, 0 Sep 11 01:32 /dev/tape-nodens crw-r--r-- 1 root root 12, 255 Sep 11 01:31 /dev/tape-reset In the kernel, the drive is set up as IRQ 5, DMA 1, and I/O address 338H. Typing in "mt -f /dev/tape-reset reset" does exactly what it's supposed to do: The tape drive makes some noises, and stops. Any other combinations of -f parameters and commands (for example: "mt -f /dev/tape tell") will result in: Density minor bits have changed. Forcing rewind. Rewinding tape... Drive is dead. Do a `mt reset`. rewind failed in do_qic_cmd(). stat=0xfffffffa Any suggestions? -- *-*-*-*-*-*-*-*-*-*-* Robert Broughton Robert_Broughton@mindlink.bc.ca "We calm and reassure. We embrace people with the message that we're all in it together. That our leaders are infallible and that there is nothing, absolutely nothing wrong." - Miles Drentell, _thirtysomething_ ------------------------------ Crossposted-To: comp.unix.admin,comp.sys.sun.admin,comp.sys.sgi.admin,comp.admin.policy From: mosedale@aeffle.Stanford.EDU (Dan Mosedale) Subject: UNIX sysadmin FAQ- proposal and volunteer Date: Mon, 18 Oct 93 06:49:38 GMT I'd like to volunteer to keep a general UNIX system administration FAQ. There are many resources and FAQs available for the UNIX system admin, but I have yet to see a good document addressing most of the relevant issues in one place. One would would need extensive experience to see the many interdependencies (eg NTP helps ensure NFS consistency which can improve the reliability of mail-delivery). There are, of course, some good books available. However, the ones that I've looked at omit many tips & topics that are especially useful and/or necessary to heterogeneous, Internet-connected sites. Furthermore, they typically don't document the many (freely and commercially) available tools that can be invaluable to a system manager. Since some of these issues have detailed FAQs of their own (eg MIME, security), I would just mention them briefly with a pointer to the other FAQs. Others would be addressed in more detail. I'd like to know if people feel this would be a worthwhile thing to have posted regularly. If I get positive feedback that this would be useful to the community, I'll go ahead and come up with a rough draft based on what I've got here and post it in the near future for editing. Here is my initial proposal for stuff to be addressed. I'd also appreciate input on issues or tools that I've forgotten or only partially covered. ACCOUNT MAINTENANCE: - acmaint - Project Athena POLICY: - short policy blurb - CAF policy archives SECURITY: - get and read the comp.security.misc FAQ - how to properly close an account - US Dept. of Justice recommended monitoring banner - PEM (RIPEM, TIS/PEM), PGP SOFTWARE PACKAGE MANAGEMENT - /usr/local - Modules - depot (CMU) - depot (NIST) - LUDE - AFS, DCE/DFS, DME DISTRIBUTED FILE MANAGEMENT: - track, rdist and fdist - NIS / YP and NIS+: pros and cons NETWORKING: - Mapping (tkined / scotty, ... ) - Monitoring (netman, SNMP, sun-net manager, ...) - Debugging (traceroute, tcpdump, nfswatch, ... ) MISC. SERVICES: - PCNFSD - Appletalk (CAP, ...) - Anonymous FTP (wustl ftpd, IAFA, archie) - Gopher, Wais, WWW - Removable media (mtools, non-root mount/umount) DOCUMENTING YOUR SYSTEM: - logbooks - documentation for the user (TeXinfo, HTML, ...) BACKUPS: - Commercial products (Legato, BudTool, ??? ) - OSU backup scripts - Amanda - dump, restore, GNU tar, cpio etc. MAIL: - Mounting /var/spool/mail via NFS - why & why not - how to: * single MTA, MDA * "hard, noac" * see NFS section about NTP & lockd patches - A few good MTAs (IDA sendmail, Smail, sendmail 8.x) - Alternate MDAs (procmail, delivermail) - related FAQ lists (email packages, email addresses, inter netwk mail guide) - POP2, POP3, IMAP2bis - Pine & Z-mail: mail for the UNIX newbie - MIME NFS: - NTP time synchronization. - Why shouldn't I mount filesystems in the root directory? - Automounters: automount and amd - latest lockd patches COOL PACKAGES to make your life easier - Perl for handy system scripts - Tcl/Tk for whipping up nifty GUI tools for your users - tchrist's Perl man - gcc, ghostscript/ghostview, and other GNU utilities - swatch and watcher - tcsh (and bash, zsh, pdksh...and /etc/shells) - sudo MISC. QUIRKS: - Ultrix (and others?) FFS block size can't be larger than 8192, even if you rebuild the kernel with a bigger MAXBSIZE - SunOS (and others?) executable scripts (ie starting with #!) only consider the first 32 chrs significant. SPECIFIC SYSTEMS: - other newsgroups comp.sys.{sun,sgi,ibm,...}.* - other FAQ's (ultrix, OSF, sun-managers, comp.sys.sun.admin, comp.sys.sun.hardware, comp.sys.sgi.admin, comp.answers, ...) - mailing lists (sun-managers, dec-managers, osf-managers...) OTHER RESOURCES: - USENIX, SAGE, and LISA - Other FAQs (guide to unix books, internet services ... ) - RFCs - Books (sysadmin ones), mags, and trade rags - internic.net - Other newsgroups and mailing lists - A few good ftp sites ( ftp.uu.net, archive.cis.ohio-state.edu, gatekeeper.dec.com, ftp.x.org, nic.funet.fi, rtfm.mit.edu, harbor.ecn.purdue.edu ) GLOSSARY & ACRONYM DICTIONARY: - ANSI - CCITT - EFF - IEEE - ISO - POSIX - SNMP - TLA -- Dan Mosedale, Systems Admin Email: mosedale@genome.Stanford.EDU Stanford Genetics Department ------------------------------ ** FOR YOUR REFERENCE ** The service address, to which questions about the list itself and requests to be added to or deleted from it should be directed, is: Internet: Linux-Admin-Request@NEWS-DIGESTS.MIT.EDU You can send mail to the entire list (and comp.os.linux.admin) via: Internet: Linux-Admin@NEWS-DIGESTS.MIT.EDU Linux may be obtained via one of these FTP sites: nic.funet.fi pub/OS/Linux tsx-11.mit.edu pub/linux sunsite.unc.edu pub/Linux End of Linux-Admin Digest ******************************