
greg at mdntridr
Mar 21, 2005, 7:04 PM
Post #1 of 1
(335 views)
Permalink
|
gentoo-security+help [at] robin wrote: > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] Password handling of a system with many > administrators > From: > Paul de Vrieze <pauldv [at] gentoo> > Date: > Thu, 17 Mar 2005 12:49:51 +0100 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > >On Friday 11 March 2005 18:02, Barry.Schwartz [at] chemoelectric wrote: > > >>With sudo, you are making it so password sniffing sufficient to gain >>ordinary user access is also sufficient to give root access. I think >>the password for sudo access should be a distinct passphrase used only >>for that. This the main reason I quit using sudo. >> >> > >As far as I know, sudo uses pam for authentication. You could configure >the pam service for sudo to use different passwords than the login >passwords. > >Paul > > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] Password handling of a system with many > administrators > From: > Mike Frysinger <vapier [at] gentoo> > Date: > Thu, 17 Mar 2005 08:43:46 -0500 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > >On Thursday 17 March 2005 06:49 am, Paul de Vrieze wrote: > > >>As far as I know, sudo uses pam for authentication. You could configure >>the pam service for sudo to use different passwords than the login >>passwords. >> >> > >sudo *can* use pam (and does in the default Gentoo setup with USE=pam), but it >doesnt require it >-mike >-- >gentoo-security [at] gentoo mailing list > > > > ------------------------------------------------------------------------ > > Subject: > [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Rui Covelo <rpfc [at] mega> > Date: > Sat, 19 Mar 2005 11:15:06 +0000 > To: > gentoo-security [at] lists > > To: > gentoo-security [at] lists > > > Hi! > > Inspired by this article (http://www.securityfocus.com/bid/12298) at > security focus, I was wondering what can be done to protect our gentoo > machine against forkbombs or similar problems. > > What is the best way to protect our system against this? > > Do you think this kind of problems are important when were talking > about our desktop box or only in big system with many users? > > > BTW, I tried a fork bomb on my gentoo desktop box. Couldn't even log > in as root to stop it. :\ > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Markus Dittrich <markusle [at] gmail> > Date: > Sat, 19 Mar 2005 05:37:18 -0600 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > >On Sat, 19 Mar 2005 11:15:06 +0000, Rui Covelo <rpfc [at] mega> wrote: > > >>Hi! >> >>Inspired by this article (http://www.securityfocus.com/bid/12298) at >>security focus, I was wondering what can be done to protect our gentoo >>machine against forkbombs or similar problems. >> >>What is the best way to protect our system against this? >> >>Do you think this kind of problems are important when were talking about >>our desktop box or only in big system with many users? >> >>BTW, I tried a fork bomb on my gentoo desktop box. Couldn't even log in >>as root to stop it. :\ >> >>-- >> >> > >Hi Rui, > >To protect against this kind of attack you should put the appropriate limits >into /etc/security/limits.conf. E.g. > >* soft nproc 100 >* hard nproc 150 > >will prevent the spawning of more than 150 processes per user and thereby >limit the impact of forkbomb attacks. Personally, I think it would be a good >idea to have some sane default values in this file. If somebody really needs >more processes, open files, etc. they can always up them. > >cheers, >Markus >-- >gentoo-security [at] gentoo mailing list > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Sven Wegener <swegener [at] gentoo> > Date: > Sat, 19 Mar 2005 12:55:14 +0100 > To: > gentoo-security [at] gentoo > > To: > gentoo-security [at] gentoo > CC: > gentoo-security [at] robin > > >On Sat, Mar 19, 2005 at 05:37:18AM -0600, Markus Dittrich wrote: > > >>To protect against this kind of attack you should put the appropriate limits >>into /etc/security/limits.conf. E.g. >> >>* soft nproc 100 >>* hard nproc 150 >> >>will prevent the spawning of more than 150 processes per user and thereby >>limit the impact of forkbomb attacks. Personally, I think it would be a good >>idea to have some sane default values in this file. If somebody really needs >>more processes, open files, etc. they can always up them. >> >> > >See http://bugs.gentoo.org/show_bug.cgi?id=85656 for discussion and >progress on integrating sane defaults into Gentoo's limits.conf. > > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Sven Wegener <swegener [at] gentoo> > Date: > Sat, 19 Mar 2005 12:55:14 +0100 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > CC: > gentoo-security [at] robin > > >On Sat, Mar 19, 2005 at 05:37:18AM -0600, Markus Dittrich wrote: > > >>To protect against this kind of attack you should put the appropriate limits >>into /etc/security/limits.conf. E.g. >> >>* soft nproc 100 >>* hard nproc 150 >> >>will prevent the spawning of more than 150 processes per user and thereby >>limit the impact of forkbomb attacks. Personally, I think it would be a good >>idea to have some sane default values in this file. If somebody really needs >>more processes, open files, etc. they can always up them. >> >> > >See http://bugs.gentoo.org/show_bug.cgi?id=85656 for discussion and >progress on integrating sane defaults into Gentoo's limits.conf. > > > > > ------------------------------------------------------------------------ > > Subject: > [gentoo-security] Interesting syslog entries. > From: > Emre Saglam <emre [at] emresaglam> > Date: > Sat, 19 Mar 2005 13:41:34 -0500 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > > Hi all, > > I just wanted to get your opinions on finding some interesting syslog > entries to capture with swatch or similar log analyser programs. Is > there a common knowledge base on this subject? (discussion list, > forums). I already analyse things like root password changes,switch to > promiscous mode, etc... What areyou guys looking for in your logs? > > Thanks! :) > Emre > -- > gentoo-security [at] gentoo mailing list > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] Interesting syslog entries. > From: > "Joey McCoy" <ixion [at] cfl> > Date: > Sat, 19 Mar 2005 14:03:35 -0500 (EST) > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > CC: > gentoo-security [at] robin > > >I personally use Logwatch and pay attention to disk free space, and more >importantly ssh/login attempts/failures/successes. I haven't looked too >much into adding custom entries in Logwatch, but I think I might look into >the GRSecurity logging extensions as well. I would definitely consider >paying attention to any externally accessible services being analyzed >(apache, mysql, etc). :) > >HTH > >cheers! > > > >>Hi all, >> >>I just wanted to get your opinions on finding some interesting syslog >>entries to capture with swatch or similar log analyser programs. Is >>there a common knowledge base on this subject? (discussion list, >>forums). I already analyse things like root password changes,switch to >>promiscous mode, etc... What areyou guys looking for in your logs? >> >>Thanks! :) >>Emre >>-- >>gentoo-security [at] gentoo mailing list >> >> >> >> > > >-- >gentoo-security [at] gentoo mailing list > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] Interesting syslog entries. > From: > "Joey McCoy" <ixion [at] cfl> > Date: > Sat, 19 Mar 2005 14:03:35 -0500 (EST) > To: > gentoo-security [at] gentoo > > To: > gentoo-security [at] gentoo > CC: > gentoo-security [at] robin > > >I personally use Logwatch and pay attention to disk free space, and more >importantly ssh/login attempts/failures/successes. I haven't looked too >much into adding custom entries in Logwatch, but I think I might look into >the GRSecurity logging extensions as well. I would definitely consider >paying attention to any externally accessible services being analyzed >(apache, mysql, etc). :) > >HTH > >cheers! > > > >>Hi all, >> >>I just wanted to get your opinions on finding some interesting syslog >>entries to capture with swatch or similar log analyser programs. Is >>there a common knowledge base on this subject? (discussion list, >>forums). I already analyse things like root password changes,switch to >>promiscous mode, etc... What areyou guys looking for in your logs? >> >>Thanks! :) >>Emre >>-- >>gentoo-security [at] gentoo mailing list >> >> >> >> > > >-- >gentoo-security [at] gentoo mailing list > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Rui Covelo <rpfc [at] mega> > Date: > Sun, 20 Mar 2005 21:26:29 +0000 > To: > gentoo-security [at] gentoo > > To: > gentoo-security [at] gentoo > CC: > Markus Dittrich <markusle [at] gmail>, gentoo-security [at] robin > > >>Hi Rui, >> >>To protect against this kind of attack you should put the appropriate >>limits into /etc/security/limits.conf. E.g. >> >> >> >(...) > > >>cheers, >>Markus >> >> > >Nice! Didn't know about that file. That's a start. Thanks! ;) > > > > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Rui Covelo <rpfc [at] mega> > Date: > Sun, 20 Mar 2005 21:26:29 +0000 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > CC: > Markus Dittrich <markusle [at] gmail>, gentoo-security [at] robin > > >>Hi Rui, >> >>To protect against this kind of attack you should put the appropriate >>limits into /etc/security/limits.conf. E.g. >> >> >> >(...) > > >>cheers, >>Markus >> >> > >Nice! Didn't know about that file. That's a start. Thanks! ;) > > > > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Calum <gentoo-security [at] umtstrial> > Date: > Sun, 20 Mar 2005 23:10:59 +0000 > To: > gentoo-security [at] gentoo > > To: > gentoo-security [at] gentoo > CC: > gentoo-security [at] robin, Markus Dittrich <markusle [at] gmail> > > >On Sun, Mar 20, 2005 at 09:26:29PM +0000, Rui Covelo wrote: > > >>>Hi Rui, >>> >>>To protect against this kind of attack you should put the appropriate >>>limits into /etc/security/limits.conf. E.g. >>> >>> >>> >>(...) >> >> >>>cheers, >>>Markus >>> >>> >>Nice! Didn't know about that file. That's a start. Thanks! ;) >> >> >> > >Anyone else getting two copies of each message? > >Calum >-- >gentoo-security [at] gentoo mailing list > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Calum <gentoo-security [at] umtstrial> > Date: > Sun, 20 Mar 2005 23:10:59 +0000 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > CC: > gentoo-security [at] robin, Markus Dittrich <markusle [at] gmail> > > >On Sun, Mar 20, 2005 at 09:26:29PM +0000, Rui Covelo wrote: > > >>>Hi Rui, >>> >>>To protect against this kind of attack you should put the appropriate >>>limits into /etc/security/limits.conf. E.g. >>> >>> >>> >>(...) >> >> >>>cheers, >>>Markus >>> >>> >>Nice! Didn't know about that file. That's a start. Thanks! ;) >> >> >> > >Anyone else getting two copies of each message? > >Calum >-- >gentoo-security [at] gentoo mailing list > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Andrew Ross <aross [at] whitley> > Date: > Mon, 21 Mar 2005 10:26:01 +1100 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > >On Sun, 2005-03-20 at 23:10 +0000, Calum wrote: > > >>On Sun, Mar 20, 2005 at 09:26:29PM +0000, Rui Covelo wrote: >> >> >>>>Hi Rui, >>>> >>>>To protect against this kind of attack you should put the appropriate >>>>limits into /etc/security/limits.conf. E.g. >>>> >>>> >>>> >>>(...) >>> >>> >>>>cheers, >>>>Markus >>>> >>>> >>>Nice! Didn't know about that file. That's a start. Thanks! ;) >>> >>> >>> >>Anyone else getting two copies of each message? >> >> > >Yes. > >Cheers > > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > "Brian G. Peterson" <brian [at] braverock> > Date: > Sun, 20 Mar 2005 17:31:31 -0600 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > >On Sunday 20 March 2005 05:10 pm, Calum wrote: > > >>Anyone else getting two copies of each message? >> >> > >The mailing list address is in both the To: and the CC: for this thread. >quite annoying. > >Regards, > > - Brian >-- >gentoo-security [at] gentoo mailing list > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Andrew Ross <aross [at] whitley> > Date: > Mon, 21 Mar 2005 10:33:30 +1100 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > >On Mon, 2005-03-21 at 10:26 +1100, Andrew Ross wrote: > > >>On Sun, 2005-03-20 at 23:10 +0000, Calum wrote: >> >> >>>On Sun, Mar 20, 2005 at 09:26:29PM +0000, Rui Covelo wrote: >>> >>> >>>>>Hi Rui, >>>>> >>>>>To protect against this kind of attack you should put the appropriate >>>>>limits into /etc/security/limits.conf. E.g. >>>>> >>>>> >>>>> >>>>(...) >>>> >>>> >>>>>cheers, >>>>>Markus >>>>> >>>>> >>>>Nice! Didn't know about that file. That's a start. Thanks! ;) >>>> >>>> >>>> >>>Anyone else getting two copies of each message? >>> >>> >>Yes. >> >> > >but only when the sender includes gentoo-security in both the To and CC >fields. > >Cheers > > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Pedro Venda <pjlv [at] mega> > Date: > Mon, 21 Mar 2005 01:14:05 +0000 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Markus Dittrich wrote: > | On Sat, 19 Mar 2005 11:15:06 +0000, Rui Covelo > <rpfc [at] mega> wrote: > | > |>Hi! > |> > |>Inspired by this article (http://www.securityfocus.com/bid/12298) at > |>security focus, I was wondering what can be done to protect our gentoo > |>machine against forkbombs or similar problems. > |> > |>What is the best way to protect our system against this? > |> > |>Do you think this kind of problems are important when were talking > about > |>our desktop box or only in big system with many users? > |> > |>BTW, I tried a fork bomb on my gentoo desktop box. Couldn't even log in > |>as root to stop it. :\ > |> > |>-- > | > | > | Hi Rui, > | > | To protect against this kind of attack you should put the > appropriate limits > | into /etc/security/limits.conf. E.g. > | > | * soft nproc 100 > | * hard nproc 150 > | > | will prevent the spawning of more than 150 processes per user and > thereby > | limit the impact of forkbomb attacks. Personally, I think it would > be a good > | idea to have some sane default values in this file. If somebody > really needs > | more processes, open files, etc. they can always up them. > > but who (what process(es) look into those files? init? login? pam > plugins? > the kernel (hardly, I guess)? > > where are the hooks to implement such limits? > > regards, > pedro venda. > - -- > > Pedro Joćo Lopes Venda > email: pjlv < at > mega.ist.utl.pt > http://arrakis.dhis.org > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.6 (GNU/Linux) > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org > > iD8DBQFCPh/deRy7HWZxjWERAuYbAKCvPbBqisjJ761NKhscAaO8AbeYJgCfbj7m > N8kS5OsMRcRRcL94fqhG6ys= > =ooZ3 > -----END PGP SIGNATURE----- > > -- > gentoo-security [at] gentoo mailing list > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] protecting agains forkbombs (and similar problems) > From: > Pedro Venda <pjlv [at] mega> > Date: > Mon, 21 Mar 2005 01:14:45 +0000 > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > CC: > Markus Dittrich <markusle [at] gmail> > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Calum wrote: > | On Sun, Mar 20, 2005 at 09:26:29PM +0000, Rui Covelo wrote: > | > |>>Hi Rui, > |>> > |>>To protect against this kind of attack you should put the appropriate > |>>limits into /etc/security/limits.conf. E.g. > |>> > |> > |>(...) > |> > |>>cheers, > |>>Markus > |> > |>Nice! Didn't know about that file. That's a start. Thanks! ;) > |> > | > | > | Anyone else getting two copies of each message? > > yes. > > regards, > pedro venda. > - -- > > Pedro Joćo Lopes Venda > email: pjlv < at > mega.ist.utl.pt > http://arrakis.dhis.org > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.6 (GNU/Linux) > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org > > iD8DBQFCPiAFeRy7HWZxjWERApqfAJ9kemUl88XKJjg/AysdE1JNXlkqfQCfbaH2 > YJ44mtDjyQVSF6a/HbZD/VY= > =8j7f > -----END PGP SIGNATURE----- > > -- > gentoo-security [at] gentoo mailing list > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] Interesting syslog entries. > From: > "Joerg Mertin" <smurphy [at] solsys> > Date: > Mon, 21 Mar 2005 09:34:07 +0100 (CET) > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > ><quote who="Joey McCoy"> > > >>I personally use Logwatch and pay attention to disk free space, and more >>importantly ssh/login attempts/failures/successes. I haven't looked too >>much into adding custom entries in Logwatch, but I think I might look into >>the GRSecurity logging extensions as well. I would definitely consider >>paying attention to any externally accessible services being analyzed >>(apache, mysql, etc). :) >> >> > >I do more or less the same - but graphs say more than 1000words - so I >wrote some little extensions to phpWebSite to actually show me some data >on what is going on on my systems. Disk-Usage, CPU-Loads, >Login-Attempts/Failures, Detected Viruses, SMTP-Connections, passed mails, >detected Spam/Rejected Spam etc. Check it out on my >webpage:http://www.solsys.org/mod.php?mod=systat&op=disp_ind&host_id=1 > >Cheers > >Joerg > > > >>HTH >> >>cheers! >> >> >> >>>Hi all, >>> >>>I just wanted to get your opinions on finding some interesting syslog >>>entries to capture with swatch or similar log analyser programs. Is >>>there a common knowledge base on this subject? (discussion list, >>>forums). I already analyse things like root password changes,switch to >>>promiscous mode, etc... What areyou guys looking for in your logs? >>> >>>Thanks! :) >>>Emre >>>-- >>>gentoo-security [at] gentoo mailing list >>> >>> >>> >>> >>-- >>gentoo-security [at] gentoo mailing list >> >> >> >> > > > > > > ------------------------------------------------------------------------ > > Subject: > Re: [gentoo-security] Interesting syslog entries. > From: > "Joey McCoy" <ixion [at] cfl> > Date: > Mon, 21 Mar 2005 06:40:02 -0500 (EST) > To: > gentoo-security [at] robin > > To: > gentoo-security [at] robin > > >Hey very nicely done! Quite impressive! :) > > > > >><quote who="Joey McCoy"> >> >> >>>I personally use Logwatch and pay attention to disk free space, and more >>>importantly ssh/login attempts/failures/successes. I haven't looked too >>>much into adding custom entries in Logwatch, but I think I might look >>>into >>>the GRSecurity logging extensions as well. I would definitely consider >>>paying attention to any externally accessible services being analyzed >>>(apache, mysql, etc). :) >>> >>> >>I do more or less the same - but graphs say more than 1000words - so I >>wrote some little extensions to phpWebSite to actually show me some data >>on what is going on on my systems. Disk-Usage, CPU-Loads, >>Login-Attempts/Failures, Detected Viruses, SMTP-Connections, passed mails, >>detected Spam/Rejected Spam etc. Check it out on my >>webpage:http://www.solsys.org/mod.php?mod=systat&op=disp_ind&host_id=1 >> >>Cheers >> >>Joerg >> >> >> >>>HTH >>> >>>cheers! >>> >>> >>> >>>>Hi all, >>>> >>>>I just wanted to get your opinions on finding some interesting syslog >>>>entries to capture with swatch or similar log analyser programs. Is >>>>there a common knowledge base on this subject? (discussion list, >>>>forums). I already analyse things like root password changes,switch to >>>>promiscous mode, etc... What areyou guys looking for in your logs? >>>> >>>>Thanks! :) >>>>Emre >>>>-- >>>>gentoo-security [at] gentoo mailing list >>>> >>>> >>>> >>>> >>>-- >>>gentoo-security [at] gentoo mailing list >>> >>> >>> >>> >>-- >>------------------------------------------------------------------------ >>| Joerg Mertin : smurphy [at] solsys (Home)| >>| in Forchheim/Germany : smurphy [at] linux (Alt1)| >>| Stardust's LiNUX System : | >>| Web: http://www.solsys.org | >>------------------------------------------------------------------------ >>PGP Fingerprint: AF0F FB75 997B 025F 4538 5AD6 9888 5D97 170B 8B7A >> >> >> >>-- >>gentoo-security [at] gentoo mailing list >> >> >> >> > > >-- >gentoo-security [at] gentoo mailing list > > -- gentoo-security [at] gentoo mailing list
|