Chris Paquin

AI, Virtualization, Containers, Infrastructure, Linux

Category: Linux

  • Yum: Under the Covers with GPG Keys

    Skeleton_key_1_keychain_sculpture_photo_cut_outs-r558fef9b275d4609b522ac07970a6af6_x7sa6_8byvr_324Hey look at this spooky key. Don't be frightened little one. Nothing scary is going to happen to you here. This is a safe place. As a matter of fact, if you stick around you might just learn a thing or two. A thing or two about GPG!

    First off do any of us really know what GPG stands for? Well yes we do! It stands for GNU Privacy Guard. RPM Package creators use GPG to apply a digital signature to their packages. If a package was tampered with, then its GPG signature will no longer match what was placed in the original package.

    First off to check what keys you have installed on your Linux server you can run the following rpm command as show in the example below.

    [root@ip-172-31-22-45 ~]# rpm -qa gpg-pubkey
    gpg-pubkey-0608b895-4bd22942
    gpg-pubkey-fd431d51-4ae0493b
    gpg-pubkey-2fa658e0-45700c69

     

    Neet I have three keys installed. But lets say want to install another one. Well I can do so with the command below. In this example I have navigated to /etc/pki/rpm-gpg and am going to install the redhat beta key on my server.

    [root@ip-172-31-22-45 rpm-gpg]# rpm –import RPM-GPG-KEY-redhat-beta

    Hey that was fun. Now lets get our hands a bit dirtier.

    Want to get more information on a specific key. Then this command is your huckleberry. Here you can see that this is the pubkey for the EPEL repo.

    [root@ip-172-31-22-45 rpm-gpg]# rpm -qi gpg-pubkey-0608b895-4bd22942
    Name        : gpg-pubkey                   Relocations: (not relocatable)
    Version     : 0608b895                          Vendor: (none)
    Release     : 4bd22942                      Build Date: Sat 14 Jun 2014 09:13:58 AM EDT
    Install Date: Sat 14 Jun 2014 09:13:58 AM EDT      Build Host: localhost
    Group       : Public Keys                   Source RPM: (none)
    Size        : 0                                License: pubkey
    Signature   : (none)
    Summary     : gpg(EPEL (6) <epel@fedoraproject.org>)
    Description :

     

    To verify signature of a downloaded package, use the rpm command as shown below. In this example I have highlighted the key that was used to sign this package.

    # rpm -vK nautilus-dropbox-1.6.0-1.fedora.i386.rpm
    nautilus-dropbox-1.6.0-1.fedora.i386.rpm:
        Header V3 RSA/SHA1 Signature, key ID 5044912e: OK
        Header SHA1 digest: OK (a4d51906633f92913db075ba33946f50999c245e)
        V3 RSA/SHA1 Signature, key ID 5044912e: OK
        MD5 digest: OK (1b8ff7abc18f68bf274e24fc57fd3a87)

     

    Using the bolded information in the example above, I can then use this information to track down the exact key that was used to sign the package.

    [root@localhost Downloads]# rpm -qa | grep 5044912e
    gpg-pubkey-5044912e-4b7489b1

     

    Is this awesome, well not really, but you never know when you might need to use this information. Like on a test. Wink Wink.
    Related articles

    Using Yum Update to Apply Security Patches Only
    How to Enable EPEL Repository on CentOs for Yum
    Signing rpm packages with GPG

  • RPM Package Inspection for Fun and Profit

    6a00d8341c562c53ef01538f8abd65970b-800wi"Whats in the box" — David Mills

    Lets face it, one of your users needs to have a package installed on a system, you tend to do it for them. That is, as long as the package looks safe. Sure, your not going to install an rpm that is clearly dangerous, but as long as the package name looks reasonable and you trust the user, you might actually just go ahead an install it for them without thinking much about it. Hell, I know that I have done the exact same thing from time to time. And I have done it with an unsigned package.

    "Sure you need this Oracle thing installed on this database server?"

     "You got it directly from Oracle right?"

    But honestly, this is a very bad practice as you have no idea what the RPM is installing, and what its pre and post scripts might be doing to your system. Using the command below, you can inspect a packages post and pre install scripts to see if they are doing anything funny. In this instance I am taking a look at the dropbox package for my little Eeepc.

    [root@localhost ~]# rpm -qp –scripts /root/Downloads/nautilus-dropbox-1.6.0-1.fedora.i386.rpm

    If you have already installed a package and want to see what its pre and post install scripts did. You can run the command above using the installed package name. Note that you will drop the "P" from the command. See my sendmail example below.

    [root@localhost ~]#rpm -q –scripts sendmail-8.14.8-2.fc20.i686

     

    In addition to checking the pre and post scripts, you also want to check to see if the rpm has any triggers. What are triggers you ask? Well they are extensions to the normal install scripts, and they may often call for the installation of another package or the execution of a command. Just look at all the triggers that fire when you install sendmail.

    [root@localhost ~]# rpm -q –triggers sendmail-8.14.8-2.fc20.i686
    triggerun scriptlet (using /bin/sh) — sendmail < 8.14.5-3
    /usr/bin/systemd-sysv-convert –save sendmail >/dev/null 2>&1 ||:
    /bin/systemctl enable sendmail.service >/dev/null 2>&1
    /bin/systemctl enable sm-client.service >/dev/null 2>&1
    /sbin/chkconfig –del sendmail >/dev/null 2>&1 || :
    /bin/systemctl try-restart sendmail.service >/dev/null 2>&1 || :
    /bin/systemctl try-restart sm-client.service >/dev/null 2>&1 || :
    # workaround for systemd rhbz#738022
    /bin/systemctl is-active sendmail.service >/dev/null 2>&1 && \
            ! /bin/systemctl is-active sm-client.service >/dev/null 2>&1 && \
            /bin/systemctl start sm-client.service >/dev/null 2>&1 || :

    Obviously you also want to check to see what files are actually part of a package. This can be accomplished with the query and list arguments seen below. Add the "P" argument if the rpm is not already installed. In this case I have already installed sendmail, so I exclude the "P" from the command.

     

    [root@localhost ~]# rpm -ql sendmail-8.14.8-2.fc20.i686
    /etc/NetworkManager/dispatcher.d/10-sendmail
    /etc/mail
    /etc/mail/Makefile
    /etc/mail/access
    /etc/mail/access.db
    /etc/mail/aliasesdb-stamp
    /etc/mail/domaintable
    /etc/mail/domaintable.db
    /etc/mail/helpfile
    /etc/mail/local-host-names
    ..truncated…

     

    So whats the moral of the story here. Well its really not that hard to take a minute and look under the covers and make sure that the packages that you are installing are not harming your systems. Is definetly worth 5 minutes of your time. Might just save your behind.

     
    Related articles

    RHEL6 – Simple Postfix Configuration
    RHEL6 – Common Postfix Server Roles
    Configure sendmail as a client for SMTPs
    Sendmail Server

  • Quick and Dirty Yum Security Plugin Overview

    Maneki-neko-mountain-tummy-13745890The YUM security plugin is a package that allows you to search specifically for security patches applicable to a Redhat/Centos server.  This functionality comes in very handy when having to cross reference CVEs to Redhat Security Advisories (RHSAs). If you work closely with anyone in an information security role, you already know how vital functionality is.

    Before you can begin you need to make sure that you have the plugin installed.  Use the command below to install it.

    # yum -y install yum-plugin-security

     

    Then you can use the plugin to get a overview of the security updates availible for your system.

    # yum updateinfo
        
    Updates Information Summary: available
    3 Security notice(s)
             1 Important Security notice(s)
             2 Moderate Security notice(s)
    12 Bugfix notice(s)
    1 Enhancement notice(s)

     

    You can get a specific list of updates, sorted by security advisories, bug fixes, and enhancement advisories.

    # yum updateinfo list

     

    To get more specific information on a RHSA and the CVEs that it applies to, you can search by RHSA as seen below.

    # yum updateinfo RHSA-2014:0771

     

    Need to see what patches are required to address a certain CVE, then this next command is for you. Trust me this one is useful as it gives you a list of all required packages that address that CVE.

    # yum updateinfo list –cve=CVE-2013-6378
    Loaded plugins: amazon-id, rhui-lb, security
    RHSA-2014:0771 Important/Sec. kernel-2.6.32-431.20.3.el6.x86_64
    RHSA-2014:0771 Important/Sec. kernel-firmware-2.6.32-431.20.3.el6.noarch
    RHSA-2014:0771 Important/Sec. kernel-headers-2.6.32-431.20.3.el6.x86_64
    RHSA-2014:0771 Important/Sec. perf-2.6.32-431.20.3.el6.x86_64

     

    Want to see a list of all fixes by severity. Then you can use the command below. Note that I am using important as my severity as there are no critical updates that are applicable to my test system at this time.

    yum updateinfo list –sec-severity=Important
    RHSA-2014:0771 Important/Sec. kernel-2.6.32-431.20.3.el6.x86_64
    RHSA-2014:0771 Important/Sec. kernel-firmware-2.6.32-431.20.3.el6.noarch
    RHSA-2014:0771 Important/Sec. kernel-headers-2.6.32-431.20.3.el6.x86_64
    RHSA-2014:0771 Important/Sec. perf-2.6.32-431.20.3.el6.x86_64

     

    You can also search for security fixes by package name as shown below.

    # yum updateinfo list kernel
    RHSA-2014:0771 Important/Sec. kernel-2.6.32-431.20.3.el6.x86_64

     

    You can also use YUM to apply only security related updates. See below. This is useful if you are in a pinch and need to quickly apply all security updates to make your Infosec Team happy.

    # yum –security update

    Related articles

    Using Yum Update to Apply Security Patches Only
    SCAP CVE Audit
    YFD plugin updated

  • What the Heck is a Linux Container, and Who the Hell is Docker?

    Docker-whaleA Linux Container is an Operating System level virtualization method for running isolated Linux environments on a single base install of Linux. Linux containers are not virtual machines, rather they are isolated virtual environments with dedicated CPU, memory, I/O, and network. One can think of a Linux Container as a light, virtual OS instance. At first glance one hearkens back to the time of Solaris Containers, but there is a lot more going on here then first meets the eye, especially when we throw Docker in the mix.

     

    But first, lets focus on Linux Containers…

     

    The technologies behind Linux Containers are Control Groups and Name Spaces. Control Groups manage and monitor resource allocation for processes and process groups such as CPU, Memory, and I/O. Name Spaces help isolate processes, in something akin to a chrooted environment, making processes running within them invisible to other processes in other Name Spaces.

     

    So why would you possibly want to run a Linux Container?

     

    Well for one you can consolidate multiple Linux servers into one Machine, therefor reducing the number of management points in your environment. Instead of having to patch 6 Virtual Machines, you now only have to patch one.

     

    Linux Containers can also be used to quickly spin up sandbox environments for development and testing so that you no longer need to spin up a new VM for each individual project. As we all know, this is how we end up with Virtual Sprawl. You create someone a Virtual Machine, with the intention of reclaiming it after a short period of time and all of a sudden that Virtual Machine becomes a permanent fixture in your environment. In the case of Linux Containers, you just tear down the instance and toss it away.

     

    Also, Linux Containers can be used to allow you to run multiple instances of the same application in parallel. Think of Apache virtual servers, running separately, independent and isolated from each other. Each with its own dedicated CPU, Memory, and I/O, and never stepping on each others toes.

     

    Linux Containers also provide an added layer of security. Just because a Container on a server is compromised, it does not mean that any other local Containers, or the base system itself is compromised in the least.

     

    Finally Linux Containers are efficient. First and foremost, they boot faster than traditional Virtual Machines. They also offer better performance over Virtual Machines as there is no hardware abstraction layer in the form of a hypervisor.

     

    So what is Docker then, you ask? Docker is an open source project that streamlines the deployment of an application (or OS) inside a Linux Container. Its designed to make the creation and management of Linux Containers simple as Docker can create and share disk images with ease.

     

    Here are just a few of the images available from the Docker Hub.

    • Apache CouchDB

    • PostgreSQL

    • Memcached

    • Mongo DB

    • NGINX

    • Mysql

    • WordPress

    • Centos

    • Ubuntu

    Whats amazing is that any dockerized image can run on any machine that is running docker. Imagine an Ubuntu docker image running on Centos. Weird huh?

     

    Have yourself a perfect OS image for your in-house java app? How about you dockerize that and use Docker as a revision control system for your application/OS. Sounds interesting, doesn't it.

     

    I have heard it said that Docker is not just Platform as a Service (PAAS) , its possibly could be much more than that. Right now Docker only works with Linux Containers, but imagine if it worked with KVM or Xen.

     

    Not sure about you but I look forward to getting deploy it in my lab.

    Related articles

    libswarm – Docker Orchestration Announced
    Docker 1.0 Provides Enterprise Support for Container Virtualization
    Docker 1.0 Backed By IBM, Red Hat, Rackspace
    Docker all geared up for the enterprise
    Docker: Lightweight Linux Containers for Consistent Development and Deployment
    Docker Software Containers Go Commercial

  • How to Manage Password Aging in Solaris, AIX, and Linux

    LogoIts possible that sometime in your short, meaningless life, you may need to create an account that has a password that is set to never expire. This is somethimes the case with headless accounts and specialty accounts such as the type you might have to setup for monitoring or security scanning. You might also find yourself setting up shared headless accounts that have locked passwords in order to block direct logins. This second scenario can be especially troublesome when this is some sort of application or database user with cron jobs, as even an account without a password and expire and lock. If this occurs all of a users cron jobs will fail. All because the account expired.

    So today we are going to configure a user password not to expire.

    Lets start with Solaris. First lets unlock the account just in case.

    passwd -d username

    Now you can turn off password aging for a user with the command below.

    passwd -x -1 username

    You can then verify your config with the following.

    passwd -s dmadmin

    The output of the command above should look similar to what I have below. In this example our user id is myuser.

    #passwd -s myuser
myuser  PS

    Compare what you see above to the output below for our example myuser1, which includes the date that the password was last changed, the minimum number of days between password changes, the maximum number of days required between password changes, and the number of days of warning a user is given before a password expires. Standard system password aging and expiration still applies.

    #passwd -s myuser1
myuser1  PS    09/30/13     7    28     7

    Now lets move on to Linux. First lets ulock. Then we will configure the password to not expire. Then we can verify our work with the chage -l command.

    passwd -u username

    chage -m 0 -M 99999 -I -1 -E -1 username

    change -l username

    So now lets take a visit to AIX land. Remember to not stay long. Again, its always best to make sure that the current password is not locked. Then we configure the password to not expire. Finally we step back and admire our work.

    chuser account_locked=false username

    chuser maxage=0 username

    lsuser -f USERNAME | fgrep expires

    Related articles

    SuperUser in Linux
    How to Unlock an account in Linux
    How to Reset a Password on Unix
    Much Todo About Linux/RHEL Passwords
    Enycrypting Passwords Via SSL for Redhat Kickstart Configuration Files
    How to disable an user account in Linux

  • Enycrypting Passwords Via SSL for Redhat Kickstart Configuration Files

    MummyHello again earthlings. The fatmin returns once again to dispense a bit of wisdom. This handy one-liner is a command that for the life of me I cannot remember.

    Our story begings when building your kickstart config and post-install config files you are going to need to set the password for at least one user (being root). If you are like me your configs add all sorts of users. As you know you cannot just stick the password for these users into your config files in plain text, rather you need to encrypt them via ssl.

    The command to do so is below.

    openssl passwd -1

    At this point you will be prompted to enter the users password — twice. Then the command will spit out your ssl encrypted password which you can then shove into your config files.
    Related articles

    Really Awesome Network Config Differ Tricks we use to forget
    Strategies to establish secure password storage systems
    HomeLab: Simple SSH Setup on a Cisco Router
    Re: Sound Wallet – Audio Cold Storage – Your private key as .wav, CD, or a Record

  • Disable SSH for SFTP Users in UNIX and Linux

    Lego_IronManSFTP is a file transfer mechanism that is an extension of the SSH (Secure Shell) protocol and by design they share the same configuration file (/etc/ssh/sshd_config). By default when a user is given access to a server via SSH they also gain access to a server via SFTP. however it is pretty easy to disallow SFTP access with a couple short lines added to the end of the sshd_config.

    In this example we could create a Unix group of "no-sftp" and add whatever users we want to into this group. Then drop the two lines below into the sshd_config and block sftp access

    Match Group no-sftp
    Subsystem   sftp  /bin/false

    However lets consider the opposite scenario…

    You have users that you want to be able to use SFTP to transfer files but you do not want to allow the user to login to the server. You can't just drop a couple lines in the sshd_config to allow sftp but not ssh, because ssh does not work this way. You also cannot just change the users shell to something like /bin/false, as this will also block SFTP access as well as SSH access. Note: It is for this very reason that I personally choose never to choose to use SFTP as a file transfer protocol… this is why we have VSFTP. By using a separate daemon with a separate config file you have a lot more control over your environment.

    So how do you disable ssh only for these users you ask? Well lets look at Linux and Solaris first.

    First drop the script below into /usr/local/bin/sftponly and make it executable.

    #!/bin/bash
    if [[ "$2" = *sftp-server ]]
    then
            exec /bin/bash "$@"
    else
            echo "User '$LOGNAME' is only allowed access via sftp."
            exit 1
    fi

    Now for any user that you need to block ssh access, just change their shell to /usr/local/bin/sftponly, and if they come in via any other method then SFTP they will be booted right off the box. But if they come in via SFTP its business as usual.

    Now AIX is a bit different – here there is actually a built in mechanism for dealing with such a situation. Here you change the user's login shell to /usr/sbin/sftp-server which pretty much does the same thing (in regards to blocking ssh access) but without the fancy error message.

    Note that this is obviously not an ideal solution, but if you are like me and you are stuck with a piss poor configuration and need to block SSH access without re-inventing the wheel, or breaking any existing processes.. and you need to do so quickly and easily this is the best solution for the money.
    Related articles

    Install and Configure SNMP on the Asus RT-AC66U Router
    HomeLab: Simple DHCP Service Configuration on a Cisco Router
    Secure File Transfer Protocol (sftp)
    How to set up Chroot Sftp?
    Options for file sharing via SSH in OS X