Chris Paquin

AI, Virtualization, Containers, Infrastructure, Linux

Tag: linux

  • Finding Files with Special Permissions in Linux

    Special-k-diet-1Ok, before you even attempt to read this post, I am assuming that you not only understand standard UNIX file permissions, but that you also understand special file permissions. What are special file permissions you ask. Well you know them as setuid, setgid, and the stickbit. If you don’t know what these things are then I will give you a very brief introduction.

    Setuid – when set on a file, runs a command as root, a good example of this is the password command as shown below.

    [root@localhost ~]# ls -l /usr/bin/passwd
    -rwsr-xr-x. 1 root root 27156 Aug  3  2013 /usr/bin/passwd

    Setgid – when set on a file, elevates permissions to the group ownership of a file. When set on a directory, causes all files created in that directory to be inherit group ownership from the directory.

    Sticky Bit – when set on a directory, blocks a user from renaming or removing a file that they do not own.

    Now lets use the find command to find files on our linux box with special permissions.

    To match a special permission with a specific octal number specify the octal number as shown below. Note that this command does not return anything at all as there are no files on my system with the perms 4000.

    [root@localhost ~]# find / -perm 4000

    To match the permissions on a file using a specific prefix use the ‘-‘ switch as shown below. Its basically a wildcard search, which searches on the fields that you specified.

    [root@ip-172-31-22-45 ~]# find /bin -perm -4000 | head -n 5
    /bin/umount
    /bin/mount
    /bin/ping
    /bin/su
    /bin/ping6

    As shown below, this command returns us all files in the /bin directory with the setuid bit set. In octal 4 is setuid.

    [root@ip-172-31-22-45 ~]# ls -l /bin/ping
    -rwsr-xr-x. 1 root root 40760 Sep 17  2013 /bin/ping

    The next example returns us all files in /bin with the setgid bit set. Note that the octal value of the setgid bit is 2.

    [root@ip-172-31-22-45 ~]# find /bin -perm /2000 | head -n 3
    /bin/cgexec
    /bin/cgclassify

    See I told you so…

    [root@ip-172-31-22-45 ~]# ls -l /bin/cgexec
    -rwxr-sr-x. 1 root cgred 16384 Dec  2  2013 /bin/cgexec

    Now lets get silly and try to match two octal values at once. This time we are going to search for files where both the setuid and setgid bits are set. As we know 4 + 2 = 6, so our command is as shown below

    [root@ip-172-31-22-45 ~]# find /bin -perm -6000 | head -n 3

    Note that this command does not return anything at all. However if we modify it a bit so that it searches for files that either have the setuid or the setgid bit set. To do this we use the ‘/’ modifier as shown below in my awesome example.

    [root@ip-172-31-22-45 ~]# find /bin -perm /6000 | xargs ls -l
    -rwxr-sr-x. 1 root cgred 16352 Dec  2  2013 /bin/cgclassify
    -rwxr-sr-x. 1 root cgred 16384 Dec  2  2013 /bin/cgexec
    -rwsr-xr-x. 1 root root  77336 Apr 10 04:50 /bin/mount
    -rwsr-xr-x. 1 root root  40760 Sep 17  2013 /bin/ping
    -rwsr-xr-x. 1 root root  36488 Sep 17  2013 /bin/ping6
    -rwsr-xr-x. 1 root root  34904 Mar  5 07:21 /bin/su
    -rwsr-xr-x. 1 root root  53472 Apr 10 04:50 /bin/umount

    In this example below I am searching for files that either have the setuid (4), the setgid (2), or the stickybit (1) set.

    [root@ip-172-31-22-45 ~]# find /bin -perm /7000 | xargs ls -l
    -rwxr-sr-x. 1 root cgred 16352 Dec  2  2013 /bin/cgclassify
    -rwxr-sr-x. 1 root cgred 16384 Dec  2  2013 /bin/cgexec
    -rwsr-xr-x. 1 root root  77336 Apr 10 04:50 /bin/mount
    -rwsr-xr-x. 1 root root  40760 Sep 17  2013 /bin/ping
    -rwsr-xr-x. 1 root root  36488 Sep 17  2013 /bin/ping6
    -rwsr-xr-x. 1 root root  34904 Mar  5 07:21 /bin/su
    -rwsr-xr-x. 1 root root  53472 Apr 10 04:50 /bin/umount

    To review. when using find if you do not specify any switches or options when searching for files by permissions, then you are attempting to do a specific match for files with those exact permissions. When you use the ‘-‘ option you are searching for files that match on a specific field. When you use the ‘/’ switch you are basically doing a wild card logical OR search. Use this option when you are searching for more than one type of special permission.

    Related articles

    CVE-2014-0907 – SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2
    setuid/setgid binaries in Debian’s Wheezy release?
    Learn octal file permissions easily with stat

  • Working With Extended Filesystem Attributes in Linux

    GarfatIn my previous post I went over standard filesystem attibutes in Linux, and how to set and view those attibutes with lsattr and chattr. You can view that post here if you are interested.

    In this post we are going to go over extended filesystem attibutes. Now there is not much to this as you are probably not going to ever have to use these settings. That being said, its not a bad thing to be aware of.

    Attribute names are strings that can be set and configured at will using the setfatr command. They can be viewed with the getfattr command. There are 4 namespaces of attibutes, security, system, trusted, and user.

    When using getfattr ( which I pronounce as getfatter) the -d option dumps only user namespace attibutes. The rest of the namespace attributes can be viewed by using the -m option along with the namespace name. In the example below you can see that there are no user namespace attibutes set on my anaconda-ks.cfg file, however there are attibutes set in the security namespace.

    [root@localhost ~]# getfattr -d anaconda-ks.cfg
    [root@localhost ~]# getfattr -d -m security anaconda-ks.cfg
    # file: anaconda-ks.cfg
    security.selinux="unconfined_u:object_r:admin_home_t:s0"

     

    Using setfattr you can define and set custom attributes. See the useless example below.

    [root@localhost ~]# setfattr -n user.example -v example anaconda-ks.cfg
    [root@localhost ~]# getfattr -d anaconda-ks.cfg
    # file: anaconda-ks.cfg
    user.example="example"

    However this could be cool if you got an md5 sum on a file and dumped it into a file attibute. You could, in theory, use this process to see if someone has messed with one of your config files.

     

    [root@localhost ~]# md5sum anaconda-ks.cfg
    fda1aa550d3cf82423d1b1ad1ae53a13  anaconda-ks.cfg
    [root@localhost ~]# setfattr -n user.md5sum -v fda1aa550d3cf82423d1b1ad1ae53a13 anaconda-ks.cfg
    [root@localhost ~]# getfattr -d anaconda-ks.cfg
    # file: anaconda-ks.cfg
    user.example="example"
    user.md5sum="fda1aa550d3cf82423d1b1ad1ae53a13"

     
    Related articles

    Why Extended Attributes are Coming to HDFS
    Advanced Filesystem Attributes in Linux
    How to create a file that root user also can't delete?

  • Yum: Under the Covers with GPG Keys

    Skeleton_key_1_keychain_sculpture_photo_cut_outs-r558fef9b275d4609b522ac07970a6af6_x7sa6_8byvr_324Hey look at this spooky key. Don't be frightened little one. Nothing scary is going to happen to you here. This is a safe place. As a matter of fact, if you stick around you might just learn a thing or two. A thing or two about GPG!

    First off do any of us really know what GPG stands for? Well yes we do! It stands for GNU Privacy Guard. RPM Package creators use GPG to apply a digital signature to their packages. If a package was tampered with, then its GPG signature will no longer match what was placed in the original package.

    First off to check what keys you have installed on your Linux server you can run the following rpm command as show in the example below.

    [root@ip-172-31-22-45 ~]# rpm -qa gpg-pubkey
    gpg-pubkey-0608b895-4bd22942
    gpg-pubkey-fd431d51-4ae0493b
    gpg-pubkey-2fa658e0-45700c69

     

    Neet I have three keys installed. But lets say want to install another one. Well I can do so with the command below. In this example I have navigated to /etc/pki/rpm-gpg and am going to install the redhat beta key on my server.

    [root@ip-172-31-22-45 rpm-gpg]# rpm –import RPM-GPG-KEY-redhat-beta

    Hey that was fun. Now lets get our hands a bit dirtier.

    Want to get more information on a specific key. Then this command is your huckleberry. Here you can see that this is the pubkey for the EPEL repo.

    [root@ip-172-31-22-45 rpm-gpg]# rpm -qi gpg-pubkey-0608b895-4bd22942
    Name        : gpg-pubkey                   Relocations: (not relocatable)
    Version     : 0608b895                          Vendor: (none)
    Release     : 4bd22942                      Build Date: Sat 14 Jun 2014 09:13:58 AM EDT
    Install Date: Sat 14 Jun 2014 09:13:58 AM EDT      Build Host: localhost
    Group       : Public Keys                   Source RPM: (none)
    Size        : 0                                License: pubkey
    Signature   : (none)
    Summary     : gpg(EPEL (6) <epel@fedoraproject.org>)
    Description :

     

    To verify signature of a downloaded package, use the rpm command as shown below. In this example I have highlighted the key that was used to sign this package.

    # rpm -vK nautilus-dropbox-1.6.0-1.fedora.i386.rpm
    nautilus-dropbox-1.6.0-1.fedora.i386.rpm:
        Header V3 RSA/SHA1 Signature, key ID 5044912e: OK
        Header SHA1 digest: OK (a4d51906633f92913db075ba33946f50999c245e)
        V3 RSA/SHA1 Signature, key ID 5044912e: OK
        MD5 digest: OK (1b8ff7abc18f68bf274e24fc57fd3a87)

     

    Using the bolded information in the example above, I can then use this information to track down the exact key that was used to sign the package.

    [root@localhost Downloads]# rpm -qa | grep 5044912e
    gpg-pubkey-5044912e-4b7489b1

     

    Is this awesome, well not really, but you never know when you might need to use this information. Like on a test. Wink Wink.
    Related articles

    Using Yum Update to Apply Security Patches Only
    How to Enable EPEL Repository on CentOs for Yum
    Signing rpm packages with GPG

  • Quick and Dirty Yum Security Plugin Overview

    Maneki-neko-mountain-tummy-13745890The YUM security plugin is a package that allows you to search specifically for security patches applicable to a Redhat/Centos server.  This functionality comes in very handy when having to cross reference CVEs to Redhat Security Advisories (RHSAs). If you work closely with anyone in an information security role, you already know how vital functionality is.

    Before you can begin you need to make sure that you have the plugin installed.  Use the command below to install it.

    # yum -y install yum-plugin-security

     

    Then you can use the plugin to get a overview of the security updates availible for your system.

    # yum updateinfo
        
    Updates Information Summary: available
    3 Security notice(s)
             1 Important Security notice(s)
             2 Moderate Security notice(s)
    12 Bugfix notice(s)
    1 Enhancement notice(s)

     

    You can get a specific list of updates, sorted by security advisories, bug fixes, and enhancement advisories.

    # yum updateinfo list

     

    To get more specific information on a RHSA and the CVEs that it applies to, you can search by RHSA as seen below.

    # yum updateinfo RHSA-2014:0771

     

    Need to see what patches are required to address a certain CVE, then this next command is for you. Trust me this one is useful as it gives you a list of all required packages that address that CVE.

    # yum updateinfo list –cve=CVE-2013-6378
    Loaded plugins: amazon-id, rhui-lb, security
    RHSA-2014:0771 Important/Sec. kernel-2.6.32-431.20.3.el6.x86_64
    RHSA-2014:0771 Important/Sec. kernel-firmware-2.6.32-431.20.3.el6.noarch
    RHSA-2014:0771 Important/Sec. kernel-headers-2.6.32-431.20.3.el6.x86_64
    RHSA-2014:0771 Important/Sec. perf-2.6.32-431.20.3.el6.x86_64

     

    Want to see a list of all fixes by severity. Then you can use the command below. Note that I am using important as my severity as there are no critical updates that are applicable to my test system at this time.

    yum updateinfo list –sec-severity=Important
    RHSA-2014:0771 Important/Sec. kernel-2.6.32-431.20.3.el6.x86_64
    RHSA-2014:0771 Important/Sec. kernel-firmware-2.6.32-431.20.3.el6.noarch
    RHSA-2014:0771 Important/Sec. kernel-headers-2.6.32-431.20.3.el6.x86_64
    RHSA-2014:0771 Important/Sec. perf-2.6.32-431.20.3.el6.x86_64

     

    You can also search for security fixes by package name as shown below.

    # yum updateinfo list kernel
    RHSA-2014:0771 Important/Sec. kernel-2.6.32-431.20.3.el6.x86_64

     

    You can also use YUM to apply only security related updates. See below. This is useful if you are in a pinch and need to quickly apply all security updates to make your Infosec Team happy.

    # yum –security update

    Related articles

    Using Yum Update to Apply Security Patches Only
    SCAP CVE Audit
    YFD plugin updated

  • What the Heck is a Linux Container, and Who the Hell is Docker?

    Docker-whaleA Linux Container is an Operating System level virtualization method for running isolated Linux environments on a single base install of Linux. Linux containers are not virtual machines, rather they are isolated virtual environments with dedicated CPU, memory, I/O, and network. One can think of a Linux Container as a light, virtual OS instance. At first glance one hearkens back to the time of Solaris Containers, but there is a lot more going on here then first meets the eye, especially when we throw Docker in the mix.

     

    But first, lets focus on Linux Containers…

     

    The technologies behind Linux Containers are Control Groups and Name Spaces. Control Groups manage and monitor resource allocation for processes and process groups such as CPU, Memory, and I/O. Name Spaces help isolate processes, in something akin to a chrooted environment, making processes running within them invisible to other processes in other Name Spaces.

     

    So why would you possibly want to run a Linux Container?

     

    Well for one you can consolidate multiple Linux servers into one Machine, therefor reducing the number of management points in your environment. Instead of having to patch 6 Virtual Machines, you now only have to patch one.

     

    Linux Containers can also be used to quickly spin up sandbox environments for development and testing so that you no longer need to spin up a new VM for each individual project. As we all know, this is how we end up with Virtual Sprawl. You create someone a Virtual Machine, with the intention of reclaiming it after a short period of time and all of a sudden that Virtual Machine becomes a permanent fixture in your environment. In the case of Linux Containers, you just tear down the instance and toss it away.

     

    Also, Linux Containers can be used to allow you to run multiple instances of the same application in parallel. Think of Apache virtual servers, running separately, independent and isolated from each other. Each with its own dedicated CPU, Memory, and I/O, and never stepping on each others toes.

     

    Linux Containers also provide an added layer of security. Just because a Container on a server is compromised, it does not mean that any other local Containers, or the base system itself is compromised in the least.

     

    Finally Linux Containers are efficient. First and foremost, they boot faster than traditional Virtual Machines. They also offer better performance over Virtual Machines as there is no hardware abstraction layer in the form of a hypervisor.

     

    So what is Docker then, you ask? Docker is an open source project that streamlines the deployment of an application (or OS) inside a Linux Container. Its designed to make the creation and management of Linux Containers simple as Docker can create and share disk images with ease.

     

    Here are just a few of the images available from the Docker Hub.

    • Apache CouchDB

    • PostgreSQL

    • Memcached

    • Mongo DB

    • NGINX

    • Mysql

    • WordPress

    • Centos

    • Ubuntu

    Whats amazing is that any dockerized image can run on any machine that is running docker. Imagine an Ubuntu docker image running on Centos. Weird huh?

     

    Have yourself a perfect OS image for your in-house java app? How about you dockerize that and use Docker as a revision control system for your application/OS. Sounds interesting, doesn't it.

     

    I have heard it said that Docker is not just Platform as a Service (PAAS) , its possibly could be much more than that. Right now Docker only works with Linux Containers, but imagine if it worked with KVM or Xen.

     

    Not sure about you but I look forward to getting deploy it in my lab.

    Related articles

    libswarm – Docker Orchestration Announced
    Docker 1.0 Provides Enterprise Support for Container Virtualization
    Docker 1.0 Backed By IBM, Red Hat, Rackspace
    Docker all geared up for the enterprise
    Docker: Lightweight Linux Containers for Consistent Development and Deployment
    Docker Software Containers Go Commercial

  • How to Manage Password Aging in Solaris, AIX, and Linux

    LogoIts possible that sometime in your short, meaningless life, you may need to create an account that has a password that is set to never expire. This is somethimes the case with headless accounts and specialty accounts such as the type you might have to setup for monitoring or security scanning. You might also find yourself setting up shared headless accounts that have locked passwords in order to block direct logins. This second scenario can be especially troublesome when this is some sort of application or database user with cron jobs, as even an account without a password and expire and lock. If this occurs all of a users cron jobs will fail. All because the account expired.

    So today we are going to configure a user password not to expire.

    Lets start with Solaris. First lets unlock the account just in case.

    passwd -d username

    Now you can turn off password aging for a user with the command below.

    passwd -x -1 username

    You can then verify your config with the following.

    passwd -s dmadmin

    The output of the command above should look similar to what I have below. In this example our user id is myuser.

    #passwd -s myuser
myuser  PS

    Compare what you see above to the output below for our example myuser1, which includes the date that the password was last changed, the minimum number of days between password changes, the maximum number of days required between password changes, and the number of days of warning a user is given before a password expires. Standard system password aging and expiration still applies.

    #passwd -s myuser1
myuser1  PS    09/30/13     7    28     7

    Now lets move on to Linux. First lets ulock. Then we will configure the password to not expire. Then we can verify our work with the chage -l command.

    passwd -u username

    chage -m 0 -M 99999 -I -1 -E -1 username

    change -l username

    So now lets take a visit to AIX land. Remember to not stay long. Again, its always best to make sure that the current password is not locked. Then we configure the password to not expire. Finally we step back and admire our work.

    chuser account_locked=false username

    chuser maxage=0 username

    lsuser -f USERNAME | fgrep expires

    Related articles

    SuperUser in Linux
    How to Unlock an account in Linux
    How to Reset a Password on Unix
    Much Todo About Linux/RHEL Passwords
    Enycrypting Passwords Via SSL for Redhat Kickstart Configuration Files
    How to disable an user account in Linux

  • You are not allowed to access to (crontab) because of pam configuration.

    PD Donut Guy with ShadowHey look a real live Linux post.

    Sure enough, and right as rain I am back with something that is not about networking (yeah!) and not about Solaris (boo!).

    This is a short story about how we had a user who was a member of our database team who was attempting to make modifications to the oracle user’s crontab. They kept running into the error below.

    Authentication token expired
    You (oracle) are not allowed to access to (crontab) because of pam configuration.

    Remembering that the oracle account is a special account without a password, or the ability to login, I figured that it had something to do with the fact the lack or password or something related.

    I used the chage command to determine that while the password was not expired, rather that the account was considered inactive. Probably due to the fact that we locked down login permissions for service users on this box, but did not take into account that this user needed to login from time to time to keep the account from becoming inactive.

    # chage -l oracle
    Last password change                                    : Mar 25, 2013
    Password expires                                        : Apr 22, 2013
    Password inactive                                       : May 06, 2013
    Account expires                                         : never
    Minimum number of days between password change          : 7
    Maximum number of days between password change          : 28
    Number of days of warning before password expires       : 7

    Now whats funny about this issue is that its pretty much a time bomb waiting to go off. You lock down logins for service accounts and forget to modify the inactive or expiration dates, and some day in the near future your users cron jobs will stop running, which possibly could cause all hell to break loose depending on whats running out of cron.

    The fix is as follows.

    # chage -I -1 -m 0 -M 99999 -E -1 oracle

    Then use chage again to check out the sexy new settings.

    # chage -l oracle
    Last password change                                    : Mar 25, 2013
    Password expires                                        : never
    Password inactive                                       : never
    Account expires                                         : never
    Minimum number of days between password change          : 0
    Maximum number of days between password change          : 99999
    Number of days of warning before password expires       : 7

    Related articles

    HomeLab: Simple SSH Setup on a Cisco Router
    HomeLab: Cisco 2621 Router Password Recovery/Factory Reset
    chkcrontab 1.6
    How to Use Cron to Automate Tasks on a VPS