Baslinux mailing list

[Stephen Clement <s.clement AT sympatico.ca>]

sindi keesan wrote:

> > > > > I have no cgi files and don't need a log so I simply made
> > > > > /etc/mini_http.config
> > > > >
> > > > > consisting of
> > > > > dir=/www
> > > > >
> > > > > I made an alias httpd='mini-httpd -C /etc/mini_httpd.config'
> > >
> > > I also typed httpd (enter) to start mini_httpd.
> > >
> > > > > I killed mini_httpd (ps, kill the process number)
> > > > >
> > > > > I then loaded it with a different switch, to ignore the config file:
> > > > >
> > > > > mini_httpd -d /tmp
> > >
> > > -d specifies the directory that contains index.htm and/or will serve 
> > > files.
> > >
> > > > Don't forget that you set that alias!
> > >
> > >
> > >
> > > I was careful to call the alias 'httpd' and not mini_httpd.
> >
> >
> > ...but isn't there already a httpd in /sbin, the busybox one?
>
>
> The busybox httpd is in BL3.  mini_httpd is in BL2.  This way I can 
> type httpd for both.  Or mini_httpd -d directoryname in BL2 if I want 
> to specify the directory not to be www so I can upload a file to my 
> shell account from /tmp.

Ok.

> > > > > I am not going to get into chrooting, but when I start mini_httpd 
> > > > > I get some message about it that I don't understand and am ignoring.
> > > >
> > > >
> > > >
> > > > "mini_httpd: started as root without requesting chroot(), warning 
> > > > only"
> > > >
> > > > Yeah, it's not recommended that you run a webserver as root without 
> > > > chrooting, but you SHOULD be fine.
> > >
> > >
> > >
> > > chrooting to what and why? ?  I only know how to chroot between the 
> > > linux partitions where I have BL2 and BL3 so as to run BL3 programs 
> > > from one of the BL2 vts.  I could use busybox httpd that way in BL2.
> >
> >
> > chrooting can be used to lock programs into certain areas so that if 
> > an attacker somehow manages to exploit the httpd, he can't do 
> > anything. Very useful on larger servers, you probably won't want to 
> > do that though, especially considering you're not using a heavyweight 
> > linux distro.
>
>
> I don't think I would have anything to chroot to, unless I were to put 
> a second linux on the same partition somewhere just to serve files from.

You'd just need to put the files that it would need. Quite frankly, you 
don't really need to chroot.

> > > > > I don't understand the business about switching to user nobody.  I 
> > > > > just switched terminals to do something else.  Could I also just type
> > > > > mini_httpd -d /tmp &
> > > > > and continue to use that terminal?
> > >
> > > > You don't even need the & on the end, it daemonizes itself. You can 
> > > > continue using that terminal. The whole switching to user 'nobody' 
> > > > is for if you want a more secure environment.
> > >
> > >
> > >
> > > How do I keep using the terminal when there is no longer a cursor?
> > > Same for in.telnetd -debug
> >
> >
> > I found that using Control-C when the chroot warning came up put me 
> > back into a terminal.
>
>
> I would have thought that would dump me back out of httpd.

No, the warning text can simply be backspaced, so it's safe to Control-C it.

> > > What does it mean to switch to user 'nobody' and what is chroot about?
> > > And what does daemonize itself mean?
> >
> >
> > On more mainstream distro's, there is a user called 'nobody'. This 
> > user has restricted access, and can't get shell access. It's used 
> > mostly for daemons, and is there for security reasons. When a program 
> > switches to the nobody user, it's putting itself in a protected 
> > environment so that it's harder for an attacker to take over a 
> > system. mini_httpd takes care of all of this for you, however, so you 
> > don't need to worry about it.
> >
> > On chrooting, i've already explained it but I shall go further. 
> > chrooting locks a program into a certian area, and outside of that 
> > area it cannot do anything. It's useful for security reasons.
>
>
> I think I saw something about nobody in one of the files in /etc in 
> BL2 or maybe BL3.  Can't check right now - I tend to dial my shell 
> account from DOS - is there more or less chance of someone changing 
> things in my computer when I am using DOS to dial and go online?

Probably not, considering how long you're online for.

> What is the probability of someone else breaking into my computer even 
> if I am doing everything wrong (running telnetd and httpd, going 
> online as root, using telnet not ssh, etc.) when I am dialed into the 
> internet with BL3 or BL2?

If you're online for a while, probably not very long, although if you 
have an always-on connection it is definitly not recommended.

> > > Wow, I feel like a real system administrator now.  In training.
> >
> >
> > Heh, don't worry. It'll all make sense soon enough. :)
> >
> > Thanks,
> >
> > Stephen Clement
> >
> > > > Thanks,
> > > >
> > > > Stephen Clement
> > > >
> > > > > On Mon, 14 Mar 2005, Stephen Clement wrote:
> > > > >
> > > > > > sindi keesan wrote:
> > > > > >
> > > > > > > On Mon, 14 Mar 2005, Stephen Clement wrote:
> > > > > > >
> > > > > > > > sindi keesan wrote:
> > > > > > > >
> > > > > > > > > Interesting.  I just found my own assigned IP address in 
> > > > > > > > > /var/eznet/status.0:
> > > > > > > > >
> > > > > > > > > ppp0 204.39.226.xxx to 204.39.226.4 up since 9:12AM Mon Mar 
> > > > > > > > > 14, 2005
> > > > > > > > >
> > > > > > > > > (I did not type out the full IP address just in case this 
> > > > > > > > > might cause a security problem - could it?  I am not running 
> > > > > > > > > any telnet or http demons right now and I am telnetted here as 
> > > > > > > > > user.)
> > > > > > > > >
> > > > > > > > > So if I were to run httpd on my computer I could from this 
> > > > > > > > > shell account use a browser to access my own computer and 
> > > > > > > > > transfer files from it, instead of via ftp or kermit file 
> > > > > > > > > transfer.  Might be useful.  But I dialed in using BL2 not BL3 
> > > > > > > > > - is there a small httpd that will work in BL2, or is the BL3 
> > > > > > > > > one statically compiled?
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > The one I submitted to the list, mini_httpd is statically 
> > > > > > > > compiled, so it should work with BL2, and it's easier than 
> > > > > > > > copying over all of busybox.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > I took a look at it but could not understand how to configure 
> > > > > > > it.  Can you explain how to set it up to work like the busybox 
> > > > > > > httpd, just from the directory where it is invoked?  I have not 
> > > > > > > set up a web server until yesterday.
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > First of all, if you have the new version there's plenty of 
> > > > > > documentation on it in /usr/doc/.
> > > > > >
> > > > > > I'll explain it however:
> > > > > > The -C option specifies a config file. Config files are explained 
> > > > > > quite nicely if you read the page in /usr/doc/, and you set the 
> > > > > > options like so:
> > > > > >
> > > > > > optionname=value
> > > > > >
> > > > > > -p specifies a port. The default of 80 should be what you want.
> > > > > >
> > > > > > -d specifies a dir to chdir to at startup.
> > > > > >
> > > > > > -dd is related to chrooting, see the manual.
> > > > > >
> > > > > > -c is for specifying your cgi-bin. Specify 'cgi-bin/**' (without 
> > > > > > the quotes) for anything in cgi-bin/. '**.cgi' (yet again, 
> > > > > > without the quotes) for all files ending in .cgi. Note that this 
> > > > > > path is relative to the directory specified with -d.
> > > > > >
> > > > > > -u specifies a user to switch to after initialization as root. 
> > > > > > Default is nobody. If you leave this alone in BL3, it'll somehow 
> > > > > > magically change to nobody just fine, despite the user 'nobody' 
> > > > > > not being existing.
> > > > > >
> > > > > > -h and -v are related to virtual hosting. See the manual.
> > > > > >
> > > > > > -l specifies a log file name. Default is no logging.
> > > > > >
> > > > > > -i specifies a pidfile (a file that it writes it's PID to)
> > > > > >
> > > > > > -T specifies a character set to use when sending text files. 
> > > > > > Default should be fine.
> > > > > >
> > > > > > -P specifies a P3P server header. See manual for details.
> > > > > >
> > > > > > -M is related to caching, see manual for details.
> > > > > >
> > > > > > -S is related to SSL, which I have disabled. Useless unless you 
> > > > > > recompile with SSL support.
> > > > > >
> > > > > > -E is also related to SSL. Yet again, see the manual.
> > > > > >
> > > > > > -D is for debug mode. Note, however that mini_httpd does not 
> > > > > > become a daemon in this mode, so it's great for a restart script.
> > > > > >
> > > > > > -V prints the version and exits.
> > > > > >
> > > > > > So, now that we have that covered, here's an example 
> > > > > > configuration file:
> > > > > >
> > > > > > dir=/var/www/
> > > > > > cgipat=cgi-bin/**
> > > > > > logfile=/var/log/mini_httpd.log
> > > > > >
> > > > > > With this configuration file, you'd put your files in /var/www/, 
> > > > > > and your cgi files in /var/www/cgi-bin/. It would log to 
> > > > > > /var/log/mini_httpd.log.
> > > > > >
> > > > > > You would invoke mini_httpd like this:
> > > > > >
> > > > > > mini_httpd -C /path/to/config/file
> > > > > >
> > > > > > Hope this clears things up a bit. By the way, if you have an old 
> > > > > > version that does not have the (essential) manual in /usr/doc/, 
> > > > > > e-mail me for the new package. The manual is essential.
> > > > > >
> > > > > > Thanks,
> > > > > >
> > > > > > Stephen Clement
> > > > > >
> > > > > > > > Thanks,
> > > > > > > >
> > > > > > > > Stephen Clement
> > > > > > > >
> > > > > > > > > On Sun, 13 Mar 2005, Alejandro Lieber wrote:
> > > > > > > > >
> > > > > > > > > > Today I used httpd:
> > > > > > > > > >
> > > > > > > > > > 1) made directory www
> > > > > > > > > > 2) loaded a index.html file there.
> > > > > > > > > > 3) cd to /www
> > > > > > > > > > 4) run httpd
> > > > > > > > > > 5) run ppp-on
> > > > > > > > > > 6) read myip address (200.32.16.17) after loging to my IP.
> > > > > > > > > > 7) run links
> > > > > > > > > > 8) g 200.32.16.17
> > > > > > > > > > 9) links got my /www/index.html page
> > > > > > > > > >
> > > > > > > > > > All using only one machine.
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Read net news (USENET) with Arachne: 
> > > > > > > > > > http://www.lieber.com.ar/nnews.zip
> > > > > > > > > > Sans Serif fonts for MS-DOS at: 
> > > > > > > > > > http://www.lieber.com.ar/novafont.zip
> > > > > > > > > > Configurable dialing menu for several DOS internet programs at:
> > > > > > > > > > http://www.lieber.com.ar/dial_ip.zip
> > > > > > > > > >
> > > > > > > > > > ---------------------
> > > > > > > > > > Ing. Alejandro Lieber
> > > > > > > > > > Rosario     Argentina
> > > > > > > > > > ---------------------
> > > >
> > > > _______________________________________________
> > > > BasLinux mailing list
> > > > BasLinux AT lists.ibiblio.org
> > > > http://lists.ibiblio.org/mailman/listinfo/baslinux
> > >
> > > keesan AT sdf.lonestar.org
> > > SDF Public Access UNIX System - http://sdf.lonestar.org
> > > _______________________________________________
> > > BasLinux mailing list
> > > BasLinux AT lists.ibiblio.org
> > > http://lists.ibiblio.org/mailman/listinfo/baslinux
> >
> > _______________________________________________
> > BasLinux mailing list
> > BasLinux AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/baslinux
>
> keesan AT sdf.lonestar.org
> SDF Public Access UNIX System - http://sdf.lonestar.org
> _______________________________________________
> BasLinux mailing list
> BasLinux AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/baslinux