sm-grimoire AT lists.ibiblio.org
Subject: Discussion of Spells and Grimoire items
List archive
- From: Seth Woolley <seth AT tautology.org>
- To: FubecaPobre AT netscape.net
- Cc: evraire AT tuwg.com, sm-grimoire AT lists.ibiblio.org
- Subject: RE: [SM-Grimoire] named running as bind user
- Date: Mon, 6 Oct 2003 15:40:40 -0700 (PDT)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Mon, 6 Oct 2003 FubecaPobre AT netscape.net wrote:
> The user 'bind' does exist, but the initial group is set to 'nogroup'.
> I'm not sure if that's by design or not. I double-checked the
> permissions in my /etc/bind directory and all files are owned by
> bind:bind (that's user bind and group bind), including the sub-directory
> 'zones' and the zone file '127.0.0' found within the 'zones'
> sub-directory.
zones subdirectory? do you mean 'm'? I made an m and s subdir by design.
s is needed because if anybody were to break into it, it prevents somebody
from overwriting config files in the main directory, and m is there for
cleanness in the main directory. I made a small script for handling basic
master/slave logic (that I use) and included it in the spell. Only issue
I seem to have now is that recasting seems to overwrite things I didn't
want overwritten. /me begs for help to solve that since he's rather busy
lately with work/RL, but to answer your question:
the chroot logic takes place in the spell itself in BUILD. It copies the
main files into /var/chroot/bind (IIRC) and sets up some symlinks. (hmm,
that might be why it overwrites, I'll have to look into what's
dispelled...) One from /etc/bind to the chroot, and another from
/etc/bind/etc/bind to / (what that does is when you chroot it, it will
behave like it wasn't chrooted, and you don't have to change around the
config files, unchrooting just involves removing the -t /etc/bind part in
the init script. the -u bind should _always_ be there, else you are
running as root, big security risk. if you are running as root and
chrooted, don't expect safety unless you run grsecurity kernel and have
root perms removed for breaking out of the chroot jail with a double
chroot (as I understand). to run as root eliminates permission problems,
but unless you removed the -t /etc/bind, then you should still be fully
chrooted in the chroot environment (which means _that_ logic works). I
suspect there might be a permission issue somewhere. You can send me a ls
- -l of respective directories and I could take a look at it (in my zeal to
make the spell even better and perhaps fix your problem). No promises
though ;).
Seth
>
> I'll double-check them tonight, as well as the symlinks and such, and
> let you know what I find.
>
> Just out of curiosity, where does all the 'chroot' logic take place? It
> wasn't apparent in the init script.
>
> Thanks!
>
> Seth Woolley <seth AT tautology.org> wrote:
>
> >-----BEGIN PGP SIGNED MESSAGE-----
> >Hash: SHA1
> >
> >It should be running chrooted by default:
> >from: ps auxw
> >bind 474 0.0 1.4 4728 3624 ? S Sep21 1:33 named -u
> >bind -t /etc/bind
> >
> >The -t is the chrooted directory. It can run either in or out of it
> >because I use fancy symlinks when I made the spell support chrooting.
> >/etc/bind itself is actually in /var/chroot/bind (IIRC) to prevent a DoS
> >on the /etc/ filesystem.
> >
> >Does the bind user exist? The spell works fine on my box, and I sent a
> >note out to the MLs that I had experimented with getting named in chroot
> >working, and I incorporated what comments I got. Maybe you edited a file
> >as root and so it got saved as root-owned? If you find out if the spell
> >is doing anything wrong, let me know.
> >
> >Seth
> >
> >On Mon, 6 Oct 2003 evraire AT tuwg.com wrote:
> >
> >>
> >> > Pardon my ignorance, but how would I tell if it's being run in a
> >> > chrooted environment?
> >>
> >> Good question! Unfortunately I'm on a Wintendo box at the moment so
> >> can't check out my setup. :/ Your best bet will be to hope the author
> >> or maintainer of the spell hears your call for help and answers. :) If
> >> I think of it I'll double check myself when I get home.
> >>
> >> Good luck!
> >>
> >> Jonathan Evraire
> >> evraire at tuwg.com
> >>
> >>
> >> -----------------------------------------
> >> Message sent via Toad-One
> >> Anti-spam notice, this message originated from IP Address: 199.212.215.11
> >> -----------------------------------------
> >> _______________________________________________
> >> SM-Grimoire mailing list
> >> SM-Grimoire AT lists.ibiblio.org
> >> http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
> >>
> >
> >- --
> >Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
> >Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
> >Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
> >-----BEGIN PGP SIGNATURE-----
> >Version: GnuPG v1.2.2 (FreeBSD)
> >
> >iD8DBQE/gdGX7fQ833vqzH0RAiFuAJ9xaO4WTzA659wFw4vpYHrEAUGiTgCgtTfv
> >abmHk/LrTOUkN6gDC2tIF+M=
> >=J1WW
> >-----END PGP SIGNATURE-----
> >
> >
>
> __________________________________________________________________
> McAfee VirusScan Online from the Netscape Network.
> Comprehensive protection for your entire computer. Get your free trial
> today!
> http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397
>
> Get AOL Instant Messenger 5.1 free of charge. Download Now!
> http://aim.aol.com/aimnew/Aim/register.adp?promo=380455
>
- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)
iD8DBQE/ge9u7fQ833vqzH0RAvUhAJ9IDWTcx3Wa5BBegK/9AfoQcvLIjQCfcJIq
EHN4wR8V62fu7zo3J4CwX00=
=xZNX
-----END PGP SIGNATURE-----
-
[SM-Grimoire] named running as bind user,
FubecaPobre, 10/06/2003
- <Possible follow-up(s)>
- RE: [SM-Grimoire] named running as bind user, evraire, 10/06/2003
-
RE: [SM-Grimoire] named running as bind user,
FubecaPobre, 10/06/2003
- Re: [SM-Grimoire] named running as bind user, Pierre Abbat, 10/06/2003
-
RE: RE: [SM-Grimoire] named running as bind user,
evraire, 10/06/2003
- RE: [SM-Grimoire] named running as bind user, Seth Woolley, 10/06/2003
-
RE: [SM-Grimoire] named running as bind user,
FubecaPobre, 10/06/2003
- RE: [SM-Grimoire] named running as bind user, Seth Woolley, 10/06/2003
- RE: [SM-Grimoire] named running as bind user, FubecaPobre, 10/07/2003
- RE: [SM-Grimoire] named running as bind user, FubecaPobre, 10/07/2003
Archive powered by MHonArc 2.6.24.