Discussion of Spells and Grimoire items

[FubecaPobre AT netscape.net]

Seth,

I'm starting to think that I cast the bind spell from the stable grimoire 
which possibly hasn't been updated with these chroot changes. Do you know if 
that could be the case?

I didn't have an /s or /m directory and no symlinks to be found. Also, the 
init script didn't have the -t switch, just 'loadproc named -u bind'. I'm 
recasting as we speak with the latest test grimoire and should have more 
details for you in the morning.

Thanks for all your help (you too, evraire).

Seth Woolley <seth AT tautology.org> wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>
>
>On Mon, 6 Oct 2003 FubecaPobre AT netscape.net wrote:
>
>> The user 'bind' does exist, but the initial group is set to 'nogroup'.
>> I'm not sure if that's by design or not. I double-checked the
>> permissions in my /etc/bind directory and all files are owned by
>> bind:bind (that's user bind and group bind), including the sub-directory
>> 'zones' and the zone file '127.0.0' found within the 'zones'
>> sub-directory.
>
>zones subdirectory?  do you mean 'm'?  I made an m and s subdir by design.
>s is needed because if anybody were to break into it, it prevents somebody
>from overwriting config files in the main directory, and m is there for
>cleanness in the main directory.  I made a small script for handling basic
>master/slave logic (that I use) and included it in the spell.  Only issue
>I seem to have now is that recasting seems to overwrite things I didn't
>want overwritten.  /me begs for help to solve that since he's rather busy
>lately with work/RL, but to answer your question:
>
>the chroot logic takes place in the spell itself in BUILD.  It copies the
>main files into /var/chroot/bind (IIRC) and sets up some symlinks.  (hmm,
>that might be why it overwrites, I'll have to look into what's
>dispelled...)  One from /etc/bind to the chroot, and another from
>/etc/bind/etc/bind to / (what that does is when you chroot it, it will
>behave like it wasn't chrooted, and you don't have to change around the
>config files, unchrooting just involves removing the -t /etc/bind part in
>the init script.  the -u bind should _always_ be there, else you are
>running as root, big security risk.  if you are running as root and
>chrooted, don't expect safety unless you run grsecurity kernel and have
>root perms removed for breaking out of the chroot jail with a double
>chroot (as I understand).  to run as root eliminates permission problems,
>but unless you removed the -t /etc/bind, then you should still be fully
>chrooted in the chroot environment (which means _that_ logic works).  I
>suspect there might be a permission issue somewhere.  You can send me a ls
>- -l of respective directories and I could take a look at it (in my zeal to
>make the spell even better and perhaps fix your problem).  No promises
>though ;).
>
>Seth
>
>>
>> I'll double-check them tonight, as well as the symlinks and such, and
>> let you know what I find.
>>
>> Just out of curiosity, where does all the 'chroot' logic take place? It
>> wasn't apparent in the init script.
>>
>> Thanks!
>>
>> Seth Woolley <seth AT tautology.org> wrote:
>>
>> >-----BEGIN PGP SIGNED MESSAGE-----
>> >Hash: SHA1
>> >
>> >It should be running chrooted by default:
>> >from: ps auxw
>> >bind       474  0.0  1.4  4728 3624 ?        S    Sep21   1:33 named -u 
>> >bind -t /etc/bind
>> >
>> >The -t is the chrooted directory.  It can run either in or out of it
>> >because I use fancy symlinks when I made the spell support chrooting.
>> >/etc/bind itself is actually in /var/chroot/bind (IIRC) to prevent a DoS
>> >on the /etc/ filesystem.
>> >
>> >Does the bind user exist?  The spell works fine on my box, and I sent a
>> >note out to the MLs that I had experimented with getting named in chroot
>> >working, and I incorporated what comments I got.  Maybe you edited a file
>> >as root and so it got saved as root-owned?  If you find out if the spell
>> >is doing anything wrong, let me know.
>> >
>> >Seth
>> >
>> >On Mon, 6 Oct 2003 evraire AT tuwg.com wrote:
>> >
>> >>
>> >> > Pardon my ignorance, but how would I tell if it's being run in a 
>> >> > chrooted environment?
>> >>
>> >> Good question!  Unfortunately I'm on a Wintendo box at the moment so 
>> >> can't check out my setup. :/  Your best bet will be to hope the author 
>> >> or maintainer of the spell hears your call for help and answers. :)  If 
>> >> I think of it I'll double check myself when I get home.
>> >>
>> >>   Good luck!
>> >>
>> >>   Jonathan Evraire
>> >>   evraire at tuwg.com
>> >>
>> >>
>> >> -----------------------------------------
>> >> Message sent via Toad-One
>> >> Anti-spam notice, this message originated from IP Address: 
>> >> 199.212.215.11
>> >> -----------------------------------------
>> >> _______________________________________________
>> >> SM-Grimoire mailing list
>> >> SM-Grimoire AT lists.ibiblio.org
>> >> http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
>> >>
>> >
>> >- --
>> >Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
>> >Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
>> >Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
>> >-----BEGIN PGP SIGNATURE-----
>> >Version: GnuPG v1.2.2 (FreeBSD)
>> >
>> >iD8DBQE/gdGX7fQ833vqzH0RAiFuAJ9xaO4WTzA659wFw4vpYHrEAUGiTgCgtTfv
>> >abmHk/LrTOUkN6gDC2tIF+M=
>> >=J1WW
>> >-----END PGP SIGNATURE-----
>> >
>> >
>>
>> __________________________________________________________________
>> McAfee VirusScan Online from the Netscape Network.
>> Comprehensive protection for your entire computer. Get your free trial 
>> today!
>> http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397
>>
>> Get AOL Instant Messenger 5.1 free of charge.  Download Now!
>> http://aim.aol.com/aimnew/Aim/register.adp?promo=380455
>>
>
>- --
>Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
>Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
>Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.2.2 (FreeBSD)
>
>iD8DBQE/ge9u7fQ833vqzH0RAvUhAJ9IDWTcx3Wa5BBegK/9AfoQcvLIjQCfcJIq
>EHN4wR8V62fu7zo3J4CwX00=
>=xZNX
>-----END PGP SIGNATURE-----
>
>

__________________________________________________________________
McAfee VirusScan Online from the Netscape Network.
Comprehensive protection for your entire computer. Get your free trial today!
http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397

Get AOL Instant Messenger 5.1 free of charge.  Download Now!
http://aim.aol.com/aimnew/Aim/register.adp?promo=380455