sm-grimoire AT lists.ibiblio.org
Subject: Discussion of Spells and Grimoire items
List archive
- From: FubecaPobre AT netscape.net
- To: seth AT tautology.org (Seth Woolley)
- Cc: evraire AT tuwg.com, sm-grimoire AT lists.ibiblio.org
- Subject: RE: [SM-Grimoire] named running as bind user
- Date: Tue, 07 Oct 2003 07:36:13 -0400
Well, the recast worked fine and everything is happy now. I'm sorry for all
the hassle, but I know a lot more about the bind spell than I did before!
Thanks again,
Cory
FubecaPobre AT netscape.net wrote:
>Seth,
>
>I'm starting to think that I cast the bind spell from the stable grimoire
>which possibly hasn't been updated with these chroot changes. Do you know if
>that could be the case?
>
>I didn't have an /s or /m directory and no symlinks to be found. Also, the
>init script didn't have the -t switch, just 'loadproc named -u bind'. I'm
>recasting as we speak with the latest test grimoire and should have more
>details for you in the morning.
>
>Thanks for all your help (you too, evraire).
>
>Seth Woolley <seth AT tautology.org> wrote:
>
>>-----BEGIN PGP SIGNED MESSAGE-----
>>Hash: SHA1
>>
>>
>>
>>On Mon, 6 Oct 2003 FubecaPobre AT netscape.net wrote:
>>
>>> The user 'bind' does exist, but the initial group is set to 'nogroup'.
>>> I'm not sure if that's by design or not. I double-checked the
>>> permissions in my /etc/bind directory and all files are owned by
>>> bind:bind (that's user bind and group bind), including the sub-directory
>>> 'zones' and the zone file '127.0.0' found within the 'zones'
>>> sub-directory.
>>
>>zones subdirectory? do you mean 'm'? I made an m and s subdir by design.
>>s is needed because if anybody were to break into it, it prevents somebody
>>from overwriting config files in the main directory, and m is there for
>>cleanness in the main directory. I made a small script for handling basic
>>master/slave logic (that I use) and included it in the spell. Only issue
>>I seem to have now is that recasting seems to overwrite things I didn't
>>want overwritten. /me begs for help to solve that since he's rather busy
>>lately with work/RL, but to answer your question:
>>
>>the chroot logic takes place in the spell itself in BUILD. It copies the
>>main files into /var/chroot/bind (IIRC) and sets up some symlinks. (hmm,
>>that might be why it overwrites, I'll have to look into what's
>>dispelled...) One from /etc/bind to the chroot, and another from
>>/etc/bind/etc/bind to / (what that does is when you chroot it, it will
>>behave like it wasn't chrooted, and you don't have to change around the
>>config files, unchrooting just involves removing the -t /etc/bind part in
>>the init script. the -u bind should _always_ be there, else you are
>>running as root, big security risk. if you are running as root and
>>chrooted, don't expect safety unless you run grsecurity kernel and have
>>root perms removed for breaking out of the chroot jail with a double
>>chroot (as I understand). to run as root eliminates permission problems,
>>but unless you removed the -t /etc/bind, then you should still be fully
>>chrooted in the chroot environment (which means _that_ logic works). I
>>suspect there might be a permission issue somewhere. You can send me a ls
>>- -l of respective directories and I could take a look at it (in my zeal to
>>make the spell even better and perhaps fix your problem). No promises
>>though ;).
>>
>>Seth
>>
>>>
>>> I'll double-check them tonight, as well as the symlinks and such, and
>>> let you know what I find.
>>>
>>> Just out of curiosity, where does all the 'chroot' logic take place? It
>>> wasn't apparent in the init script.
>>>
>>> Thanks!
>>>
>>> Seth Woolley <seth AT tautology.org> wrote:
>>>
>>> >-----BEGIN PGP SIGNED MESSAGE-----
>>> >Hash: SHA1
>>> >
>>> >It should be running chrooted by default:
>>> >from: ps auxw
>>> >bind 474 0.0 1.4 4728 3624 ? S Sep21 1:33 named -u
>>> >bind -t /etc/bind
>>> >
>>> >The -t is the chrooted directory. It can run either in or out of it
>>> >because I use fancy symlinks when I made the spell support chrooting.
>>> >/etc/bind itself is actually in /var/chroot/bind (IIRC) to prevent a DoS
>>> >on the /etc/ filesystem.
>>> >
>>> >Does the bind user exist? The spell works fine on my box, and I sent a
>>> >note out to the MLs that I had experimented with getting named in chroot
>>> >working, and I incorporated what comments I got. Maybe you edited a file
>>> >as root and so it got saved as root-owned? If you find out if the spell
>>> >is doing anything wrong, let me know.
>>> >
>>> >Seth
>>> >
>>> >On Mon, 6 Oct 2003 evraire AT tuwg.com wrote:
>>> >
>>> >>
>>> >> > Pardon my ignorance, but how would I tell if it's being run in a
>>> >> > chrooted environment?
>>> >>
>>> >> Good question! Unfortunately I'm on a Wintendo box at the moment so
>>> >> can't check out my setup. :/ Your best bet will be to hope the author
>>> >> or maintainer of the spell hears your call for help and answers. :)
>>> >> If I think of it I'll double check myself when I get home.
>>> >>
>>> >> Good luck!
>>> >>
>>> >> Jonathan Evraire
>>> >> evraire at tuwg.com
>>> >>
>>> >>
>>> >> -----------------------------------------
>>> >> Message sent via Toad-One
>>> >> Anti-spam notice, this message originated from IP Address:
>>> >> 199.212.215.11
>>> >> -----------------------------------------
>>> >> _______________________________________________
>>> >> SM-Grimoire mailing list
>>> >> SM-Grimoire AT lists.ibiblio.org
>>> >> http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
>>> >>
>>> >
>>> >- --
>>> >Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
>>> >Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
>>> >Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
>>> >-----BEGIN PGP SIGNATURE-----
>>> >Version: GnuPG v1.2.2 (FreeBSD)
>>> >
>>> >iD8DBQE/gdGX7fQ833vqzH0RAiFuAJ9xaO4WTzA659wFw4vpYHrEAUGiTgCgtTfv
>>> >abmHk/LrTOUkN6gDC2tIF+M=
>>> >=J1WW
>>> >-----END PGP SIGNATURE-----
>>> >
>>> >
>>>
>>> __________________________________________________________________
>>> McAfee VirusScan Online from the Netscape Network.
>>> Comprehensive protection for your entire computer. Get your free trial
>>> today!
>>> http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397
>>>
>>> Get AOL Instant Messenger 5.1 free of charge. Download Now!
>>> http://aim.aol.com/aimnew/Aim/register.adp?promo=380455
>>>
>>
>>- --
>>Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
>>Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
>>Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
>>-----BEGIN PGP SIGNATURE-----
>>Version: GnuPG v1.2.2 (FreeBSD)
>>
>>iD8DBQE/ge9u7fQ833vqzH0RAvUhAJ9IDWTcx3Wa5BBegK/9AfoQcvLIjQCfcJIq
>>EHN4wR8V62fu7zo3J4CwX00=
>>=xZNX
>>-----END PGP SIGNATURE-----
>>
>>
>
>__________________________________________________________________
>McAfee VirusScan Online from the Netscape Network.
>Comprehensive protection for your entire computer. Get your free trial today!
>http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397
>
>Get AOL Instant Messenger 5.1 free of charge. Download Now!
>http://aim.aol.com/aimnew/Aim/register.adp?promo=380455
>_______________________________________________
>SM-Grimoire mailing list
>SM-Grimoire AT lists.ibiblio.org
>http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
>
__________________________________________________________________
McAfee VirusScan Online from the Netscape Network.
Comprehensive protection for your entire computer. Get your free trial today!
http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397
Get AOL Instant Messenger 5.1 free of charge. Download Now!
http://aim.aol.com/aimnew/Aim/register.adp?promo=380455
-
[SM-Grimoire] named running as bind user,
FubecaPobre, 10/06/2003
- <Possible follow-up(s)>
- RE: [SM-Grimoire] named running as bind user, evraire, 10/06/2003
-
RE: [SM-Grimoire] named running as bind user,
FubecaPobre, 10/06/2003
- Re: [SM-Grimoire] named running as bind user, Pierre Abbat, 10/06/2003
-
RE: RE: [SM-Grimoire] named running as bind user,
evraire, 10/06/2003
- RE: [SM-Grimoire] named running as bind user, Seth Woolley, 10/06/2003
-
RE: [SM-Grimoire] named running as bind user,
FubecaPobre, 10/06/2003
- RE: [SM-Grimoire] named running as bind user, Seth Woolley, 10/06/2003
- RE: [SM-Grimoire] named running as bind user, FubecaPobre, 10/07/2003
- RE: [SM-Grimoire] named running as bind user, FubecaPobre, 10/07/2003
Archive powered by MHonArc 2.6.24.