- WLUG - wlug.mailman3.com

Re: [Wlug] ssh-dummy-shell for OpenSSH???

by Charles R. Anderson

Be careful. OpenSSH has some features that could compromise your security. It lets the user set environment variables when the user connects. A user could upload a library and override C Library functions with LD_PRELOAD to execute whatever they want. There are a couple sftp-only shells that were designed to handle being used in the manner you want, but they caution you to disable the rc features in sshd_config or take other security precautions: http://www.pizzashack.org/rssh/security.shtml On Sat, Feb 08, 2003 at 03:51:38AM -0500, Brian K. White wrote: brian> I have sort-of got this by setting the shell to sftp-server. brian> bizarre, I know, but it works, and a copy of /bin/true does not. brian> brian> in both the real and chroot'ed /etc/passwd's I set the shell to the full brian> path to sftp-server, and sftp works, ssh does not. brian> brian> ssh actually connects and will sit there until you type something, but brian> as soon as you type anything sftp-server says "what is this rubbish?" brian> and promptly hangs up on you. brian> brian> I don't have any real shell, or any other binary besides sftp-server in brian> my chroot tree, and even though users can upload their own, they cannot brian> execute it because their shell is only sftp-server, which is not a shell brian> and cannot execute anything. I hope it doesn't have any cases where it brian> could execute any external program like ls (I know it doesn't need ls brian> specifically, just as an example the way ftpd often uses a ls binary in brian> the chroot path). otherwise a person might be able to upload a shell brian> named <whatever sftp-server might exec> brian> brian> this is OpenSSH 3.5p1 with chroot patch, on SCO Open Server 5.0.6 -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

Feb. 9, 2003

Re: [Wlug] ssh-dummy-shell for OpenSSH???

by Brian K. White

I have sort-of got this by setting the shell to sftp-server. bizarre, I know, but it works, and a copy of /bin/true does not. in both the real and chroot'ed /etc/passwd's I set the shell to the full path to sftp-server, and sftp works, ssh does not. ssh actually connects and will sit there until you type something, but as soon as you type anything sftp-server says "what is this rubbish?" and promptly hangs up on you. I don't have any real shell, or any other binary besides sftp-server in my chroot tree, and even though users can upload their own, they cannot execute it because their shell is only sftp-server, which is not a shell and cannot execute anything. I hope it doesn't have any cases where it could execute any external program like ls (I know it doesn't need ls specifically, just as an example the way ftpd often uses a ls binary in the chroot path). otherwise a person might be able to upload a shell named <whatever sftp-server might exec> this is OpenSSH 3.5p1 with chroot patch, on SCO Open Server 5.0.6 ------------ Actually it does. I tried /bin/false and it fails to setup the ssh connection properly. I guess the shell will let sftp only run specific sftp commands, anything else causes it to exit. -----Original Message----- From: Scott Venier [mailto:scottven@umich.edu] Sent: Wednesday, January 30, 2002 10:58 AM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] ssh-dummy-shell for OpenSSH??? does the ssh-dummy-shell have to actually do anything for sFTP to work, or does it just have to be in /etc/shells? If it just has to be in /etc/shells, /bin/false works. Been using that for years for (non-s)FTP-only accounts. Scott On Wed, 30 Jan 2002, Keller, Tim wrote: > I'm setting up a test environment using OpenSSH built in sFTP server. What > I want to-do is build a chroot environment where people can connect to the > machine via sFTP but not via SSH. > > I know with the commercial version of SSH they have ssh-dummy-shell which > when you try to connect via SSH just bails on you, but lets sFTP work > properly. > > I've done some digging on the web and I haven't found anything that'll > replace this functionality on the OpenSSH side of things. > > Anybody got any ideas/links of an open source version of ssh-dummy-shell. > > Thanks, > Tim. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug -- Brian K. White -- brian(a)aljex.com -- http://www.aljex.com/bkw/ +++++[>+++[>+++++>+++++++<<-]<-]>>+.>.+++++.+++++++.-.[>+<---]>++. filePro BBx Linux SCO Prosper/FACTS AutoCAD #callahans Satriani

Feb. 8, 2003

RE: [Wlug] Disable telnet and ssh, but ftp and email still enable !

by Keller, Tim

Aramico, I'm taking the guess that your users are using pop3 to access their email. If you set their shell to /bin/false this will allow them to access email and ftp, but they won't be able to login. Hope this helps, Tim. -----Original Message----- From: Aramico [mailto:aramico@duahati.com] Sent: Thursday, February 06, 2003 2:33 AM To: wlug(a)mail.wlug.org Subject: [Wlug] Disable telnet and ssh, but ftp and email still enable! Hi all, I have several user in my linux machine. And now, I've just finished configure my qmail server. qmail only works for the user who has the home directory. by this, I've got to create several users with their directory if I want to create an email address for them. It's not secure! How can I make disable ssh and telnet to my user ? By this my user still can access the email and ftp, but can not login via telnet and ssh service. what configuration that I need to do ? Thanks Man.

Feb. 6, 2003

Disable telnet and ssh, but ftp and email still enable!

by Aramico

Hi all, I have several user in my linux machine. And now, I've just finished configure my qmail server. qmail only works for the user who has the home directory. by this, I've got to create several users with their directory if I want to create an email address for them. It's not secure! How can I make disable ssh and telnet to my user ? By this my user still can access the email and ftp, but can not login via telnet and ssh service. what configuration that I need to do ? Thanks Man.

Feb. 6, 2003

webmasters.com web hosting

by Brett Russ

Anyone have any experience with http://www.webmasters.com? I am considering transferring from logicinternet.com, the services promised by the former are seemingly much better, so I am looking for some local testimonials. thanks! Brett

Feb. 4, 2003

Virtual Hosting

by jose sanchez

Hello All: I am experiencing a weird problem with Name based virtual hosting with apache. I don't know if I am doing this correctly. The webserver is behind a firewall that is NATing traffic to it. I have three domain names, example: domain1.com, domain2.com, and domain3.com. I have the registrar of the domains forwarded to my external ip (24.31.xx.xx). The webserver's ip is 192.168.2.50. This is what the http.conf file looks like: NameVirtualHost 192.168.2.50 <VirtualHost 192.168.2.50> ServerName www.domain1.com ServerAdmin wilsan816(a)yahoo.com DocumentRoot /home/domain1/www </VirtualHost> <VirtualHost 192.168.2.50> ServerName www.domain2.com ServerAdmin wilsan816(a)yahoo.com DocumentRoot /home/domain2/www </VirtualHost> <VirtualHost 192.168.2.50> ServerName www.domain3.com ServerAdmin wilsan816(a)yahoo.com DocumentRoot /home/domain3/www </VirtualHost> Somehow the virtual hosting is not working. When I type www.domain2.com or www.domain3.com on the browser I get the content or pages of domain1.com. I don't know why is doing that. When I type www.domain1.com, obviously works. Now, the address bar changes from www.domainx.com to 24.31.xx.xx/index.php. The registrar where the domains are registered doesn't offer free "Domain Masking" (when the domain name stays on the browser' address bar). I don't know if this is why I am having this problem. If anyone have experienced this before please let me know. Thanks in advance. ===== "An ounce of gold cannot buy an ounce of time." - Anonymous www.whmicro.com __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

Feb. 4, 2003

RE: [Wlug] Blanking screen blanking @#$!

by Brian J. Conway

I believe they are separate. I use 'xset s off' in my WindowMaker startup script to turn off the X screen blanking, I've never bothered to turn off console blanking. -b > I thought that the VT blanking was separate from the X blanking. Any > chance you're running X in frame buffer mode? Maybe then the VT > blanking matters? Just a shot in the dark. > > -----Original Message----- > From: wlug-admin(a)mail.wlug.org [mailto:wlug-admin@mail.wlug.org] On > Behalf Of Chuck Homic > Sent: Monday, February 03, 2003 9:49 AM > To: wlug(a)mail.wlug.org > Subject: Re: [Wlug] Blanking screen blanking @#$! > > > On Sun, Feb 02, 2003 at 02:56:54PM -0500, Andy Stewart wrote: > > > Turning off the #!$@ screen saver! > > > > Are you running KDE, GNOME, or something else? In KDE, you turn off > > the > > screen saver in the control center. Others? I don't know. > > The answer would fall squarely on "something else." Currently it's > afterstep, but I don't think the WM is a factor because it happens when > I'm using no WM at all (Hardcore X) or at the VT or anything. I was > grepping some kernel sources which led me to the setterm hypothesis, but > I'm still nowhere. > > -Chuck > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -- Brian J. Conway bconway(a)alum.wpi.edu "LINUX is obsolete" - Andrew S. Tanenbaum, creator of Minix - Jan 29, 1992

Feb. 3, 2003

Re: [Wlug] Blanking screen blanking @#$!

by Chuck Homic

On Mon, Feb 03, 2003 at 10:01:04AM -0500, Marc Hughes wrote: > I thought that the VT blanking was separate from the X blanking. I'm sure it is. :) But I'm desperate. Also, instinct tells me that if there's any kind of "power management" blanking, it would work regardless of what video mode I'm in. (And with an LCD, there's no way to really tell the difference between a blank screen, and power saving.) > Any chance you're running X in frame buffer mode? Maybe then the VT > blanking matters? Just a shot in the dark. Nope, straight up XFree86 to the hardware. Really all I need is more ways to turn off screen blanking in Linux and/or X. I'll try 'em all and report which one actually worked for me. ;) But I've exhausted (I think) setterm and xset. What else is there? -Chuck

Feb. 3, 2003

RE: [Wlug] Blanking screen blanking @#$!

by Marc Hughes

I thought that the VT blanking was separate from the X blanking. Any chance you're running X in frame buffer mode? Maybe then the VT blanking matters? Just a shot in the dark. -----Original Message----- From: wlug-admin(a)mail.wlug.org [mailto:wlug-admin@mail.wlug.org] On Behalf Of Chuck Homic Sent: Monday, February 03, 2003 9:49 AM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] Blanking screen blanking @#$! On Sun, Feb 02, 2003 at 02:56:54PM -0500, Andy Stewart wrote: > > Turning off the #!$@ screen saver! > > Are you running KDE, GNOME, or something else? In KDE, you turn off > the > screen saver in the control center. Others? I don't know. The answer would fall squarely on "something else." Currently it's afterstep, but I don't think the WM is a factor because it happens when I'm using no WM at all (Hardcore X) or at the VT or anything. I was grepping some kernel sources which led me to the setterm hypothesis, but I'm still nowhere. -Chuck _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

Feb. 3, 2003

Re: [Wlug] Blanking screen blanking @#$!

by Chuck Homic

On Sun, Feb 02, 2003 at 02:56:54PM -0500, Andy Stewart wrote: > > Turning off the #!$@ screen saver! > > Are you running KDE, GNOME, or something else? In KDE, you turn off the > screen saver in the control center. Others? I don't know. The answer would fall squarely on "something else." Currently it's afterstep, but I don't think the WM is a factor because it happens when I'm using no WM at all (Hardcore X) or at the VT or anything. I was grepping some kernel sources which led me to the setterm hypothesis, but I'm still nowhere. -Chuck

Feb. 3, 2003