The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1036 »

fatherdog: Feb 16, 2005

fletcher posted:

Didn't see this posted in here yet, it sounds pretty bad

http://seclists.org/oss-sec/2014/q3/649

My understanding is that the main thing that this allows you to do is run arbitrary commands beyond those that the shell allows you to do, meaning the main things it allows in terms of actual privilege escalation are people with sudo access being able to run arbitrary commands not on the approved list, and people using CGI scripts that spawn bash scripts to run arbitrary commands as the apache user. The latter being obviously rather more serious.

# ? Sep 25, 2014 02:24

Adbot: ADBOT LOVES YOU

# ? May 30, 2024 23:08

evol262: Nov 30, 2010; #!/usr/bin/perl

Hopefully few people are using CGI with shell, but it's potentially quite serious for any public service which relies on privilege separation through scripted logins (some source control systems, some shell servers, znc/BNC irc bots, etc).

If SSH is allowed with bash as a shell in any way (which is pretty much anything that's not nologin, since default shells can be bypasses)...

# ? Sep 25, 2014 03:36

fatherdog: Feb 16, 2005

evol262 posted:

Hopefully few people are using CGI with shell, but it's potentially quite serious for any public service which relies on privilege separation through scripted logins (some source control systems, some shell servers, znc/BNC irc bots, etc).

If SSH is allowed with bash as a shell in any way (which is pretty much anything that's not nologin, since default shells can be bypasses)...

I believe PHP scripts can also potentially spawn shells. Our biggest concern was cpan and drupal instances, which tend to be a bit wild-west-y

I'm still not quite getting the peril in ssh using bash as a shell; how do you wind up escalating privilege above whatever account you're accessing?

# ? Sep 25, 2014 04:03

evol262: Nov 30, 2010; #!/usr/bin/perl

fatherdog posted:

I believe PHP scripts can also potentially spawn shells. Our biggest concern was cpan and drupal instances, which tend to be a bit wild-west-y

I'm still not quite getting the peril in ssh using bash as a shell; how do you wind up escalating privilege above whatever account you're accessing?

It's more about potentially breaking out in the same way as everything else. For example, you can break out of gitlab. And SVN. And gitolite. And maybe github (I'm sure they're already patched).

Git and SVN (and ansible and other services which rely on it) aren't so much "escalation to root" as "escalation to seeing everyone else's poo poo", though sometimes root, same as apache, etc

# ? Sep 25, 2014 04:15

fatherdog: Feb 16, 2005

evol262 posted:

It's more about potentially breaking out in the same way as everything else. For example, you can break out of gitlab. And SVN. And gitolite. And maybe github (I'm sure they're already patched).

Git and SVN (and ansible and other services which rely on it) aren't so much "escalation to root" as "escalation to seeing everyone else's poo poo", though sometimes root, same as apache, etc

Ah, so it's just a lot more programs than I thought using bash shell, and enabling an escalation to their service account.

# ? Sep 25, 2014 04:27

ewe2: Jul 1, 2009

fatherdog posted:

Ah, so it's just a lot more programs than I thought using bash shell, and enabling an escalation to their service account.

The really nasty bit is being able to hack via SSH because you can use shell evaluation to skip indirect hops (eg corporate gateways). Ubuntu has been quicker on the draw than Debian so far, already patched.

# ? Sep 25, 2014 12:50

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

ewe2 posted:

The really nasty bit is being able to hack via SSH because you can use shell evaluation to skip indirect hops (eg corporate gateways). Ubuntu has been quicker on the draw than Debian so far, already patched.

Note that the patches for Ubuntu and Red Hat are incomplete, and bash is still affected by a separate, more specific CVE.

# ? Sep 25, 2014 13:09

fatherdog: Feb 16, 2005

Misogynist posted:

Note that the patches for Ubuntu and Red Hat are incomplete, and bash is still affected by a separate, more specific CVE.

It'd be helpful to actually mention what that CVE is

EDIT: I assume you're referring to https://access.redhat.com/articles/1200223

fatherdog fucked around with this message at 13:30 on Sep 25, 2014

# ? Sep 25, 2014 13:27

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

This is why you don't build your infrastructure on a parser that has Quote Removal as a step. Also, nice commit messages

# ? Sep 25, 2014 16:07

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

fatherdog posted:

It'd be helpful to actually mention what that CVE is

EDIT: I assume you're referring to https://access.redhat.com/articles/1200223

Phonepostin'

# ? Sep 25, 2014 16:45

fatherdog: Feb 16, 2005

What's the over/under on how long till Oracle bothers to put out a patch for Solaris?

# ? Sep 25, 2014 17:31

ewe2: Jul 1, 2009

fatherdog posted:

It'd be helpful to actually mention what that CVE is

EDIT: I assume you're referring to https://access.redhat.com/articles/1200223

Thanks for this. I checked out the original tweeter and it seems the patchjob hasn't been done properly. Another demonstration, which I tried myself:

code:

$ function a a>\[hit return]
> foo
bash: syntax error near unexpected token `a'
bash: -ne: command not found
$ whatever
bash: whatever: command not found
$ ls
echo

That's a zero-length file called "echo". The original post is here

# ? Sep 25, 2014 19:02

My Rhythmic Crotch: Jan 13, 2011

Working on a little webapp, and I'd like to send mail from my domain for account activations and other messages which may be part of the application. Gmail and Zoho both mark my messages as spam currently, while my work email does not.

I have plugged my domain into dnsstuff.com and it generated 3 failures: SOA serial agreement, Acceptance of postmaster, and Acceptance of abuse. The last two I can resolve by adding receiving accounts for, but the "SOA serial agreement" I'm not sure. Could that be due to a couple of the namecheap DNS servers not being online?

Anyway, I have no idea if any of those failures are taking into consideration for letting mail past spam filters. If anyone has any insight on this, I'd be glad to hear it.

# ? Sep 25, 2014 21:14

fletcher: Jun 27, 2003; ken park is my favorite movie; Cybernetic Crumb

My Rhythmic Crotch posted:

Working on a little webapp, and I'd like to send mail from my domain for account activations and other messages which may be part of the application. Gmail and Zoho both mark my messages as spam currently, while my work email does not.

I have plugged my domain into dnsstuff.com and it generated 3 failures: SOA serial agreement, Acceptance of postmaster, and Acceptance of abuse. The last two I can resolve by adding receiving accounts for, but the "SOA serial agreement" I'm not sure. Could that be due to a couple of the namecheap DNS servers not being online?

Anyway, I have no idea if any of those failures are taking into consideration for letting mail past spam filters. If anyone has any insight on this, I'd be glad to hear it.

Juse use a service like Amazon SES, Mailgun, or Sendgrid, etc to send emails. It's not worth the headache of doing it yourself.

# ? Sep 25, 2014 23:09

My Rhythmic Crotch: Jan 13, 2011

poo poo, I had no idea there was email as a service :v:

Thanks, I will go with that.

# ? Sep 25, 2014 23:29

jre: Sep 2, 2011; To the cloud ?

My Rhythmic Crotch posted:

poo poo, I had no idea there was email as a service Thanks, I will go with that.

Mandrill is free below 12,000 messages a month, and makes it easy to set up dkim, spf etc.

# ? Sep 25, 2014 23:34

SurgicalOntologist: Jun 17, 2004

I'm getting websocket errors trying to use IPython Notebook behind a nginx https -> http reverse proxy. It's also running on a subpath, at <server>/ipython/.

Strange thing is, it was working earlier today from a different machine (if it could matter, from a computer lab at my university--the server is in my office on the same campus).

Google just turns up people needing to upgrade nginx or add a few lines that I already had. I've checked my version, checked against all the configs I can find online, nothing seems wrong.

Any idea of something I could try, headers to look for, whatever? I have no idea what I'm doing and don't know how to troubleshoot something like this. Any help would be appreciated.

# ? Sep 26, 2014 02:58

Baron Bifford: May 24, 2006; Can't post for 2 years!

I tried to label the Linux partition of my hard drive "Linux_Partition", but that was apparently too long a label and instead had to choose "LinuxPartition". Are ext4 labels limited to 14 characters?

EDIT: Weird. Partition Magic didn't accept more than 14 characters for the label, but GParted did it with no problem.

Baron Bifford fucked around with this message at 10:11 on Sep 26, 2014

# ? Sep 26, 2014 08:18

spankmeister: Jun 15, 2008

Protip: don't use partition magic.

# ? Sep 26, 2014 10:55

hooah: Feb 6, 2006; WTF?

I have Ubuntu on a VM to work on Linux-specific school homework. I'm doing a project to write a basic shell, and it has to be able to process cd commands. We've been lead to attempt this via chdir, but that didn't seem to be working, so I tried it at the terminal and was told "No command 'chdir' found, did you mean:". WTF? Is chdir somehow not on Ubuntu??

hooah fucked around with this message at 22:05 on Sep 26, 2014

# ? Sep 26, 2014 12:20

Ninja Rope: Oct 22, 2005; Wee.

chdir is a thing the shell does, not a command on the system the shell runs for you. Saying more than that might be handing you the answer...

# ? Sep 26, 2014 22:08

hooah: Feb 6, 2006; WTF?

Ninja Rope posted:

chdir is a thing the shell does, not a command on the system the shell runs for you. Saying more than that might be handing you the answer...

I was under the impression that what you said applied to cd, which called chdir?

# ? Sep 26, 2014 22:46

pliable: Sep 26, 2003; this is what u get for "180 x 180 avatars"

this is what u fucking get u bithc; Fun Shoe

quote:

So I booted up Ubuntu Gnome 14.04 after about a month, and was greeted with this surprise: http://i.imgur.com/JFL9fA4.png. Anyone know how to fix this and bring the regular bar back at the top? Or is this some new dumb "feature"? It's a pain in the dick to quickly move the window around. I've looked through the preferences and played around with poo poo and nothing seems to work (or I missed something obvious)...

Thank y'all for the help!

Desktop environment: Gnome 3.10.4
Window Manager: X window
I've only tweaked the color scheme, as far as I know.
This was different as soon as I booted it up.

EDIT 2: Well poo poo, nevermind. It's a feature...in that case, anyone know how to revert it back to the old style?

Cross posting here to get more exposure.

SurgicalOntologist posted:

You should probably mention what version of Ubuntu you're running, what desktop environment, the window manager, if you've tweaked it at all, whether you actually updated anything or if it was just different as soon as you booted up... etc.

Whoops, good idea, updated post with relevant info. Thanks!

pliable fucked around with this message at 23:42 on Sep 26, 2014

# ? Sep 26, 2014 23:12

SurgicalOntologist: Jun 17, 2004

You should probably mention what version of Ubuntu you're running, what desktop environment, the window manager, if you've tweaked it at all, whether you actually updated anything or if it was just different as soon as you booted up... etc.

# ? Sep 26, 2014 23:15

evol262: Nov 30, 2010; #!/usr/bin/perl

hooah posted:

I was under the impression that what you said applied to cd, which called chdir?

"No command found" means the shell can't find it in the path, which is correct and reasonable.

chdir is a c function which gets called from "cd", sure, but it is not a command you can use from the shell. You need to use C or chdir exposed elsewhere (python's os.chdir() or similar). Do not try to re-implement a shell with a shell.

# ? Sep 26, 2014 23:57

hooah: Feb 6, 2006; WTF?

evol262 posted:

"No command found" means the shell can't find it in the path, which is correct and reasonable.

chdir is a c function which gets called from "cd", sure, but it is not a command you can use from the shell. You need to use C or chdir exposed elsewhere (python's os.chdir() or similar). Do not try to re-implement a shell with a shell.

But I can call it from the shell when I ssh into a school machine. Or is it actually an alias for something else?

# ? Sep 27, 2014 00:13

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

hooah posted:

But I can call it from the shell when I ssh into a school machine. Or is it actually an alias for something else?

Stop asking the same question over and over and look up how cd/chdir actually work.

Here's a hint, though: a process can't modify the environment of the process that calls it.

# ? Sep 27, 2014 00:15

Applebees: Jul 23, 2013; yospos

hooah posted:

But I can call it from the shell when I ssh into a school machine. Or is it actually an alias for something else?

On some systems, chdir is an alias for the command cd but not on Ubuntu, and I think most systems don't have that alias.

# ? Sep 27, 2014 00:20

hooah: Feb 6, 2006; WTF?

Misogynist posted:

Stop asking the same question over and over and look up how cd/chdir actually work.

Here's a hint, though: a process can't modify the environment of the process that calls it.

I did end up figuring it out. I try to read man pages, but they tend to assume you know a whole lot of stuff that I don't yet, so I get bogged down a lot.

Applebees posted:

On some systems, chdir is an alias for the command cd but not on Ubuntu, and I think most systems don't have that alias.

Thanks for answering my question.

# ? Sep 27, 2014 00:53

jaegerx: Sep 10, 2012; Maybe this post will get me on your ignore list!

Up for my RHCA. Anyone here taken it yet? Don't want spoilers just asking if it's a real test or a joke like the rhce.

# ? Sep 27, 2014 01:00

evol262: Nov 30, 2010; #!/usr/bin/perl

jaegerx posted:

Up for my RHCA. Anyone here taken it yet? Don't want spoilers just asking if it's a real test or a joke like the rhce.

With what certificates?

RHCSA->RHCE->specialized certs (get 5 of these and be an rhca). Difficulty depends on track

hooah posted:

I did end up figuring it out. I try to read man pages, but they tend to assume you know a whole lot of stuff that I don't yet, so I get bogged down a lot.

If you check a manpage and it shows you function signatures and "#include <something.h>", you need to write C or use a language which has already done the binding for you (for glibc, almost all languages have done this for you in various libraries, often core)

# ? Sep 27, 2014 01:29

jaegerx: Sep 10, 2012; Maybe this post will get me on your ignore list!

evol262 posted:

With what certificates?

RHCSA->RHCE->specialized certs (get 5 of these and be an rhca). Difficulty depends on track

Haven't decided yet. Probably openstack and performance tuning. Large scale deployment and maybe the data virtualization.

I'm just checking to see if it's a sure pain in the rear end gotta spend time in the lab or like when I renewed my rhce I spent a day reviewing and took it hungover.

I still have to get the rhcsa but I ain't concerned about that.

# ? Sep 27, 2014 02:00

evol262: Nov 30, 2010; #!/usr/bin/perl

jaegerx posted:

Haven't decided yet. Probably openstack and performance tuning. Large scale deployment and maybe the data virtualization.

I'm just checking to see if it's a sure pain in the rear end gotta spend time in the lab or like when I renewed my rhce I spent a day reviewing and took it hungover.

I still have to get the rhcsa but I ain't concerned about that.

I haven't looked in a while, but the rhcsa replaced the rhct. I'd be really surprised if an rhce had to take it, even if you never have, since it's a lesser cert.

Openstack will need studying and labbing just for neutron, really...

# ? Sep 27, 2014 02:54

jaegerx: Sep 10, 2012; Maybe this post will get me on your ignore list!

evol262 posted:

I haven't looked in a while, but the rhcsa replaced the rhct. I'd be really surprised if an rhce had to take it, even if you never have, since it's a lesser cert.

Openstack will need studying and labbing just for neutron, really...

Yeah redhat is doing a money grab and requiring the rhcsa and rhce for the rhca. I just renewed my rhce for the 3rd time and I apparently have to go back and do the rhcsa to get an rhca.

Figure that out.

# ? Sep 27, 2014 03:04

RFC2324: Jun 7, 2012; http 418

If you want the RHCE, currently, you have to already have the RHCSA as well.

I'm currently working on both, if I can ever stop drinking long enough to study.

# ? Sep 27, 2014 03:13

Precambrian Video Games: Aug 19, 2002

I spent several pointless hours trying to install Fedora 20 to my liking and found the following things:

Anaconda doesn't let you modify the partition layout directly, or even view it before it's created. Okay then. I mean yes you can modify things to some extent, but you won't see exactly how each drive is laid out until you go through with it. I hope you like the ordering of the partitions (doesn't this matter for older SSDs?).

Anaconda doesn't seem to let you install to existing partitions. Okay then again.

I had issues getting a raid 0 swap working. It seemed to work at first, but then after trying to re-install, it would fail to create the array for non-obvious reasons. I gave up on it because it was a dumb idea anyway with only HDDs. Maybe someone with SSDs would care.

You can only choose to install the bootloader on one drive. If you do so, you can't span /boot across any other drives, so no raid1 /boot. You can only only install /boot onto raid1 if you opt not to install the bootloader through the gui, but then you have to install it manually later - which isn't difficult, I just didn't know how right away.

... and I guess I just now realized that F20 doesn't install or enable sshd by default, so I know what I'm doing tomorrow.

I don't really have questions now, except that I'm amused to find that while older gnome 3 had no power button (just logout), the newer gnome has a power button but no logout. Apparently that's because it hides the username button thing in the top bar if there is only one user on the machine.

# ? Sep 27, 2014 03:52

RFC2324: Jun 7, 2012; http 418

eXXon posted:

... and I guess I just now realized that F20 doesn't install or enable sshd by default, so I know what I'm doing tomorrow.

Can't speak for anything else, but since Fedora is a desktop distro, it would not make sense for sshd to be there by default, since having it open is a security risk that most users don't need to have available. If you want a server, Fedora isn't the best route anyway.

# ? Sep 27, 2014 04:24

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

New Anaconda is really bad. I tried to stop it. I failed.

# ? Sep 27, 2014 04:44

evol262: Nov 30, 2010; #!/usr/bin/perl

eXXon posted:

I spent several pointless hours trying to install Fedora 20 to my liking and found the following things:

Anaconda doesn't let you modify the partition layout directly, or even view it before it's created. Okay then. I mean yes you can modify things to some extent, but you won't see exactly how each drive is laid out until you go through with it. I hope you like the ordering of the partitions (doesn't this matter for older SSDs?).

Anaconda doesn't seem to let you install to existing partitions. Okay then again.

I had issues getting a raid 0 swap working. It seemed to work at first, but then after trying to re-install, it would fail to create the array for non-obvious reasons. I gave up on it because it was a dumb idea anyway with only HDDs. Maybe someone with SSDs would care.

You can only choose to install the bootloader on one drive. If you do so, you can't span /boot across any other drives, so no raid1 /boot. You can only only install /boot onto raid1 if you opt not to install the bootloader through the gui, but then you have to install it manually later - which isn't difficult, I just didn't know how right away.

... and I guess I just now realized that F20 doesn't install or enable sshd by default, so I know what I'm doing tomorrow.

I don't really have questions now, except that I'm amused to find that while older gnome 3 had no power button (just logout), the newer gnome has a power button but no logout. Apparently that's because it hides the username button thing in the top bar if there is only one user on the machine.

If you want to do this, kickstart. The anaconda recommendation is "simple installer for new users, advanced users should kickstart", like other operating systems which are pretty much " click next until done" (windows, osx, etc)

# ? Sep 27, 2014 06:12

Adbot: ADBOT LOVES YOU

# ? May 30, 2024 23:08

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

evol262 posted:

If you want to do this, kickstart. The anaconda recommendation is "simple installer for new users, advanced users should kickstart", like other operating systems which are pretty much " click next until done" (windows, osx, etc)

New Anaconda is more like "click next until you can't click it anymore, start clicking randomly on the screen until something happens and suddenly you can click next again". It's really confusing and bad.

# ? Sep 27, 2014 06:13

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1036 »