Releases

Current version
Git/Latestdiff: 1.5.6

Latest Snapshots
Produced after each commit or rebase to new upstream version

GIT
RSBAC source code, can be unstable sometimes

Events

No events planned

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

--- wiki:experiences:telmich [2005/12/30 14:31] – 84.161.74.190
+++ wiki:experiences:telmich [2006/05/02 13:40] (current) – external edit 127.0.0.1
@@ Line 5: / Line 5: @@
   * motivated developers
   * small community (still)
+  * still unknown to many people out there
+====== TODO ======
+Things I want to achieve / do with RSBAC:
+  - Create a new user, who
+    - may create, delete and modify other users (like a end user compatible user manager)
+  - Understand and use PM (there is no "real" documentation!)
+  - Create a new user, who can shutdown / reboot the system
+  - use jails
+  - use rsbac_mod for apache, as soon as vhosts are supported
+  - test daemons, check whether they can run with rsbac
+  - test cinit with RSBAC
 ====== common problems ======
@@ Line 12: / Line 26: @@
 When you enabled ssh (see below) you may be able to **directly** login as //you// or **root**, but using __su__
 or __sudo__ may fail, because you are normally **not** allowed to setuid (to change) to another user.
+===== upgrading your system =====
+When you upgrade your system (especially ssh, login or pam) you may lose complete control
+over your system. Like I did some seconds ago:
+  - I logged in as root
+  - I typed "apt-get update && apt-get dist-upgrade"
+  - I went away, shopping for the company
+  - I came back and wanted to login as "rsbac_400"
+  - The answer was "setuid: Operation not permitted"
+What happened?
+  - The update saw that there are new packages and dist-upgrade installs them
+  - The dist upgrade replaced ///bin/login//
+  - The inode of /bin/login changed
+  - The old settings for /bin/login vanished
+  - I am not able to login anymore
+  - sshd also got replaced, so the connection is reseted by the rsbac host
+**How to solve the problem**
+  - I am right now trying it...
+  - I rebooted the system
+  - At the grub prompt I added //rsbac_auth_enable_login// as kernel parameter
+  - Now I am able to login as rsbac_400 on the console (at least in theory it still boots)
+  - And now I can restore the standard settings:
+     - Allow /bin/login to setuid (use //rsbac_fd_menu /bin/login//)
+     - Allow /usr/sbin/sshd to setuid to everybody (no role implemented for ssh yet)
 ====== HOWTO ======
@@ Line 155: / Line 197: @@
   - call /usr/sbin/squid
   - That's how it worked here
 ==== configuring apache (http server) ====
 [[http://trusteddebian.org/Members/tsauter/rsbac-apache-rc.txt/view]]
-but bevor start, mayby you build for all directorys wich start from the root-directory a rc-type.
-do it in the softmode.
-go to rsbac_menu, then RC Types:
-there FD File/Dire type name  and New Type : Enter type number to add  ; just press enter, then again enter and chose the name for this rc-type. the first is
-/bin than again and this all other directorys but exclude /boot /proc /dev /sys.
-i also prefer to build a rc-type for /usr/bin /usr/sbin , because the /use has many public inside so the rc-type /usr becomes very public :). also later you can this do for the /var .
-the next is assign this created rc-types to the directorys.
-in the rsbac_menu go tho File/Dir Atrributes:  then FD Name:  /bin
-now when /bin is chose go to RC Type FD: and you will see here now the bevor created rc-types.
-wich is to take, for better remembering use the /bin and press enter.
-you must see now RC Type FD:  6 / bin  e.g mayby 8 or 9.
-this step must repeat for every RC Type wich are left over, but bevor
-echo debug_adf_rc 1 > /proc/rsbac-info/debug
-echo debug_nosyslog 1 > /proc/rsbac-info/debug  <-- when you do this you must have the rklogd running for log.
-in this time and later also very quickly the logfile can grow, if you have have no seperate partition for the security-user and for /var/log than and your space is only 500MB for the / directory, it can very quickly fill up your partition if both logger are write and the system will mayby stand because out off space. thats why you dont need the syslog for rsbac-logging when rklogd is present.
-i prefer the setup over ssh, because i login wich so many konsoles how i need. two i need for, one from this as root-user
-tail -f /var/log/syslog  and the second as security-user tail -f /security/log/security-log .
-the directorys are mayby different.
-now starts to visit the logfiles.
-continue foolow
 ==== configuring openvpn (vpn server) ====
@@ Line 379: / Line 400: @@
 ==== creating a user/group administrator  ====
+===== dosinux.schottelius.org =====
+==== configuring apache2 (http server) ====
+  - Do apt-get install apache2 before
+  - See what happens:<code>
+dosinux# /usr/sbin/apache2
+dosinux# dmesg
+0000001236|rsbac_adf_request(): request READ, pid 3517, ppid 2735, prog_name apache2,
+prog_file /usr/sbin/apache2, uid 0, target_type GROUP, tid 33, attr none, value none, result
+NOT_GRANTED by RC ACL
+0000001237|rsbac_adf_request(): request READ, pid 3518, ppid 3517, prog_name apache2,
+prog_file /usr/sbin/apache2, uid 0, target_type GROUP, tid 33, attr none, value none,
+result NOT_GRANTED by RC ACL
+0000001238|rsbac_adf_request(): request CHANGE_OWNER, pid 3519, ppid 3518, prog_name
+apache2, prog_file /usr/sbin/apache2, uid 0, target_type PROCESS, tid 3519, attr owner,
+value 33, result NOT_GRANTED by AUTH
+0000001239|rsbac_adf_request(): request CHANGE_OWNER, pid 3520, ppid 3518, prog_name
+apache2, prog_file /usr/sbin/apache2, uid 0, target_type PROCESS, tid 3520, attr owner,
+value 33, result NOT_GRANTED by AUTH
+0000001240|rsbac_adf_request(): request CHANGE_OWNER, pid 3521, ppid 3518, prog_name
+apache2, prog_file /usr/sbin/apache2, uid 0, target_type PROCESS, tid 3521, attr owner,
+value 33, result NOT_GRANTED by AUTH
+0000001241|rsbac_adf_request(): request CHANGE_OWNER, pid 3522, ppid 3518, prog_name
+apache2, prog_file /usr/sbin/apache2, uid 0, target_type PROCESS, tid 3522, attr owner,
+value 33, result NOT_GRANTED by AUTH
+0000001242|rsbac_adf_request(): request CHANGE_OWNER, pid 3523, ppid 3518, prog_name
+apache2, prog_file /usr/sbin/apache2, uid 0, target_type PROCESS, tid 3523, attr owner,
+value 33, result NOT_GRANTED by AUTH
+</code>
+  - Add the AUTH capability 33 (www-data), use rsbac_400 and rsbac_fd_menu /usr/sbin/apache2
+  - TADA, it runs:<code>
+dosinux# /usr/sbin/apache2
+dosinux# dmesg
+0000001243|rsbac_adf_request(): request READ, pid 3692, ppid 2718, prog_name apache2, prog_file /usr/sbin/apache2, uid 0, target_type GROUP, tid 33, attr none, value none, result NOT_GRANTED by RC ACL
+0000001244|rsbac_adf_request(): request READ, pid 3693, ppid 3692, prog_name apache2, prog_file /usr/sbin/apache2, uid 0, target_type GROUP, tid 33, attr none, value none, result NOT_GRANTED by RC ACL
+dosinux# ps axu | grep apache2
+root      3693  0.8  0.9  16744  5436 ?        Ss   16:02   0:00 /usr/sbin/apache2
+www-data  3694  0.0  0.9  16744  5456 ?        S    16:02   0:00 /usr/sbin/apache2
+www-data  3695  0.0  0.9  16744  5456 ?        S    16:02   0:00 /usr/sbin/apache2
+www-data  3696  0.0  0.9  16744  5456 ?        S    16:02   0:00 /usr/sbin/apache2
+www-data  3697  0.0  0.9  16744  5456 ?        S    16:02   0:00 /usr/sbin/apache2
+www-data  3698  0.0  0.9  16744  5456 ?        S    16:02   0:00 /usr/sbin/apache2
+root      3701  0.0  0.0   1520   328 pts/0    R+   16:02   0:00 grep apache2
+</code>
+===== Roles =====
+Roles should make life easier, currently they are just making my life more complicated. Let's see what we can do with them.
+==== creating a "user_manager" ====
+The first problem to solve with Roles is to create a user, which is able to
+  - create
+  - delete
+  - and modify other users (like a end user compatible user manager)
+First of all, I create a user:
+  - login as rsbac_400, do <code>rsbac_useradd -d /home/user/user_manager user_manager</code>
+  - now do <code>rsbac_passwd -n user_manager</code>
+  - login as root and do<code>
+mkdir /home/user/user_manager
+chown user_manager ~user_manager</code>
+  - Now we successfully created a normal user.
+  - TOBEDONE...
 ===== Backup =====

//