December 2009 - main

Relative merits/security of Public Key and old-fashioned password with ssh
by Chris G 16 Dec '09

16 Dec '09

I'm probably being totally paranoid but still. Is there any significant difference in security between using password login and Public Key when using ssh to connect to my home server? Just to clarify ssh connections are *only* allowed from two systems 'out there' where I have shell login accounts so an intruder has to get onto one of those systems before having any possibility of connecting to my server. Is it any easier for an intruder to guess my password (remember, no access to the system so I don't think a dictionary attack is possible is it?) or to guess the encryption key for my private key? I can't see any really significant difference between the two but I'm open to any comments. -- Chris Green

3 4

Security thoughts/questions
by Chris G 14 Dec '09

14 Dec '09

I have a small SoHo LAN which is used by the family (mostly just two of us now) for personal use and in running our small Ltd. company. There's no very sensitive (as in confidential) information on any of the systems but I guess there is stuff in E-Mails etc. that we don't really want to escape. More impportant is the *safety* (as in not losing) of a lot of information such as the company accounts, E-Mail trails of work we do and so on. Recently I have set up a small server machine which now handles DNS (using dnsmasq), has the publicly visible web pages (not the company site but bits and pieces that I want to make visible to 'the world') and runs an SMTP server. This means that firstly I can turn my desktop machine off now (it used to be the server) and secondly there's no direct access from the outside world to my desktop machine. The firewall is set up to allow only ssh, http and SMTP connections from the outside and all three of these are routed to the server machine. So far so good. Now I'm wondering whether I have overlooked anything obvious and/or if there's any way I can improve things. The most likely sort of exploit/damage as I see it is someone breaking into the server machine and just making a mess. I keep the server software as up to date as possible with security fixes etc. for apache, ssh and SMTP (postfix) so it should be fairly difficult to break in. I only allow ssh connections from two hosts (where I have shell login accounts) so password guessing needs to get there first and then into the server. All important data from desktop machines is backed up to a NAS in the garage (separate machine from the server) so that should protect against fire damage and even burglars as they're unlikely to break into both the house and the garage as well as notice hardware in both places. I also back up the critical company files 'off site' to my hosting company's site. The final barrier(s) I'm thinking about are the ease (or otherwise) of doing damage if someone breaks into one system in the LAN. For example would I win anything by enabling the root account on the server (currently sudo only) so that if someon breaks in as me they'd still have to guess the root password to be able to do anything nasty. Are there any NFS exploits I should worry about? There are quite a few NFS mounts across the various systems. -- Chris Green

1 0

Forms design for web pages - any ideas?
by Chris G 14 Dec '09

14 Dec '09

I'm looking for a tool a bit like the Forms Design part of Open Office (or MS Access for that matter) that will build web data input forms. I don't want a full-blown CMS or site design package, I just want to be able to build some simple data entry pages to load data into a database from the web (well, actually my intranet). Is there anything out there which can do this? ... and I have looked quite hard, the best I've found so far is phpmyedit. (This is as an alernative to using Open Office Base) -- Chris Green

7 12

How to set up NFS file sharing area for two users to read/write easily?
by Chris G 14 Dec '09

14 Dec '09

I want to set up a 'file sharing' area on my server machine where two users can both easily read and write files. I want this to be an NFS mount on both users' machines so it's just an 'ordinary' directory as they see at and it can also be mounted as a VirtualBox shared drive. Ideally I'd like the shared area to be owned by a third user, i.e. the two users reading and writing files are, say, 'fred' and 'bert' while the shared area is owned by 'shared'. Is there any way to set up NFS so that if fred writes a file to the area owned by 'shared' it automatically becomes owned by shared and similarly for bert? I don't really want to end up with shared's files owned by all sorts of different users. It would be fairly trivial to set up the shared area to have general write permissions for everyone but it would still be only too easy for either fred or bert to write files there that wouldn't then be writeable by the other users. I guess I essentially want both fred and bert to become user shared when they do anything in shared's file system. -- Chris Green

1 1

lp printing and permissions
by Peter Alcibiades 13 Dec '09

13 Dec '09

OK, profiting from the collective wisdom, my gdi printer is set up as raw in CUPS and is now working very nicely with cat myfile>/dev/usb/lp0 At least as far as printing is concerned, there are some issues with sending it control characters, but that's for later after some more wrestling with it myself. Problem is, printing in this way only seems to work with root privileges. Why? And what should be done about it? Printing works just fine as a user via CUPS, what is so special about this process that it needs to be su? I can think of ways of doing it, but would really like to understand what is going on and why before doing any of them. Cheers, Peter

3 3

re lp printing and permissions
by Peter Alcibiades 13 Dec '09

13 Dec '09

Yes, what I seem to have is: $ ls -l /dev/usb/lp0 crw-rw---- 1 root lp 180, 0 2009-12-12 01:59 /dev/usb/lp0 So, is this maybe the consequence of having set up the raw printer as root? But it had to be done as root apparently. Peter

2 1

Ubuntu Live CD puzzle
by Ted.Harding＠manchester.ac.uk 13 Dec '09

13 Dec '09

Hi Folks, First, I hope that those of you who went out for the Christmas meal had a good one! Now: I've just been giving a wee whirl to an Ubuntu 9.10 ("Karmic Koala") live CD (from the Jan 2010 Linux Magazine). I was puzzled to find that the (Gnome) interface does not seem to offer any way of setting the DNS server. I let it use DHCP from my router (which duly gave out an IP address), and I'm able to access other machines on my home LAN. However, if I'm to try it out on the WWW I need to set a DNS server IP. With the Debian Lenny which is already installed on the same machine, I get the Gnome desktop and if I click on System --> Administration --> Network [brings up "Network Settings" window] --> Connections --> Wired Connections I can then set the DNS via the "DNS" tab. However, once the Ubuntu Live CD has finished booting up I again get the Gnome desktop, but this time if I try to click as abve I get System --> Administration [and now no "Network" but only]: --> Network Tools from which it seems I can only see a listing of device properties, and choose from the basic networn tools like ping, traceroute, etc. Nothing that I can see which has to do with settings. If I look under System --> Preferences --> Network Connections [choose "eth0" and "Edit"] --> IPV4 Settings and there is no apparent provision to set the DNS IP. Of course I can work round it "by hand" by simply editing /etc/resolv.conf, but I'm surprised that the allegedly user-friendly Ubuntu doesn't give me an easy interface to do it! Or maybe Ubuntu is trying to make it too easy -- could it have something to do with being on DHCP (and the router not coming up with a DNS IP -- all my other machines being on static setup)? Even so, it should still allow me to over-ride a DNS IP from DHCP (if any) by direct configuration. So I'm puzzled, but maybe others are not and can put me right! Thanks, Ted. -------------------------------------------------------------------- E-Mail: (Ted Harding) <Ted.Harding(a)manchester.ac.uk> Fax-to-email: +44 (0)870 094 0861 Date: 12-Dec-09 Time: 23:47:10 ------------------------------ XFMail ------------------------------

2 2

Ian new member
by Ian Porter 12 Dec '09

12 Dec '09

Hi all, I have just joined the Linux mailing list, this is my HI email :) I have been using Linux for a bit, gentoo was one of fav's but because of compile times I have moved to kubuntu because I prefer kde ( do I need to stand back ?) Anyway, I suppose I mainly would class myself as a developer and do admin as well. Regards Ian

4 3

Re: [ALUG] Questionnaire software - any suggestions?
by Sam Tuke 11 Dec '09

11 Dec '09

>I want to build an on-line questionnaire, a very basic one, are there >any ready made applications in the Linux/Open Source world for doing >this? I've read good things about limesurvey (web based). Sam.

3 3

christmas dinner tonight
by Sam Tuke 10 Dec '09

10 Dec '09

Are we still on for this evening? Sam.

2 1