main

main@lists.alug.org.uk

10364 discussions

How best to run a 'pull' backup using passwordless login?
by Chris G 20 Dec '09

20 Dec '09

As part of my sort out and tidy up of security, backups, etc. I've decided that it would be better to run my off site backups as 'pull' backups driven from the remote systems. This way an intruder into my home system won't see any evidence of these backups happening and hence won't be tempted to do anything to them. This requires (unless someone else has some bright ideas) that the remote system has a passwordless login to enable it to do the backup (or I put the password in the script, which comes to the same thing). For this to be (reasonably) secure it needs to be set up so that the *only* thing you can do with that login is a backup. So, finally to my question, what's the tidiest/easiest way of doing this? I can see two possible ways:- A dedicated login with the program to be executed when you login set to do the backup. A 'ForceCommand' in ssh that executes the backup when certain criteria are met. I think I prefer the second as it makes handling permissions etc. easier. E.g. I want to backup files belonging to user xxxx, if I can login as user xxxx then I don't need to worry about the files all being readable by the backup. This requires careful setting up of the sshd_config file though so that remote logins to user xxxx run the backup but one can still login to user xxxx locally. Can anyone see any serious flaws in the above and/or easier ways of doing it that are still reasonably secure? -- Chris Green

4 3

Gnome, seahorse, gnome-keyring-daemon - any good howtos or overviews anywhere?
by Chris G 18 Dec '09

18 Dec '09

I'm considering (though I'm rapidly going off the idea at the moment) using seahorse and gnome-keyring to manage passwords/keys etc. None of the manuals gives a clue as to what they all actually *do*. All you get is information about the mechanics of entering data into seahorse etc. which is pretty straightforward and obvious anyway. I want to know how it actually works to make keeping keys etc. easier and to make logging in to other systems easier. At present I do things manually by editing and copying the various files in $HOME/.ssh directly myself. I don't run ssh-agent, I *assume* that gnome-keyring is a sort of replacement for that but can't find anything that tells me anything actually useful. What concerns me slightly is that it's all a total waste of time if it's only protected by my login password which I think, by default, it is. I.e. if I understand things right (and I'm not at all sure about this) when I log in to the X gui and enter my password then gnome-keyring (and/or seahorse) extracts my key[s] from somewhere and then when I ssh to other systems that key is used and I don't have to type it in. Have I got that anything like right? If this *is* the way that it works how is it even remotely more secure than simply using password login on those systems I ssh into? If not can someone clarify a bit for me, or, as I said, point me at some sort of overview document that explains things. -- Chris Green

4 13

email addresses starting with asterisk?
by Peter Alcibiades 18 Dec '09

18 Dec '09

Helping a friend change computers, we found that the email login did not work, and after a series of conversations with the provider were told to log in to get messages using *(a)mydomain.com This did indeed work, and the effect appears to be that mail sent to any name at mydomain.com is picked up by the login, and also that any name used results in mail being accepted. So for instance you can apparently send to alexander(a)mydomain.com bacchus(a)mydomain.com calypso(a)mydomain.com and so on, and it will all arrive when you log in for messages as *(a)mydomain.com. Why would anyone set up an email system like this? Does it not make a lot more sense to have specific email addresses, both to reduce spam, and to allow you to segregate, for instance, home and business email? This is the same case where there was the incomprehensible networking with two cards and class B addresses for a three machine network. When set up in the usual way with a five port router modem, it all worked perfectly fine with a lot fewer cables. Very strange. Peter

5 4

Questionnaire software - any suggestions?
by Chris G 17 Dec '09

17 Dec '09

I want to build an on-line questionnaire, a very basic one, are there any ready made applications in the Linux/Open Source world for doing this? I can't find anything obvious in the Ubuntu repositories. -- Chris Green

5 8

[ALUG Announce] POSTPONED: December's 3rd Monday Monthly Ipswich Social Meeting
by samwise 16 Dec '09

16 Dec '09

ALUG Announce Please send announcements to Announce(a)lists.alug.org.uk Unsub, change settings via http://lists.alug.org.uk/mailman/listinfo/announce ----- The monthly "Third Monday" ALUG Ipswich Social Meeting has been postponed until January. Off-list five us of have agreed on an ALUG Christmas meal on the evening of Tuesday January 5th 2010 (the only day everybody's calendars agreed!). If anyone would like to join us then, please drop me a line. With no other suggestions, I'll probably try making a booking soon at Mr. Wings - the chinese restaurant we went to last time. Thanks, Peter. ----- Send discussion replies to main(a)lists.alug.org.uk (Reply-To set) Unsub, change settings via http://lists.alug.org.uk/mailman/listinfo/announce

1 0

Eee bah gum - feature...
by Anthony Anson 16 Dec '09

16 Dec '09

If there is a memory-stic plugged-in to any USB socket, the Vodafone internet dongle will not work. Click on the icon to start the software, and all you get is an egg-timer, for less time than it takes to boil an egg - if memory serves. So, introduced the Eee to a memory card in the slot provided. Dongle software failed to open. Same failure if I have an external HDD or CD/DVD plugged in. This is *VERY* inconvenient. Not tried it using a hub yet. Any ideas/suggetions, O all ye cognoiscenti? -- Tony Anson www.girolle.co.uk/

1 1

Relative merits/security of Public Key and old-fashioned password with ssh
by Chris G 16 Dec '09

16 Dec '09

I'm probably being totally paranoid but still. Is there any significant difference in security between using password login and Public Key when using ssh to connect to my home server? Just to clarify ssh connections are *only* allowed from two systems 'out there' where I have shell login accounts so an intruder has to get onto one of those systems before having any possibility of connecting to my server. Is it any easier for an intruder to guess my password (remember, no access to the system so I don't think a dictionary attack is possible is it?) or to guess the encryption key for my private key? I can't see any really significant difference between the two but I'm open to any comments. -- Chris Green

3 4

Security thoughts/questions
by Chris G 14 Dec '09

14 Dec '09

I have a small SoHo LAN which is used by the family (mostly just two of us now) for personal use and in running our small Ltd. company. There's no very sensitive (as in confidential) information on any of the systems but I guess there is stuff in E-Mails etc. that we don't really want to escape. More impportant is the *safety* (as in not losing) of a lot of information such as the company accounts, E-Mail trails of work we do and so on. Recently I have set up a small server machine which now handles DNS (using dnsmasq), has the publicly visible web pages (not the company site but bits and pieces that I want to make visible to 'the world') and runs an SMTP server. This means that firstly I can turn my desktop machine off now (it used to be the server) and secondly there's no direct access from the outside world to my desktop machine. The firewall is set up to allow only ssh, http and SMTP connections from the outside and all three of these are routed to the server machine. So far so good. Now I'm wondering whether I have overlooked anything obvious and/or if there's any way I can improve things. The most likely sort of exploit/damage as I see it is someone breaking into the server machine and just making a mess. I keep the server software as up to date as possible with security fixes etc. for apache, ssh and SMTP (postfix) so it should be fairly difficult to break in. I only allow ssh connections from two hosts (where I have shell login accounts) so password guessing needs to get there first and then into the server. All important data from desktop machines is backed up to a NAS in the garage (separate machine from the server) so that should protect against fire damage and even burglars as they're unlikely to break into both the house and the garage as well as notice hardware in both places. I also back up the critical company files 'off site' to my hosting company's site. The final barrier(s) I'm thinking about are the ease (or otherwise) of doing damage if someone breaks into one system in the LAN. For example would I win anything by enabling the root account on the server (currently sudo only) so that if someon breaks in as me they'd still have to guess the root password to be able to do anything nasty. Are there any NFS exploits I should worry about? There are quite a few NFS mounts across the various systems. -- Chris Green

1 0

Forms design for web pages - any ideas?
by Chris G 14 Dec '09

14 Dec '09

I'm looking for a tool a bit like the Forms Design part of Open Office (or MS Access for that matter) that will build web data input forms. I don't want a full-blown CMS or site design package, I just want to be able to build some simple data entry pages to load data into a database from the web (well, actually my intranet). Is there anything out there which can do this? ... and I have looked quite hard, the best I've found so far is phpmyedit. (This is as an alernative to using Open Office Base) -- Chris Green

7 12

How to set up NFS file sharing area for two users to read/write easily?
by Chris G 14 Dec '09

14 Dec '09

I want to set up a 'file sharing' area on my server machine where two users can both easily read and write files. I want this to be an NFS mount on both users' machines so it's just an 'ordinary' directory as they see at and it can also be mounted as a VirtualBox shared drive. Ideally I'd like the shared area to be owned by a third user, i.e. the two users reading and writing files are, say, 'fred' and 'bert' while the shared area is owned by 'shared'. Is there any way to set up NFS so that if fred writes a file to the area owned by 'shared' it automatically becomes owned by shared and similarly for bert? I don't really want to end up with shared's files owned by all sorts of different users. It would be fairly trivial to set up the shared area to have general write permissions for everyone but it would still be only too easy for either fred or bert to write files there that wouldn't then be writeable by the other users. I guess I essentially want both fred and bert to become user shared when they do anything in shared's file system. -- Chris Green

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

main