Linux stuffs

Security issue on installing your own Tucows/OpenSRS Reseller Client Library

Hamid — Wed, 16 Nov 2005 19:30:00 GMT

There is a security issue when you are install your RCL to manage your own domain registered with Tucows/OpenSRS.

/cgi-bin/manage.cgi has the feature like "Forgot Password?" which will send the password to the owner or admin of the domain name.

The following flags in OpenSRS.conf mange this feature:

           # setting this will allow your customers to request their username /
           # password be sent to them through main manage.cgi screen. The
           # password that is sent can be either that for the main user or the
           # subuser of the domain, and it can be sent to either the admin
           # contact, or the owner (registrant) of the domain. Note that if
           # set to sub-user, and sub-user doesn't exist, an error will be
           # returned.
           allow_password_requests => 0,
           password_send_to_admin => 0,
           password_send_to_owner => 0,
           password_send_subuser => 0,      # 1 to send sub-user password
           enable_cira_email_pwd => 0,
           );

Suppose you have a single account profile in OpenSRS and you register all your domains in this profile and also suppose the send password flags are turned ON( setting to 1).

One day one of your customer ask you to enable him to manage his domain by himself so you create a SUBUSER account in his domain name with the ability to change the ADMIN or OWNER data and sent it to him.

This customer will go to your /cgi-bin/manage.cgi and change the ADMIN email and then logout and reenter to the /cgi-bin/manage.cgi and enter his password incorrectly, the system will offer you to send his password back to Admin email of the domain and he only tell OK.
Unfortunately the OpenSRS will send the account profile password to the SUBUSER, he can then login to the your profile and God knows what will going on then.

So turning off this flags are strongly recommended.

Plesk 7.5 and Redhat Enterprise Linux(RHEL) Problems

Hamid — Mon, 07 Nov 2005 12:45:00 GMT

I installed Redhat Linux Enterprise (RHEL) in virtual machine and without any manual changes I went to install Plesk 7.5 Reloaded.

Plesk successfully installed on this box.But when I logined to plesk, I found that DNS server (BIND) in "server management" failed connect and start it.

I had the same story with my RHEL box which I leased from NetNation. They installed and delivered Plesk 7.5 in my box and When I logined to Plesk, I found that DNS Server (BIND) stopped and failed to start.

I asked NetNation support to resolve the problem and after two day they told me:

"It looks like manual changes have been made to the bind configuration on your server. With custom changes done outside of Plesk, we are unable to guarentee Plesk will be able to operate as a front end to the service."

So I decide to follow the case by myself .
I dig into /va/log/message and the error was:

Nov 3 11:59:35 lnn197 kernel: audit(1131006575.886:492): avc: denied { getattr } for pid=18156 comm="rndc"name="rndc.conf" dev=md2 ino=3753157 scontext=user_u:system_r:ndc_t tcontext=user_u:object_r:named_zone_t tclass=file

The command "service named start" failed but I could run "named" from the /usr/sbin/ with the following command:

#/usr/sbin/named -u named -c /etc/named.cong -t /var/named/run-root/

The above command successfully ran the named and everything was OK.

But I baffled why "service named restart" fails? So I asked Plesk support and fortunatly they told me something helpful:

"RedHat distributes RHEL with SElinux enabled by default. So default SElinux policy denies apache to manage bind (named). You should edit some boleans of selinux or switch selinux off for resolving of your issue."

I disabled the SElinux by editing /etc/sysconfig/selinux and setting SELINUX flag to Permissive.

And the problem resolved.

If you want to your SElinux enabled in enforing mode you should run the fillowing commands to tune some Booleans:

# setsebool -P named_write_master_zones=1
# setsebool -P named_disable_trans=1
# setsebool -P httpd_disable_trans=1
# setsebool -P mysql_disable_trans=1

Standard configuration of Red Hat® Enterprise Linux 4.0 (AS/ES) goes with enabled SElinux. Unfortunately Installer of current version of Plesk doesn't set selinux booleans correctly. This issue is fixed for the next version of Plesk which is targeted for release on the December 2005.

You can see the following link for something related to this problem:

http://radcom.ir/weblog/majid/archive/2005/11/06/10788.aspx

چند کلمه هم به فارسی:

طعم پشتیبانی اینها را هم نچشیده بودیم که چشیدیم، بیخودی کلی الاف و معطلمون کردند.خیلی رو دارند به خدا، همین طوری یه مزخرفی را نصب می کنند و تحویل می دهند بدون اینکه یه بار هم آن را تست کنند، ببیند کار می کنه یا نه.
بعد هم که بهشون میگی "مشکل داره حلش کنید"، جواب سربالا می دهند.

How to find out the version of BIND running

Hamid — Sat, 05 Nov 2005 10:34:00 GMT

To determine the version of BIND using nslookup:

>nslookup -q=txt -class=CHAOS version.bind 192.168.0.1
Server: servername
Address: 192.168.0.1

version.bind text =

"9.2.1"

-----------------------------------
To determine the verison of BIND using dig:

[root@as4 ~]# dig @192.168.0.1 version.bind chaos txt

; <<>> DiG 9.2.4 <<>> @192.168.0.1 version.bind chaos txt
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13916
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;version.bind. CH TXT

;; ANSWER SECTION:
version.bind. 0 CH TXT "9.2.1"

;; Query time: 428 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sat Nov 5 10:28:09 2005
;; MSG SIZE rcvd: 48

نحوه تنظیم ساعت و منطقه زمانی در لینوکس

Hamid — Wed, 13 Apr 2005 14:56:00 GMT

نحوه تنظیم ساعت لینوکس

برای نمایش ساعت و تاریخ سیستم از دستور date استفاده می شود:

# date
Wed Apr 13 14:48:50 IRDT 2005

برای نمایش زمان به ساعت گرینویچ دستور زیر را استفاده می کنیم:

# date --utc
Wed Apr 13 10:20:42 UTC 2005

از دستور date برای تنظیم ساعت سیستم نیز می توان استفاده کرد:

# date -s "15:30:25"
Wed Apr 13 15:30:25 IRDT 2005

نکته ای که باید توجه کرد که با روش بالا تنها ساعت سیستم لینوکس (Kernel) تغییر می کند. علاوه براین ساعت خو.د ماشین (CMOS) هم وجود دارد که باید تنظیم شود. شما با دستور زیر می توانید ساعت ماشین را ببینید:

# hwclock --show
Wed Apr 13 14:55:59 2005 -0.962467 seconds

برای تنظیم ساعت ماشین به وقت سیستم از دستور زیر می توانید استفاده کنید:

hwclock --systohc

نحوه تیظیم منطقه زمانی یا Time Zone

کره زمین در 15 درجه طول جغرافیایی یک نصف النهار داریم. در واقع خورشید فاصله بین دو نصف النهار را در یک ساعت طی میکند. نصف النهار مبدا نیز نصف النهاری است که در گرینویج عبور می کند. از ساعت این منظقه به عنوان ساعت جهانی UTC و یا ساعت گرینویج GMT یاد می شود.

بنابراین به راحتی اختلاف ساعت هرجایی را می توان با توجه به نصف النهاری که در آن قرار گرفته با گرینویچ محاسبه کرد. تنها مساله ای که می ماند و باید در نظر گرفته شود، مساله Daylight Saving Time است که برای هر کشور و منطقه متفاوت است.

برا تنظیم Time Zone در لینوکس می توانید از روال زیر استفاده کنید:

1. Select the appropriate time zone from the /usr/share/zoneinfo directory. Time zone names are relative to that directory. In this case, we will select "America/Denver"

2. Edit the /etc/sysconfig/clock text file so that it looks like this:

ZONE="Iran"
UTC=true
ARC=false

Of course, this assumes that your hardware clock is running UTC time...

3. Delete the following file: /etc/localtime

4. Create a new soft link for /etc/localtime. Here is an example of step 3 and step 4:

# cd /etc
# ls -al localtime
lrwxrwxrwx 1 root root 39 Mar 28 07:00 localtime -> /usr/share/zoneinfo/America/Los_Angeles

# rm /etc/localtime

# ln -s /usr/share/zoneinfo/Iran /etc/localtime
# ls -al localtime
lrwxrwxrwx 1 root root 34 Mar 28 08:59 localtime -> /usr/share/zoneinfo/Iran

# date
Wed Apr 13 14:48:50 IRDT 2005