Security :: Disabling Networking And Mounting Capabilities?
May 31, 2011
I'd like to modify a linux distro, specifically Puppy, so that the drivers/mechanisms for mounting local HDDs and Networking is Disabled completely. A step further than simply disabling "auto-mounting" at boot time, I don't even want mounting to be possible (at least by default).Likewise, further than just disabling network devices, I'd like to remove the ability to use network devices. How are these "mounting" and "device drivers" mechanisms implemented, where are they, and what are my options?
It is known that binaries with the SetUID bit enabled are a threat for the system.I saw on this ArchLinux wiki[URL].tead_Of_Setuida way to limit the use of SetUID bit thanks to POSIX capabilities.It looks very interesting.Does anyone of you used it already?Is it a burden for the system afterwards (like binaries not working, needing to be fixed); or is it seamless
A create an application which has to bind to port less than 1024 and must be launched under non-root user. OS: Ubuntu 10.04. Decision 1: Using a firewall to redirect packets. Problem: This decision is not good for me. I need simple way to solve the problem. Decision 2: Use CAP_NET_BIN_SERVICE. Problem: My execution file has 2,7G size. It is very big application with a lot of debug info. setcat command return an error:
I suffer enormously from net addiction (as well as gaming addiction and related behavioural maladies).I've had revelatory success in controlling my time online-and, in general, in front of a screen with unproductive applications- by locking my monitor's power cord into an Ems PowerCop (the key to which I keep at work). Writing and journaling, I do on an AlphaSmart Neo. However, I could really use a tool to allow me to edit and typeset my writing (and only those tasks).I'm considering buying an ultra-low cost net-book.I want a netbook because it's the cheapest way to keep the display power fully dependent and integrated with the machine---I can't have something that will allow a simple means of working around the Ems PowerCop. Also, since it lacks an optical disk drive (and since I'll be keeping my usb drives at work) there will not be an easy way to reinstall the operating system. However, before I buy anything, I need to know that, after installing/configuring all of my preferred settings for vim and La/Xetex, there is a way that I can cripple the netbook and all of its applications so that no internet access is possible.
The Cherrypal Africa can come with either Ubuntu, Debian, or its own Linux blend, Green Maraschino. If it ends up being either Ubuntu or Debian, what can I do that will irreversibly (at least, from a software level---a hardware level would probably require damaging the usb ports, which I don't want to do) disable its ability to try to communicate with the internet (including the software repositories)? I'm hoping for a particular system file that I can delete rather than the addition of a command somewhere that would be easy for me to undo when I'm bored out of my mind and want to see what Wikipedia has to say about the glycemic index.
I recently installed Ubuntu 9.10 onto an older laptop for my boss. However, after installation I lost all internet capabilities... both through wireless and ethernet connections. There is zero indication that Ubuntu is picking up any wireless connections at all and when I plugged into an ethernet connection Ubuntu acts as if it is trying to connect, however unsuccessfully. I have eliminated the internet connection as my problem because I was able to connect with my laptop running 9.10 with no problem. I have searched and searched everywhere for fixes to this problem however 99% of them need an internet connection to install the required firmware and drivers... is there any OFFLINE solution out there?The computer is a Compaq Presario 2200 with a Boradcom Corp BCM4306 802.11b/g Wireless LAN Controller
I administer a desktop computer with ubuntu 8.04 in an university library. Since it works almost all night, to enable students to study, after some time I noticed some misuses of the computer during the evening, when there isn't many students. My goal was to disable users from accessing internet from 7pm to 7am, but also enable it if certain user was logged in (I use that user for torrent, and I seed on that computers from time to time). So I created a script that's being called by root's crontab, and here is the script's code:
Code: #!/bin/bash NUM=`who|grep myuser|wc -l` #echo $NUM if [ $NUM -le 0 ]; then /sbin/ifconfig eth0 down else /sbin/ifconfig eth0 up fi
Since I created the script, I actually never seeded anything, so I'm wondering now if that's going to work at all, and (also) is there a better solution for this.
right now i have vsftpd server installed for FTP access. I originally set it up for both FTP and SFTP, but found that SFTP disregarded any and all permission settings and user jailing that i had set up... so I am switching to just being standard FTP
so here is what's happening:
i've tried to disable SFTP in the sshd_config file, but i am still able to log into the ftp server under sftp through port 22 (which normally is ssh?) i've tried all kinds of things short of just blocking port 22, however I would prefer to be able to remote into my server via Putty (which has access restriction to ONLY allow my admin user account over ssh)..
I am using Red Hat and was wondering how to disable username and password only login and require that a PPK secure key file be used for authentication ? I can log in using the secure private key and the public key that is in ~/.ssh/authorized_keys but i can still log in using the plain username and password login.
Not using filename encryption when you create a new encrypted folder is easy, but how to disable it in the home encryption that is automatically set up by the Karmic installation CD?
I am having permissions errors every time I try to mount a windows host. I have a linux server and all the windows computers can see that computer and its files, but we wanted to start backing up the linux machine to one of our other computers. so I tried to mount one of the computers. here is the sequence of events:
Code: $mount -t cifs //192.168.1.194/Admin$ /mnt/Anita-comp password: (I have no password so I left it blank) Mount error (13): Permission Denied I tried all sorts of passwords we use around the office and none of them worked.
I then decided to try mounting one of our other computers. this one looked like it worked fine. no error messages at all. (I left password blank) so I look in my filesystem and the mounted drive is not in the /mnt/Anita-comp file. What gives?
when i would mount a drive (internal, external, ntfs) in 9.10 it would ask for the root password. now 10.04 doesn't do that. how can i go back to that scenario?
- lots of users work with linux Desktops. They use them as testing servers.
- All the infrastructure has the Authentication services linked by Quest Auth Services againts an AD. This gives us the option of logon scripts, startup scripts, and other things.
- One interesting option this Quest thing gives us is SUDO management. We can edit sudoers file by GPO politics.
- Now we are deploying a NAS server from Hitachi with cifs and NFS mapping capabilities.
- Servers are managed by IT, so nobody can go root except us.
- Desktop users will also mount the NFS shares so they will be able to work with real data and read their own data from servers.
- Desktop users can go sudo su.
- If desktop users go from root to another user, the NFS let them work as they where the other user.
I would like to keep them from swithching users, but only between AD users, they must be able to switch to apache user or postgres user.
I want to be able to mount an ftp account to a local folder, I have set up a ftp server that is working fine, I have tested it with a few windows ftp clients and it works fine. I am trying to use CurlFtpFS to mount it to /backup as I know it is supported but am running into an error I cant get around. I have tested that my box can access the server using the ftp command, see below
Code:
root@Fileserver:/# ftp 192.168.1.254 Connected to 192.168.1.254. 220 (vsFTPd 2.0.6)
[code]....
but when I try to use CurlFtpFS I get a Error connecting to ftp: Access denied: 530" error, see below
I'm an inordinate amount of trouble getting F15 to run without NetworkManager. If I boot with the NetworkManager service enabled, my NIC presents as expected at /dev/eth0 (I'm using biosdevname=0). However, when I stop the NetworkManager service, /dev/eth0 disappears from the filesystem.If I boot without NetworkManager enabled, /dev/eth0 is never created. Reviewing dmesg, udev is loading an ethernet driver.
I wish to prevent a user account with sudo rights from mounting attached storage, i managed todo this with ubuntu Version 8 using gnome-polkit i think it was, however i'm not able todo this in 11.04 now , has anyone got a direction i can look in, i googled alot but my searches all come up with auto mounting or how to mount drives
I have a Debian computer with 2 network interfaces. Ath0 for wifi and eth0 for cable. They're configured as dhcp and are getting their ip from different routers. When I shut down one of the router, it takes 5 minutes for the ip address to "Go away". I would like this to take a shorter time. I figured it must be a setting, but my attempts so far have been unsuccessfull. Is there a way to do this?
In Ubuntu Lucid 10.04, when I click a disk in the left panel of Nautilus for the first time, the disks are getting mounted without asking a root password. This was not in the case for the previous versions of Ubuntu. how can I turn this feature on in Lucid.
I've just reinstalled my box with an encrypted home (used the encrypt home option when installing). I have a query in this regard - suppose I lose the box. Won't it be possible for someone to drop into root, reset my passwd and then access my /home. Is there anyway of having a different passwd for accessing /home? My ~ is on a different partition from /.
Is karmic is slower for you all: if you're running windows ping a server on windows/ubuntu and compare. 9.10 is consistently slower for me. I've seen enough "slow internet" posts to suspect that someone screwed up bad. Everyone says it's ipv6, but none of the fixes work for me. Pretty sure it's ipv6 (or at least a dns-related problem):
i'm trying to delete the wireless connection and use the wired connection and when i press the delete button it keeps stack at the delete button with no further action how can i remove the wireless and use the wired connection.
I have installed Ubuntu 10.10 on my laptop, and the internet was very slow and kept dropping in and out for any web browsers and sometimes the Ubuntu software center. After searching the internet for a while I came across several article saying to disable ipv6, which I have done, but the issue persists
I ran into this today accidentally turned on networkmanager and it took it upon itself to rewrite some things and proceeded to make any DNS lookups on my server Especially those reverse DNS for SSH and SFTP take so long they would just time out instead of completing.. Disabling networkmanager did not undo the damage either. Short fix, Erase your resolv.conf file and add 2 lines to it as so, your nameservers!
nameserver xxx.xxx.xxx.xxx nameserver yyy.yyy.yyy.yyy save, and run the following commands service network restart service httpd restart service sshd restart
Mine had a search line added by networkmanager and some others, when i reverted it back to as above, almost instantly after restarting the services the systems lookups were once again, lightning fast. DNS lookups were taking upwards of 20 seconds for unknown reasons after this happenned
I have a system, I want only my sudoer account to show and automount NTFS partitions under 'Places' in Ubuntu. Simply, they shall not have access to mount it. Only my main sudoer user account shall take advantage on this show-and-possibly-automount feature of GNOME, but not anyone else.
I just installed ndiswrapper so I wouldn't have to deal with it. Thing is, I'm not fairly certain my driver is one of the ones ubunutu comes with. I removed ndiswrapper (from the add/remove section, not sure if thats a full uninstall or if I should of used terminal), but my driver is still listed as "ndiswrapper". How do I completely remove that, so my system can use default drivers?
The IP address acquisition problem I reported earlier has returned, and I am stymied. To recap: Ubuntu 9.10 would not obtain an IP address via a wired Ethernet connection. I resolved the problem at the time by configuring eth0 in /etc/network/interfaces:
Code:
auto eth0 iface eth0 inet dhcp
and disabling Network Manager in Preferences > Startup Applications.After a powering down the PC today, the problem has returned. It appears that dhclient cannot obtain an IP address. This is true whether I am connected to the router (a Linksys WRT54G running Tomato), or directly to the DSL modem. When my usually wireless Ubuntu 9.10 laptop is wired to the router, it obtains an address almost instantly. I have made no changes to the network configuration since January. I have tried to keep current on Ubuntu updates.
Code:
jgb@alienware:~$ ifconfig eth0 eth0 Link encap:Ethernet HWaddr 00:30:1b:ac:5b:9e inet6 addr: fe80::230:1bff:feac:5b9e/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
I am not new to apache but I am curious to know capabilities of Apache.Where can I get more such as some one who can program a module for apache what objectives can they achieve.
heard about App runner. Does it have the capabilities of running Adobes CS3 or CS4? if so how? Also having issues using Cross-compliler and Wine to sort this out.
