=== Guest46165 is now known as nandemonai [00:47] https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-patch [00:47] is this new? or simply never used? [00:48] no idea, first i heard of it [00:49] archives are empty so apparently nothing has ever gone out on it [00:49] im writing out some linux patching policies for work [00:49] already did the rhel doc [00:49] now im working on Ubuntu [00:50] sounds like too much fun [00:50] meh, it's interesting [00:50] beats dealing with users [00:50] heh [00:50] suppose so [00:51] looking for a comparable way to email security patch alerts [00:51] course, at this point in time, i would be happy to work with users as i'm unemployed at the moment [00:51] ideally, just the packages we have installed [00:51] but it kinda looks like traffic on security announce is light [00:52] i would say take a look at debian [00:52] since Ubuntu mainly gets it's packages from Debian [00:52] right... [00:52] if something needs to be patched @ debian, Ubuntu is likely to follow shortly [00:52] https://lists.ubuntu.com/archives/ubuntu-security-announce/ [00:53] there's also a website / rss feed [00:53] but i was wondering whether there was something installable [00:53] i got a "minor" problem, if anyone have encountered this and know how to fix it please msg me [00:53] iceonnet@homeserver:~$ sudo visudo [00:53] iceonnet is not in the sudoers file. This incident will be reported. [00:53] like a trigger to apt-get or cron job === ice|work is now known as iceonnet [00:54] ice|work: are you in the sudoers file? [00:54] no i saved it [00:54] and exited [00:54] err [00:54] kinda sqrewed it up i guess [00:54] ice|work: is your user in the sudoers file? [00:54] yea, so the message is pretty clear Iceonnet [00:54] pwnguin: no, that is what i realized when i was done and got the message [00:54] KillMeNow, yeah it is [00:55] it means that the username iceonnet isn't in the sudores file or it doesn't have permissions [00:55] i did add this, [00:55] apache ALL=NOPASSWD:/usr/sbin/useradd, \ [00:55] /bin/mkdir, /bin/ln, /bin/chown [00:55] tho apache doesn't have any passwd [00:56] yea, and the command you gave it was sudo visudo [00:56] KillMeNow: actually, i think something like apticron would suffice [00:56] !info apticron [00:56] apticron (source: apticron): simple tool to mail about pending package updates. In component universe, is extra. Version 1.1.28 (jaunty), package size 14 kB, installed size 112 kB [00:56] hey pwnguin, that looks like a good solution [00:57] yea, i was hoping people in here would know more than i could find with apt-cache search :P [00:57] at least then you would have some type of an idea when something is coming up... however will it cover your security patch issue? [00:57] well, im comfortable with canonical's turnaround time [00:57] yea, they are pretty quick usually [00:58] as long as i mandate that -security is in soruces.list, we'll be fine I think [00:58] iceonnet.. you added the sudo rights of /bin/mkdir /bin/ln /bin/chown and /usr/sbin/useradd [00:59] yeah its for a apache project [00:59] yea, but for the user iceonnet doesn't have /usr/sbin/visudo rights [01:00] follow? [01:00] yup [01:00] at least that's what i'm guessing from what you said you added [01:01] so add /usr/sbin/visudo for iceonnet in the sudoers file [01:01] well i can't access the visudo file since i removed admin group rights for sudo [01:02] i guess i just should reinstall the whole thing [01:02] do you have root? [01:02] root isn't set up from a fresh install is it? [01:02] not usually [01:03] usually the initial username you create during install has sudo su rights [01:03] yeah [01:03] so you can get to root [01:03] but some ppl enable root after the fact [01:03] how do i enable it? just f.ex do passwd root | set password? [01:04] if you didn't do this, and then changed the sudoers file, then yea i can't think of any workaround off the top of my head [01:04] lemme think about it for a second [01:05] try this... sudo passwd root [01:05] if you can change the password, log out and then try logging in as root [01:06] ok [01:06] if you can log in as root, you're saved from a reinstall [01:06] iceonnet@homeserver:~$ sudo passwd root [01:06] [sudo] password for iceonnet: [01:06] iceonnet is not in the sudoers file. This incident will be reported. [01:06] so i guess reinstall is the next stem [01:06] *step [01:08] hate to say it, yea [01:08] think that's the case [01:08] iceonnet: Since apache has "sudo ln" access you might be able to save a copy of /etc/passwd, edit it, and then ln the copy over top of /etc/passwd. [01:08] Not sure if the system checks the ownership of the file. [01:08] well, how far in to this are you? [01:09] Give root a password and then log in as root. [01:09] if you just installed it and haven't done much to the system, i might just chuck it and start over [01:09] otherwise, try Eric's suggestion [01:09] i just installed the server, apache, mysql, php and vsftpd, just done the basic setup [01:10] so i guess i just should start over, its about 15-20 mins of installing and setting it up again [01:10] yea, that's what i would do [01:10] If the system doesn't like a non-root-owned /etc/passwd, then you could overwrite any file which root runs regularly (after saving a clean copy). [01:10] but i would also create a new account to use instead of the initial one you used [01:10] pwnguin: it's not used yet [01:10] my way is more fun :) [01:11] heh [01:11] HACKERY! :D [01:11] but yeah, starting over and documenting or automating the correct setup steps is a good idea. [01:12] In case it wasn't clear, I also believe that giving an account sudo access to random commands is almost the same as giving it root access. [01:15] about the root enabling, should i just do a passwd root, after the installation? [01:15] if you want to enable root access via ssh [01:15] I think an attacker could also get root with "useradd" and "chown". I'm still thinking about mkdir. [01:16] i would recommend creating a new user besides the elevated user account at install [01:17] then i would give that other user account whatever rights you were looking to do... you usually DON"T want to allow root login besides from superuser [01:17] AFK for a few [01:20] any security-team people around? i was directed here. i have a DoS security bug against ubuntu's packaging apache that appears to be stuck in the process... [01:21] New bug: #396813 in mysql-dfsg-5.0 (main) "karmic: file conflict when installing mysql" [Undecided,New] https://launchpad.net/bugs/396813 [01:28] https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/394350 [01:28] Launchpad bug 394350 in apache2 "RLimitCPU has no effect in Apache" [Undecided,Incomplete] [01:39] hey guys, i've turn ufw logging to full, grep all of /var/log but found no trace of ufw log. what should i do ? [01:43] i've never used the Ubuntu Firewall as a frontend, i've always used IPKungfu [01:44] try sudo ufw logging on [01:44] KillMeNow: that's pretty funny [01:44] why is that? [01:44] yes i know that they are both front ends for iptables [01:44] KillMeNow: the name (IPKungfu) [01:45] ooh [01:45] yea, i've used it since like 2001 [01:45] graphical? [01:45] when i got tired of beating my head on the table trying to get IPtables done right [01:45] no, it's all cmd line [01:45] it has several config files [01:45] ok [01:45] yeah, iptables is the dog's breakfast [01:46] www.linuxkungfu.org [01:46] plus the guy who wrote it is hella nice [01:47] that helps [01:47] KillMeNow: i tried ufw logging full [01:47] hi [01:47] how do i disable the ubuntu server firewall...? [01:48] yea, talked to him here on freenode in #ipkungfu [01:48] come on guys, '$ man ufw' [01:48] is it builtin installed on the fresh ubuntu installed..? [01:48] yea, man ufw shows 'ufw logging on | off [01:48] yes, ufw is installed by default [01:49] pmatulis: i did [01:49] well it says on the first few lines: ufw disable [01:50] sorry, mixing you guys up [01:50] that was for ruben23 [01:50] # ufw logging on [01:50] Logging enabled [01:50] oh hahahhaa... yea 2 ppl here talking about UFW [01:50] how about already installed openssh but getting network refuse when ssh on the ubuntu server [01:50] ufw status [01:50] Status: active [01:50] To Action From [01:50] -- ------ ---- [01:50] 22 ALLOW Anywhere [01:51] it's active [01:51] it's running [01:51] but i can't find any log anywhere [01:51] lol [01:51] fool_: looks good but i would disable ufw and then test ssh [01:51] pmatulis: ssh's working [01:52] fool_: so what's the problem? [01:52] pmatulis: no log anywhere [01:52] he's looking for the physical log file in /var/log [01:52] it doesn't show allowed connections i think [01:52] pmatulis: when i turned on ufw aptitude couldn't work, and when i tried to look for logs i couldn't find any [01:52] only connections rejected correct pmatulis? [01:53] how about me, ssh not working--> i got network refuse error [01:53] KillMeNow: i turned on full logging and still no log [01:53] fool_: calm down [01:53] hrm... ruben23 [01:53] disable ufw and try ssh again [01:54] i just type command ufw logging off.. [01:54] pmatulis: oh my bad [01:54] if you've flushed your iptables and you still can't connect to ssh, is your box behind a firewall and is the firewall forwarding port 22? [01:54] ruben type in ufw disable [01:54] ok [01:54] that should turn off the firewall [01:55] then try to connect to ssh port 22 [01:55] if it works, viola [01:55] fool_: are you good now? [01:55] you need to add the rule in to ufw [01:55] pmatulis: no [01:55] have you read the man page for ufw ruben? [01:55] pmatulis: when i turned on ufw aptitude couldn't work, and when i tried to look for logs i couldn't find any <<< [01:55] so i'm stuck on those 2 problems [01:56] fool_: '$ sudo ufw logging high' [01:56] fool_: that will give you a 'high' level of logging [01:56] pmatulis: i tried with full w/o any luck [01:56] fool_: then '$ tail -f /var/log/kern.log' [01:57] no luck---->still getting network refuse [01:57] ruben23: is ufw disabled? [01:57] yes [01:57] disable now [01:57] ruben23: did you flush your iptables rules? [01:58] i just disable [01:58] '$ sudo iptables -F' IIRC [01:58] no flush [01:58] please do [01:58] iptables --flush [01:58] pmatulis: nothing [01:58] oh yea, sudo iptables --flush [01:58] then you can type in iptables --list [01:58] that should show you all your iptables rules [01:58] you shouldn't see any [01:59] ok in aminute [01:59] pmatulis: i'm looking at syslog/kern.log/messages/dmesg and it shows up nowhere [01:59] hey fool_ have you checked in /var/log/messages for any ufw messages? [01:59] i'm reading a forum post on ubuntuforums and someone posted that it may be logging in messages [02:00] pmatulis: i'm looking at syslog/kern.log/messages/dmesg and it shows up nowhere << KillMeNow [02:00] try sudo cat /var/log/messages | grep -i ufw [02:01] fool_: and what do you expect to see there? is it blocking stuff? [02:01] pmatulis: there is nothing, no messages [02:01] lol [02:01] say if it's blocking aptitude or something at least there'd be some messages [02:02] but there's nothing [02:02] :/ [02:02] fool_: why do you think it's blocking aptitude, that makes no sense [02:02] does aptitude work now with firewall rules in? [02:02] fool_: AFAIK, ufw blocks incoming only [02:02] if now, disable it and then flush your iptables [02:02] pmatulis: because aptitude works when i disabled ufw and doenst when i enable it [02:02] yea, another reason i used IPkungfu [02:03] very strange [02:03] ok, that would make some type of sense... check your rules... did you block a outbound port range? [02:03] pmatulis: yep, that's why i'm hear for help [02:03] lol [02:03] fool_: did you confirm that there are no other rules active? [02:03] pmatulis: nope [02:03] unless ufw status lie to me [02:04] guys [02:04] '$ sudo iptables -L -n' [02:04] still cant login through ssh [02:04] network refuse [02:04] ok, is the ssh service running? [02:04] ruben23: so you flushed the rules or not (i'm getting tired) [02:04] check your services [02:04] sudo netstat -nap | more [02:05] but when /etc/init.d/ssh restart ------> got this no such file directory [02:05] check to see if the ssh daemon is listening to port 22 [02:05] done already as youve said [02:05] all done [02:05] ruben23: guess sshd is not listening then [02:05] well, then it sounds like you don't have sshd installed [02:05] apt-get install sshd [02:05] KillMeNow: no [02:05] no? [02:05] package is 'openssh-server' [02:05] ooh yea [02:06] woulda figured that out soon enough [02:06] ruben23: did you install this package? [02:06] doing it now apt-get install openssh-server [02:07] * pmatulis packs up [02:07] ow..this is a fresh install ubuntu... [02:07] do i need to enable something on the sources list..? [02:07] before i can do apt-get install packages [02:08] man [02:08] he's gone [02:08] you might, but it wasn't broken after i installed ubuntu [02:09] http://pastebin.ca/1487592 << here's the pastebin if anyone care tolook [02:09] looking [02:10] i'm not sure why you are accept UDP for port 22 and 80 [02:11] uhm that's irrelevant to my problem isn't it ? [02:11] yep [02:11] most likely [02:11] just saying [02:12] well i just enable the ports so it doesn't matter udp or tcp [02:12] unless there's a good reason i should specify [02:13] just thinking of flooding maybe... [02:13] course it really doesn't matter since there is no udp socket for port 22 [02:13] or port 80 [02:13] guys ssh-server is installed [02:13] bug 394350 [02:13] Launchpad bug 394350 in apache2 "RLimitCPU has no effect in Apache" [Undecided,Invalid] https://launchpad.net/bugs/394350 [02:13] on the ubuntu server [02:14] KillMeNow: yeah so what should i do about aptitude and no logging problem ? [02:14] damn peculiar [02:14] your output chain looks ok [02:15] and aptitude is all out bound [02:15] lol uh huh [02:15] that's what puzzled me too [02:15] i thought my isp pulled my leg for a min or something [02:15] it makes no sense [02:15] then i realized i just turned ufw on [02:16] kees: only thing I can think of on that one is that the kernel does some of the enforcing, and I saw something on the kernel list a couple of months ago about fixing it [02:16] my suggestion, try using ipkungfu [02:16] it's hella easy to install and the config files are very self explanatory [02:16] what version you running? [02:16] latest? [02:17] yes [02:17] jaunty [02:17] ok ruben, start it and try to connect to ssh [02:18] yeah.. [02:18] still no succes [02:18] did it work? [02:18] no still [02:18] leave the firewall turned off [02:18] i got no such fiel or directory [02:18] make sure openssh-server is started [02:18] ajmitch: nah, it behaved correctly for me on hardy [02:19] sudo /etc/init.d/ssh status <--type this in ruben [02:19] all i can say is that i can't see really anything broken by your UFW rules fool_ [02:20] KillMeNow: i don't either [02:20] lol [02:20] but things are borken [02:20] brb [02:20] fool_: Turn on logging and see what gets logged by your UFW rules. [02:20] LOL... he has [02:20] it's not logging either [02:20] Then if nothing is logged, it isn't UFW/iptables doing the breaking... [02:21] getting nothing in either /var/log/messages [02:21] well it works when we turn UFW off [02:22] Very strange... did you paste the iptables ruleset from when it is turned on somewhere... I just got home from work, have not scrolled back very far... [02:22] yea here: http://pastebin.ca/1487592 [02:22] nothing in the ruleset that i can tell is limiting the outbound connections [02:22] inbound looks ok as well [02:24] kees: maybe there some some updates which have fixed it, very hard to say for sure :) [02:24] KillMeNow: Yes, that looks pretty boring... does netstat -ntlp show sshd on port 22? [02:25] jmarsden: ssh is working [02:25] i think jmarsden is looking at Ruben23's sshd issue [02:25] oh my bad [02:25] two firewall types of rule problems jmarsden... ruben23 and fool_ [02:26] Oh, I may be confusing the two... OK. [02:26] ruben23 is that he didn't have openssh-server installed [02:26] ajmitch: did it not work for you at some point? [02:26] So for fool_ when UFW is enabled what exactly breaks -- what is the symptom? [02:26] fool_ has all that working, but when IPTables is turned ON - aptitude fails [02:27] kees: I haven't tried it, but it's something that I should use [02:27] I just saw the bug earlier & did a little checking since I'd touched apache2 recently [02:27] KillMeNow/fool_: Does FTP to other sites work with UFW enabled? Does HTTP to other sites work with UFW enabled? [02:28] jmarsden: one sec let me try wget something [02:29] sorry, i'm doing about 40 different things at the moment [02:29] trying to reimage my wife's laptop from WDS, back up my Ubuntu box for update and watch this too LOL [02:29] fool_: It might also be good to try ftp to the site you are using in sources.list for apt/aptitude, using wget or a conventional ftp client such as lftp [02:29] jmarsden: ufw on, wget doesn't work [02:30] fool_: for http, or for ftp, or for both? [02:30] jmarsden: for http [02:30] let me try ftp [02:32] fool_: OK. Are you set up to use any kind of proxy server, for FTP or for HTTP? Anything like squid or some more proprietary software or hardware "in the way"? [02:32] jmarsden: nope [02:33] say if i do this wget http://mirror.mcs.anl.gov/pub/ubuntu-iso/DVDs/ubuntu/hardy/release/ubuntu-8.04.1-dvd-i386.iso [02:33] then disable ufw [02:33] it'll run [02:33] then enable ufw [02:33] it'll stop [02:33] and so on and so forth [02:33] lol [02:33] no squid no proxy no cache [02:34] i'm on a vps if that changes anything [02:34] kernel 2.6.18-128.1.1.el5.028stab062.3 [02:34] Do you control the whole physical machine -- or are you renting the VPS from a provider? [02:35] i'm renting the vps [02:35] ahhh [02:35] OK. So we don't really know what the provider does once packets leave your virtual machine... [02:35] but it shouldn't matter should it ? [02:35] since it's working when ufw is turned off ? [02:35] Well, it means we can't test or run tcpdump on the host OS instance, for example... [02:36] so what should i do ? [02:36] Your pastebin of the ruleset does not seem to show UFW logging enabled -- are you *sure* it is enabled? [02:37] we had him turn it off i think [02:37] then disabled the ufw [02:37] jmarsden: cat /etc/ufw/ufw.conf [02:37] # /etc/ufw/ufw.conf [02:37] # [02:37] # set to yes to start on boot [02:37] ENABLED=yes [02:37] # set to one of 'off', 'low', 'medium', 'high' [02:37] LOGLEVEL=full [02:37] Try sudo ufw logging on and then test again? [02:39] i've been doing tail -f on syslog/kernlog/messages/dmesg since the beginning [02:39] lol [02:39] nothing comes up [02:39] weird as heck :/ [02:40] No.... sudo ufw logging on # and then grep "UFW BLOCK" /var/log/* [02:41] nothing [02:42] OK. You did a wget or whatever after enabling the logging, right? Anwyay, I need to go, unfortunately (to eat and then out to play guitar)... back in ~2 hours or so I expect. Hopefully you'll have found and fixed it before that! [02:43] yes [02:43] it's werid as hell [02:43] gah, sometimes i really hate M$ crap [02:44] OK... definitely weird... When you find the asnwer say so here... I'll log the channel so I find out what the answer was :) [02:44] i still think you should try ipkungfu [02:44] see if that works for you [02:44] mainly cause i like ipkungfu [02:45] KillMeNow: this is not M$ crap [02:45] KillMeNow: afaik this ufw is maintained by ubuntu devs [02:45] no, i mean myself [02:45] been fighting with M$ WDS all afternoon [02:45] jmarsden: sure will , bon appetite [02:45] microsofts windows deployment services [02:45] it's a pita [02:46] yeap... i'm sure UFW is maintained by ubuntu devs [02:46] but it's just a frontend for doing IPtables [02:46] i don't use UFW, but i also own the server mine is on [02:47] but if you think it's UFW, you can install ipkungfu, configure it and see if the problem persists [02:47] either way, i'm curious to know what the issue is as well [02:49] haha if i have to get used to ipkungfu again then i might as well learn iptables [02:50] it's pretty easy to use, but ok [02:51] well it's time for me to go [02:51] have a good one [03:02] fool_: some vps providers don't compile in all the necessary modules for ufw. See http://bazaar.launchpad.net/~jdstrand/ufw/trunk/annotate/head%3A/README [03:02] * jdstrand is just passing by... [03:05] fool_: I'm on my way out the door, but your pastebin also lacks a bunch of rules regarding state RELATED that my UFW setup has... which coudl be highly relevant to your issue... [03:08] fool_: See http://pastebin.ubuntu.com/212336/ [03:39] How can I resize LVM partitions? [03:41] it's werid as hell [03:43] jdstrand: http://bazaar.launchpad.net/~jdstrand/ufw/trunk/annotate/headA/README gives me internal server error [03:43] jmarsden: thanks [03:44] fool_: that is .../head%3A/... [04:08] jdstrand: so addrtype, comment, hl, limit , multiport, recent and state are the only required modules right ? === s_markow_ is now known as s_markow [05:25]