devil-linux-develop Mailing List for Devil-Linux (Page 50)

Hi,
I build a clean 1.2.10 yesterday and it's running fine. Nice work :-)
I thought this would be a good time to send some patches of mine that I have 
been integrating into my last builds:

functions & snort:
adds support for pidfiles in /etc/init.d/functions for reloadproc, killproc 
and statusproc. Useful if several intances of one service is running, e.g. 
snort

sysrq:
Introduces a build configuration option to enable magic sysrq in the kernel 
(which is automatically activated by /etc/init.d/boot)
It works for 2.4, haven't tried 2.6

siproxd:
Adds support for siproxd which relies on libosip2:
Siproxd is a proxy/masquerading daemon for the SIP protocol. It handles 
registrations of SIP clients on a private IP network and performs rewriting 
of the SIP message bodies to make SIP connections work via an masquerading 
firewall (NAT).
http://siproxd.sourceforge.net/
http://www.gnu.org/software/osip/ 
http://ftp.gnu.org/gnu/osip/libosip2-2.2.2.tar.gz

And the question: anyone noticed this too? 
root@one:/proc # iwconfig wlan0 txpower off
Warning: Driver for device wlan0 recommend version 18 of Wireless Extension,
but has been compiled with version 16, therefore some driver features
may not be available...
I haven't had time to look into this yet...
cu
Roland
-- 
ICQ UIN 49339118	Linux Counter #88774
GPG-Key 1024D/59C6AFA6 2003-02-07 Roland Pabel <ro...@pa...>

On Wed, 2006-05-31 at 01:42 +0200, Friedrich Lobenstock wrote:
> I've just checked in initial support for run from ram. As the commit mailing 
> list seems to lag quite a bit I just wanted to let you know.

I have a couple servers with a lot of RAM, so I turned on this option
when I upgraded them to 1.2.10.  Let me be the first to say THANK YOU!!!
It works great!  Programs not in memory run much faster (as expected),
and it also fixes one "problem" (*) that I sometimes run into.

(*)  When I have a CD based CD box that runs for a long time, the CDR
seems to build up a film on it, and eventually starts failing with a
read error.  Now I only have to worry about that when rebooting!

> I think I've tested every if statement in my code with QEMU (*) but you can 
> never be 100% sure. So if things break heavily during boot I might have my stake 
> in it ;-)
> 
> (*) My new devil build sytem is already a SuSE 10.1 XEN virtual machine so I 
> can't run VMWARE there and that's why I've changed to QEMU for simulation.

I'm also running SuSE 10.1, and this update allows the latest stable
version of VMware workstation to run fine:

http://mirror.vmmatrix.net/vmware-any-any-update/vmware-any-any-update101.tar.gz

 - BS

Bingo, that did the trick!  Thanks!!!  :-)


> We had problems with this in the past:
> #
> # EnableMMAP and EnableSendfile: On systems that support it,
> # memory-mapping or the sendfile syscall is used to deliver
> # files.  This usually improves server performance, but must
> # be turned off when serving from networked-mounted
> # filesystems or if support for these functions is otherwise
> # broken on your system.

They must be "broken" on our DL system, because the files I'm serving
reside on a real hard drive, NOT on a CD or in a ram disk.


> EnableMMAP off
> EnableSendfile off
> 
> So I disable both of them per default. Maybe that's the issue.

One other thing I noticed is a LOT of errors in the Apache error log: 
[Wed Jul 05 16:31:24 2006] [crit] (70023)This function has not been implemented on this platform: DBD: driver for  not available
[Wed Jul 05 16:31:24 2006] [crit] (70023)This function has not been implemented on this platform: DBD: failed to initialise


I commented out this line in httpd.conf, and the errors go away:

  LoadModule dbd_module /usr/lib/apache2/modules/mod_dbd.so

I'm not sure what that module does, but it's not working...

 - BS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We had problems with this in the past:
#
# EnableMMAP and EnableSendfile: On systems that support it,
# memory-mapping or the sendfile syscall is used to deliver
# files.  This usually improves server performance, but must
# be turned off when serving from networked-mounted
# filesystems or if support for these functions is otherwise
# broken on your system.
#
EnableMMAP off
EnableSendfile off

So I disable both of them per default. Maybe that's the issue.

- -- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iEYEARECAAYFAkStCjkACgkQUcytMSbs+YWQjACfUzyNv26BaOI1B/OimYl72T7i
u7QAmwYgWHVWEvMxjKaiDfvTcMPGQv8Y
=R60G
-----END PGP SIGNATURE-----

HI Bruce
I'm using the current "pre-10" Apache since 2 months without any =
Problems.
Since I'm only using it as a reverse proxy (mod_proxy mod_proxy_balance =
mod_cache mod_mem_cache) I could not say if there problems with local =
files.
The "It works" worked aswell but I have not done any further testings =
with local files.
=20
Maybe I do some testing this evening...
=20
Greetings Bj=F6rn Rudner=20
=20

________________________________

Von: dev...@li... im Auftrag von =
Bruce Smith
Gesendet: Do 06.07.2006 14:28
An: Devil Linux
Betreff: [Devil-linux-develop] Apache 2.2 anyone?



Has anyone gotten Apache to run (correctly) since we upgraded it to
version 2.2.x (DL 1.2.9/1.2.10-pre)?

I started out with the stock config, and got the "It Works" default HTML
screen to appear, but if I try to download one of the .jpg/.png files in
the same directory I get nothing.  I also get nothing if I try to access
the online manual (yes, I uncommented the include for the manual in
httpd.conf).

I also get similar results if I point the default directory to my files.
PHP files work, but no graphics appear, and no .html files will display.

If I try to download a .html or a .jpg file with 'curl', I get ZERO
bytes returned.

I double checked permissions on the files and directories, and the user
that Apache runs as (nobody) has read access.

It's probably something I need to tweak in httpd.conf, but I've tried a
ton of different changes, including uncommenting all the includes in the
"extra" directory, but nothing seems to make it work.

I would like to get this solved before we release 1.2.10, just in case
there is something wrong with the way Apache is compiled.

 - BS



Using Tomcat but need to do more? Need to support web services, =
security?
Get stuff done quickly with pre-integrated technology to make your job =
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache =
Geronimo
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D=
121642
_______________________________________________
Devil-linux-develop mailing list
Dev...@li...
https://lists.sourceforge.net/lists/listinfo/devil-linux-develop



_________________________________________________________________________=
___

Der Inhalt dieser E-Mail ist vertraulich und ausschlie=DFlich f=FCr den =
bezeichneten Adressaten (dev...@li...) =
bestimmt.
Wenn Sie nicht der vorgesehene Adressat dieser E-Mail oder dessen =
Vertreter sein sollten,
so beachten Sie bitte, dass jede Form der Kenntnisnahme, =
Ver=F6ffentlichung,=20
Vervielf=E4ltigung oder Wiedergabe des Inhalts dieser E-Mail =
unzul=E4ssig ist.
Bitte setzen Sie sich in diesem Fall mit dem Absender der E-Mail in =
Verbindung (br...@ba...).

Has anyone gotten Apache to run (correctly) since we upgraded it to
version 2.2.x (DL 1.2.9/1.2.10-pre)?

I started out with the stock config, and got the "It Works" default HTML
screen to appear, but if I try to download one of the .jpg/.png files in
the same directory I get nothing.  I also get nothing if I try to access
the online manual (yes, I uncommented the include for the manual in
httpd.conf).

I also get similar results if I point the default directory to my files.
PHP files work, but no graphics appear, and no .html files will display.

If I try to download a .html or a .jpg file with 'curl', I get ZERO
bytes returned.

I double checked permissions on the files and directories, and the user
that Apache runs as (nobody) has read access.

It's probably something I need to tweak in httpd.conf, but I've tried a
ton of different changes, including uncommenting all the includes in the
"extra" directory, but nothing seems to make it work.

I would like to get this solved before we release 1.2.10, just in case
there is something wrong with the way Apache is compiled.

 - BS

Bruce Smith wrote:
> I just added that patch too.  Thanks!
> 


Thank you!

-- 
thomas

I just added that patch too.  Thanks!

 - BS

> Hi,
>
> I was in need of mod_perl for apache. So I created the required files
> and attached the patches to this email. The mod_perl source file I used
> and placed into build/src is:
>
> http://perl.apache.org/dist/mod_perl-2.0.2.tar.gz
>
> Maybe this is as useful for others as it is to my project with 
> devil-linux.
>
> Best regards,
>
> thomas
>
>
> ------------------------------------------------------------------------
>
> diff -Nur scripts.org/configuration/help/mod_perl.help scripts/configuration/help/mod_perl.help
> --- scripts.org/configuration/help/mod_perl.help	1970-01-01 01:00:00.000000000 +0100
> +++ scripts/configuration/help/mod_perl.help	2006-06-30 17:00:51.000000000 +0200
> @@ -0,0 +1,4 @@
> +CONFIG_MOD_PERL
> +  mod_perl brings together the full power of the Perl programming 
> +  language and the Apache HTTP server.
> +  http://perl.apache.org/
> diff -Nur scripts.org/configuration/mod_perl.config scripts/configuration/mod_perl.config
> --- scripts.org/configuration/mod_perl.config	1970-01-01 01:00:00.000000000 +0100
> +++ scripts/configuration/mod_perl.config	2006-06-30 16:54:25.000000000 +0200
> @@ -0,0 +1,7 @@
> +#!/bin/bash
> +#
> +# http://www.devil-linux.org
> +
> +if [ "$CONFIG_HTTPD" = "y" ] && [ "$CONFIG_PERL" = "y" ] ; then 
> +    menu_add "Networking|Services" bool "mod_perl for Apache" CONFIG_MOD_PERL
> +fi
> diff -Nur scripts.org/configuration/profiles/default scripts/configuration/profiles/default
> --- scripts.org/configuration/profiles/default	2006-06-08 17:38:39.000000000 +0200
> +++ scripts/configuration/profiles/default	2006-06-30 17:04:20.000000000 +0200
> @@ -84,6 +84,7 @@
>  CONFIG_MEMTEST86=y
>  CONFIG_MGETTY=y
>  CONFIG_MINICOM=y
> +CONFIG_MOD_PERL=y
>  CONFIG_MOTION=y
>  CONFIG_MOXIO_SMARTIO=y
>  CONFIG_MPEG_ENCODE=y
> diff -Nur scripts.org/configuration/profiles/server scripts/configuration/profiles/server
> --- scripts.org/configuration/profiles/server	2006-06-12 15:53:09.000000000 +0200
> +++ scripts/configuration/profiles/server	2006-06-30 17:05:03.000000000 +0200
> @@ -92,6 +92,7 @@
>  CONFIG_MEMTEST86=y
>  CONFIG_MGETTY=y
>  CONFIG_MINICOM=y
> +CONFIG_MOD_PERL=y
>  CONFIG_MOTION=y
>  CONFIG_MOXIO_SMARTIO=y
>  CONFIG_MPEG_ENCODE=y
> diff -Nur scripts.org/mod_perl scripts/mod_perl
> --- scripts.org/mod_perl	1970-01-01 01:00:00.000000000 +0100
> +++ scripts/mod_perl	2006-07-01 23:46:28.000000000 +0200
> @@ -0,0 +1,41 @@
> +#!/bin/bash
> +#
> +# http://www.devil-linux.org
> +
> +# you need the next line, otherwise script won't be executed !!!
> +# DL-build-system v3
> +
> +### BEGIN INIT INFO
> +# Provides:       mod_perl
> +# Required-Start: $basebuildtools $libs httpd perl 
> +# Required-Stop:
> +# Default-Start:  1 2
> +# Default-Stop:
> +# Description:    mod_perl for apache
> +### END INIT INFO
> +
> +# get the directoryname of the script
> +MYDIR=${0%/*}
> +
> +# source functions and config
> +source $MYDIR/settings
> +
> +case $1 in
> +	build )
> +		perl Makefile.PL MP_APXS=/usr/sbin/apxs || exit 1
> +		make  || exit 1
> +		strip_debug
> +		;;
> +
> +	install )
> +
> +		make install DESTDIR=$WORKDIR/tmp || exit 1
> +		cp src/modules/perl/mod_perl.so $CDDIR/usr/lib/apache2/modules/ || exit 1 
> +		;;
> +
> +	* )
> +		echo "ERROR ($0)"
> +		echo "please add parameter so I know what to do"
> +		exit 1
> +		;;
> +esac
>
>
>   
> ------------------------------------------------------------------------
>
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
>   

I added your patch, just in time for 1.2.10.  Thanks!

 - BS

> Hi,
>
> I was in need of nmap for in DL for ipplan 
> (http://iptrack.sourceforge.net/), so I created the required files and 
> attached the patches to this email. The nmap source file I used and 
> placed into build/src is:
>
> http://download.insecure.org/nmap/dist/nmap-4.11.tar.bz2
>
> Maybe this is as useful for others as it is to my project with 
> devil-linux.
>
> Best regards,
>
> thomas
> ------------------------------------------------------------------------
>
> diff -Nru scripts-without-nmap/configuration/help/nmap.help scripts/configuration/help/nmap.help
> --- scripts-without-nmap/configuration/help/nmap.help	1970-01-01 01:00:00.000000000 +0100
> +++ scripts/configuration/help/nmap.help	2006-06-26 20:57:52.000000000 +0200
> @@ -0,0 +1,3 @@
> +CONFIG_NMAP
> + Nmap ("Network Mapper") is a free open source utility for network 
> + exploration or security auditing.
> diff -Nru scripts-without-nmap/configuration/nmap.config scripts/configuration/nmap.config
> --- scripts-without-nmap/configuration/nmap.config	1970-01-01 01:00:00.000000000 +0100
> +++ scripts/configuration/nmap.config	2006-06-26 20:55:43.000000000 +0200
> @@ -0,0 +1,5 @@
> +#!/bin/bash
> +#
> +# http://www.devil-linux.org
> +
> +menu_add "Networking|Services" bool "NMAP" CONFIG_NMAP
> diff -Nru scripts-without-nmap/configuration/profiles/default scripts/configuration/profiles/default
> --- scripts-without-nmap/configuration/profiles/default	2006-06-08 17:38:39.000000000 +0200
> +++ scripts/configuration/profiles/default	2006-06-26 20:59:03.000000000 +0200
> @@ -108,6 +108,7 @@
>  CONFIG_NFSD=y
>  CONFIG_NICE=y
>  CONFIG_NIS=y
> +CONFIG_NMAP=y
>  CONFIG_NO_IP_UPDATER=y
>  CONFIG_NSSLDAPLIB=y
>  CONFIG_NTOP=y
> diff -Nru scripts-without-nmap/configuration/profiles/router scripts/configuration/profiles/router
> --- scripts-without-nmap/configuration/profiles/router	2004-04-12 23:46:30.000000000 +0200
> +++ scripts/configuration/profiles/router	2006-06-26 20:59:51.000000000 +0200
> @@ -68,6 +68,7 @@
>  CONFIG_NF_PATCHES=y
>  CONFIG_NF_SUBMITTED=y
>  CONFIG_NIS=n
> +CONFIG_NMAP=y
>  CONFIG_NO_IP_UPDATER=y
>  CONFIG_NTOP=y
>  CONFIG_NTP=y
> diff -Nru scripts-without-nmap/configuration/profiles/server scripts/configuration/profiles/server
> --- scripts-without-nmap/configuration/profiles/server	2006-06-12 15:53:09.000000000 +0200
> +++ scripts/configuration/profiles/server	2006-06-26 21:00:24.000000000 +0200
> @@ -116,6 +116,7 @@
>  CONFIG_NF_UPDATES=y
>  CONFIG_NICE=y
>  CONFIG_NIS=y
> +CONFIG_NMAP=y
>  CONFIG_NO_IP_UPDATER=y
>  CONFIG_NSSLDAPLIB=y
>  CONFIG_NTOP=y
> diff -Nru scripts-without-nmap/nmap scripts/nmap
> --- scripts-without-nmap/nmap	1970-01-01 01:00:00.000000000 +0100
> +++ scripts/nmap	2006-06-26 20:39:26.000000000 +0200
> @@ -0,0 +1,54 @@
> +#!/bin/bash
> +# http://www.devil-linux.org
> +
> +# you need the next line, otherwise script won't be executed !!!
> +# DL-build-system v3
> +
> +### BEGIN INIT INFO
> +# Provides:       nmap
> +# Required-Start: $basebuildtools $libs 
> +# Required-Stop:
> +# Default-Start:  1 2
> +# Default-Stop:
> +# Description:    description
> +### END INIT INFO
> +
> +# get the directoryname of the script
> +MYDIR=${0%/*}
> +
> +# source functions and config
> +source $MYDIR/settings
> +
> +MYNAME=NMAP
> +
> +case $1 in
> +	build )
> +		if [ "$CONFIG_NMAP" = "y" ]; then
> +			./configure --prefix=/usr --without-nmapfe  || exit 1
> +			make $PMAKE all || exit 1
> +			strip_debug
> +		    fi
> +		;;
> +
> +	install )
> +		if [ "$CONFIG_NMAP" = "y" ]; then
> +			rm -rf $TMPDIR || exit 1
> +			mkdir -p $TMPDIR/usr/bin || exit 1
> +			make install DESTDIR=$TMPDIR || exit 1
> +			
> +			mkdir -p $CDDIR/usr/share/nmap || exit 1
> +
> +			cp -dpvR  $TMPDIR/usr $CDDIR/ || exit 1
> +			rm -rf $TMPDIR || exit 1
> +
> +			echo "HELP_NMAP=\"Nmap (Network Mapper) is a free open source utility for network exploration or security auditing.\"" >> $SOFTWAREHELP
> +
> +		fi
> +		;;
> +
> +	* )
> +		echo "ERROR ($0)"
> +		echo "please add parameter so I know what to do"
> +		exit 1
> +		;;
> +esac
>   
> ------------------------------------------------------------------------
>
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
>   

Hi,

I was in need of mod_perl for apache. So I created the required files
and attached the patches to this email. The mod_perl source file I used
and placed into build/src is:

http://perl.apache.org/dist/mod_perl-2.0.2.tar.gz

Maybe this is as useful for others as it is to my project with devil-linux.

Best regards,

thomas

Hi,

I was in need of nmap for in DL for ipplan 
(http://iptrack.sourceforge.net/), so I created the required files and 
attached the patches to this email. The nmap source file I used and 
placed into build/src is:

http://download.insecure.org/nmap/dist/nmap-4.11.tar.bz2

Maybe this is as useful for others as it is to my project with devil-linux.

Best regards,

thomas

I made a bunch of changes in PAM and would like some people to test the
changes and provide feedback before we release 1.2.10.

I compiled a 'server' release (without grsecurity) optimized for i586,
so it will work as a server, or as a firewall on an older box.

Please get:  devil-linux-1.2.10-2006-06-18-i586-SMP-server-bs.tar.bz2

in the /pub/devel/testing/ directory on your favorite DL FTP mirror.
And let us know how it goes!  :-)

 - BS

> > here is a little patch for enabling snmp for squid.
> 
> How does "$CONFIG_NET_SNMP" get set?  

Never mind, I see it's an option for a different package.

I added your patch in time for 1.2.10.

 - BS

> here is a little patch for enabling snmp for squid.

How does "$CONFIG_NET_SNMP" get set?  
Don't you need to modify the menuconfig stuff too?

Or:  Does it even need to be optional (always enable snmp)?

 - BS


> --- scripts/squid.old	2006-06-15 22:41:51.000000000 +0200
> +++ scripts/squid	2006-06-15 22:44:56.000000000 +0200
> @@ -39,13 +39,16 @@
>   			AUTH_HELPERS="${AUTH_HELPERS} LDAP"
>   		fi
>   			
> +		if [ "$CONFIG_NET_SNMP" = "y" ]; then
> +			ENABLE_SNMP="--enable-snmp"
> +		fi
> +
>   		./configure --prefix=/usr --sysconfdir=/etc --bindir=/usr/sbin 
> --libexecdir=/usr/sbin \
>   			--datadir=/usr/share/squid --localstatedir=/var/squid 
> --sharedstatedir=/var/squid \
>   			--enable-delay-pools --enable-useragent-log --enable-referer-log 
> --enable-arp-acl \
>   			--enable-ssl --with-openssl --enable-htcp --enable-linux-netfilter \
> -			--enable-basic-auth-helpers="$AUTH_HELPERS" \
> +			--enable-basic-auth-helpers="$AUTH_HELPERS" $ENABLE_SNMP \
>   			--enable-default-err-language=English 
> --enable-err-languages="English" || exit 1
> -		# --enable-snmp
>   		make $PMAKE all || exit 1
>   		strip_debug
>   	fi
> plain text document attachment (patch-squid-enablesnmp.txt)
> --- scripts/squid.old	2006-06-15 22:41:51.000000000 +0200
> +++ scripts/squid	2006-06-15 22:44:56.000000000 +0200
> @@ -39,13 +39,16 @@
>  			AUTH_HELPERS="${AUTH_HELPERS} LDAP"
>  		fi
>  			
> +		if [ "$CONFIG_NET_SNMP" = "y" ]; then
> +			ENABLE_SNMP="--enable-snmp"
> +		fi
> +
>  		./configure --prefix=/usr --sysconfdir=/etc --bindir=/usr/sbin --libexecdir=/usr/sbin \
>  			--datadir=/usr/share/squid --localstatedir=/var/squid --sharedstatedir=/var/squid \
>  			--enable-delay-pools --enable-useragent-log --enable-referer-log --enable-arp-acl \
>  			--enable-ssl --with-openssl --enable-htcp --enable-linux-netfilter \
> -			--enable-basic-auth-helpers="$AUTH_HELPERS" \
> +			--enable-basic-auth-helpers="$AUTH_HELPERS" $ENABLE_SNMP \
>  			--enable-default-err-language=English --enable-err-languages="English" || exit 1
> -		# --enable-snmp
>  		make $PMAKE all || exit 1
>  		strip_debug
>  	fi

hi,

here is a little patch for enabling snmp for squid.


/thomas


--- scripts/squid.old	2006-06-15 22:41:51.000000000 +0200
+++ scripts/squid	2006-06-15 22:44:56.000000000 +0200
@@ -39,13 +39,16 @@
  			AUTH_HELPERS="${AUTH_HELPERS} LDAP"
  		fi
  			
+		if [ "$CONFIG_NET_SNMP" = "y" ]; then
+			ENABLE_SNMP="--enable-snmp"
+		fi
+
  		./configure --prefix=/usr --sysconfdir=/etc --bindir=/usr/sbin 
--libexecdir=/usr/sbin \
  			--datadir=/usr/share/squid --localstatedir=/var/squid 
--sharedstatedir=/var/squid \
  			--enable-delay-pools --enable-useragent-log --enable-referer-log 
--enable-arp-acl \
  			--enable-ssl --with-openssl --enable-htcp --enable-linux-netfilter \
-			--enable-basic-auth-helpers="$AUTH_HELPERS" \
+			--enable-basic-auth-helpers="$AUTH_HELPERS" $ENABLE_SNMP \
  			--enable-default-err-language=English 
--enable-err-languages="English" || exit 1
-		# --enable-snmp
  		make $PMAKE all || exit 1
  		strip_debug
  	fi

> > They look like they might be worth a try.
> >
> > Try them all, or just the ones we're missing (there may be conflicts)?
> > I'd stick them all in and see what happens.
> 
> I agree, let's use 'em all.

After looking and comparing them, we can't use them all.

For example, the "login" in the shadow package has "include" lines to
files that don't exist, and it calls pam modules that we don't have
(i.e.  pam_selinux.so).

It looks like we're going to have to create our own pam files for the
ones we're missing.  We can use the list of pam files in the shadow
package as reference to make sure we have every file that it has, and we
are missing a few of them now.

Currently the pam files are in a src tar file, and there are some that I
think should be changed.  So, I'm going to get rid of the tar file and
put the pam files in CVS (build/config/etc/pam.d/) so we have a record
of changes.

 - BS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Wed, June 14, 2006 15:32, Bruce Smith wrote:
>> So the question is, which route should we go?
>> Leave the locked down 'other' and create a new file for every program?
>>
>
> It sounds more secure to have a locked down 'other',
> but I'm not a PAM expert, so I really don't know.
>
>> It may be best just to copy the ones Serge found within the shadow
>> package.
>
> Ah hum, the ones *I* found in the shadow package!  :-)

That's what I wrote. The bytes must have gotten messed up when the data
was transfered to the mail server. I heard that happens somtimes. ;-)

> They look like they might be worth a try.
>
>
> Try them all, or just the ones we're missing (there may be conflicts)?
> I'd stick them all in and see what happens.

I agree, let's use 'em all.

- -- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iEYEARECAAYFAkSQdJYACgkQUcytMSbs+YU2MwCgh2ORFdbhv+mBBn7uiAe3Iw1J
tg0An0hKkqy9IwgatTSuv4jKk1iPQUdj
=VnuO
-----END PGP SIGNATURE-----

> So the question is, which route should we go?
> Leave the locked down 'other' and create a new file for every program?

It sounds more secure to have a locked down 'other',
but I'm not a PAM expert, so I really don't know.

> It may be best just to copy the ones Serge found within the shadow package.

Ah hum, the ones *I* found in the shadow package!  :-)

They look like they might be worth a try.  

Try them all, or just the ones we're missing (there may be conflicts)?
I'd stick them all in and see what happens.

 - BS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Wed, June 14, 2006 05:00, Dr. Alberto Benati wrote:
> Yes, the problem is /etc/pam.d/other file.
>
>
> In Red Hat Enterprise Linux ES release 3:
> auth     required       /lib/security/$ISA/pam_deny.so account  required
> /lib/security/$ISA/pam_deny.so
> password required       /lib/security/$ISA/pam_deny.so session  required
> /lib/security/$ISA/pam_deny.so
>
>
> In my internal server, I use:
> auth     required       pam_unix.so account  required       pam_unix.so
> password required       pam_unix.so session  required       pam_unix.so

So the question is, which route should we go?
Leave the locked down 'other' and create a new file for every program?
It may be best just to copy the ones Serge found within the shadow package.

- -- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iEYEARECAAYFAkSQKPcACgkQUcytMSbs+YXFiQCfTsKkG00gdn64a8uButLRVvlU
Q+cAn3lIHnqrTAL3NqkN5P1YxPEvZxfZ
=Fy/w
-----END PGP SIGNATURE-----

After looking around a little after a full compile, I found these:

.....build/tmp/shadow-4.0.16/etc/pam.d # ll
total 76
-rw-r--r-- 1 root root 10519 Jun 14 02:05 Makefile
-rw-r--r-- 1 2732 2732   379 May 11 12:48 Makefile.am
-rw-r--r-- 1 2732 2732 10882 Jun  1 17:19 Makefile.in
-rw-r--r-- 1 2732 2732   103 Jan  2 15:36 chage
-rw-r--r-- 1 2732 2732   103 May 11 12:47 chgpasswd
-rw-r--r-- 1 2732 2732   103 Jan  2 15:36 chpasswd
-rw-r--r-- 1 2732 2732   103 Jan  2 15:36 groupadd
-rw-r--r-- 1 2732 2732   103 Jan  2 15:36 groupdel
-rw-r--r-- 1 2732 2732   103 Jan  2 15:36 groupmod
-rw-r--r-- 1 2732 2732   336 Jan  2 15:36 login
-rw-r--r-- 1 2732 2732   103 Jan  2 15:36 newusers
-rw-r--r-- 1 2732 2732    97 Jan  2 15:36 passwd
-rw-r--r-- 1 2732 2732   512 Jan  2 15:36 su
-rw-r--r-- 1 2732 2732   103 Jan  2 15:36 useradd
-rw-r--r-- 1 2732 2732   103 Jan  2 15:36 usermod


Should we be using those PAM files instead of the ones we have?
Most are a little different than the ones we're using now.

 - BS

> root@squid:~ # userdel serge
> userdel: error removing group entry
> userdel: error removing shadow group entry

It's not saying "PAM" error any more...

Is there anything in the messages log (VC10?) or dmesg with a more
descriptive error message?

 - BS

On 6/13/06, Serge Leschinsky <fi...@in...> wrote:
>
> Oops.. I am in a great hurry ...
>
> > ========================================================
> > for i in usermod userdel groupadd groudel groupmod
> > do
> >      cp -a /etc/pam.d/useradd /etc/pam.d/$i
> > done
>
> > save-config
> > ========================================================
>


root@squid:~ # useradd serge
root@squid:~ # usermod -L serge
root@squid:~ # usermod -U serge
root@squid:~ # userdel serge
userdel: error removing group entry
userdel: error removing shadow group entry
root@squid:~ # groupadd dl-linux
root@squid:~ # groupmod -g 6000 dl-linux
root@squid:~ # groupdel dl-linux

So, everything is working except userdel.
-- 
John Bridleman

Yes, the problem is /etc/pam.d/other file.

In Red Hat Enterprise Linux ES release 3:
auth     required       /lib/security/$ISA/pam_deny.so
account  required       /lib/security/$ISA/pam_deny.so
password required       /lib/security/$ISA/pam_deny.so
session  required       /lib/security/$ISA/pam_deny.so

In my internal server, I use:
auth     required       pam_unix.so
account  required       pam_unix.so
password required       pam_unix.so
session  required       pam_unix.so


Alberto

+--------------------------+
|   Dott. Alberto Benati   |
|   System Administrator   |
|   Faculty of Economics   |
|  University of  Ferrara  |
| be...@ec... |
|   Tel: +39 0532 293006   |
+--------------------------+


---------- Original Message -----------
From: Serge Leschinsky <fi...@in...>
To: Bruce Smith <dev...@li...>
Sent: Tue, 13 Jun 2006 19:32:22 -0700
Subject: Re: [Devil-linux-develop] groupadd PAM problem.

> 
> > Let's not forget about 'usermod' & 'groupmod'.  Can you try those John?
> 
> As far as I know, if pam config for usermod (or groupmod) is absent, 
> the "other" config should be used. Otherwise we have to write 
> configs for _all_ binaries from the system...
> 
> I guess, there are 2 possible causes of problem:
> 1) the package ( which contain  userdel, useradd etc) is wrongly compiled
> 2) the pam config "other" is wrong.
> 
> I'll see tonight. But I can't start compilation on my note due to the
> note age, so I'll see on the latest beta -
> devil-linux-1.2.10-2006-06-08-i686-SMP.tar.bz2 .  I'm sorry, but I'm
> now in business trip in  Sunnyvale, CA and have no access to build
> environment & build boxes.
> 
------- End of Original Message -------

Yes, the problem is /etc/pam.d/other file.

In Red Hat Enterprise Linux ES release 3:
auth     required       /lib/security/$ISA/pam_deny.so
account  required       /lib/security/$ISA/pam_deny.so
password required       /lib/security/$ISA/pam_deny.so
session  required       /lib/security/$ISA/pam_deny.so

In my internal server, I use:
auth     required       pam_unix.so
account  required       pam_unix.so
password required       pam_unix.so
session  required       pam_unix.so


Alberto

+--------------------------+
|   Dott. Alberto Benati   |
|   System Administrator   |
|   Faculty of Economics   |
|  University of  Ferrara  |
| be...@ec... |
|   Tel: +39 0532 293006   |
+--------------------------+


---------- Original Message -----------
From: Serge Leschinsky <fi...@in...>
To: Bruce Smith <dev...@li...>
Sent: Tue, 13 Jun 2006 19:32:22 -0700
Subject: Re: [Devil-linux-develop] groupadd PAM problem.

> 
> > Let's not forget about 'usermod' & 'groupmod'.  Can you try those John?
> 
> As far as I know, if pam config for usermod (or groupmod) is absent, 
> the "other" config should be used. Otherwise we have to write 
> configs for _all_ binaries from the system...
> 
> I guess, there are 2 possible causes of problem:
> 1) the package ( which contain  userdel, useradd etc) is wrongly compiled
> 2) the pam config "other" is wrong.
> 
> I'll see tonight. But I can't start compilation on my note due to the
> note age, so I'll see on the latest beta -
> devil-linux-1.2.10-2006-06-08-i686-SMP.tar.bz2 .  I'm sorry, but I'm
> now in business trip in  Sunnyvale, CA and have no access to build
> environment & build boxes.
> 
------- End of Original Message -------

Bruce,

Tuesday, June 13, 2006, 10:15:51 AM, you wrote:

> Serge, someone told me that 'groupadd' wasn't working (PAM problem), and
> found the cause and solution of the problem here:

> http://linuxfromscratch.org/pipermail/blfs-support/2004-December/052929.html

> So I changed the Linux-PAM install script to copy /etc/pam.d/useradd
> to /etc/pamd.d/groupadd as quick fix to get 1.2.10 released soon.

> I wasn't sure if I should add groupadd to $SRCDIR/pam.d.tar.bz2 or not.
You are absolutely right.

I've looked through /etc/pam.d/other. It's very secure ....

Needless to say that groupdel, usermod etc weren't able to work this such config.

Sorry for inconvenience...

-- 
Best regards,
 Serge                            mailto:fi...@in...