Geysers video presentation
- October 3rd, 2010
- Write comment
Archive for the ‘IT’ Category
So far, it’s really time to write something about this
… Good news!
Sometimes you just have to spread alerts such this one.
If you are running 64-bit Linux machines, then you should take care of this vulnerability, because there is also a public exploit that is being used to attack affected production systems. If your distribution has already provided a patch, you just have to update your system kernel. Otherwise, you should patch it yourself. A couple of links about that:
Ksplice developers also wrote a tool to check if your systems have been compromised by that exploit by looking for the backdoors it installs. You can find it here. In order to do the check, just download this source code file, compile it, and run it. You should see something like this:
$ gcc -o diagnose-2010-3081 diagnose-2010-3081.c $ ./diagnose-2010-3081 Diagnostic tool for public CVE-2010-3081 exploit -- Ksplice, Inc. (see http://www.ksplice.com/uptrack/cve-2010-3081) $$$ Kernel release: 2.6.26-XX-XXX-XXX $$$ Backdoor in LSM (1/3): not available. $$$ Backdoor in timer_list_fops (2/3): not available. $$$ Backdoor in IDT (3/3): checking...not present. Your system is free from the backdoors that would be left in memory by the published exploit for CVE-2010-3081.
Otherwise, your system is already compromised.
Patch this vulnerability and consider also running some analysis, because while this is a publicly known exploit, there are probably many bad guys with their own one.
nohup ./my_time_consuming_script.sh and its args
By the way, if you use the bash shell, you can get the same result using the disown builtin command, that can remove jobs from the job table, or to mark jobs so that SIGHUP is not sent to them if the parent shell receives it. The syntax is:
disown [-ar] [-h] [jobspec ...]
with options meaning:
That’s it, let the machine do the jobs and go sunbathing

You should also ( if you did not before ) append your public rsa id to your iphone root ‘authorized_keys’ file in order to avoid being prompted for password at each step, as explained in this previous entry.
I did this as root, but you may try running it as mobile if you wish, just replace any root@ with mobile@ using vim or sed ‘s/root@/mobile@/g’.
Also, this is a good chance ( to add the security tag
) to remember you, jailbreaked iphone users, to change the default ssh “alpine” password, because otherwise, if you connect to untrusted (public) networks with the ssh daemon running, stealing all of your personal data may be easy as running this script
( If your first thought is “they won’t know my ip!”, give up: a simple nmap scan will reveal you quickly and easily )
You can download the script here
Ok, this can be found pretty everywhere on the internet, but on the n-th time someone asked me how to use management scripts that do stuffs via SSH without have to enter one or more password, I need to write it here so that next time I’ll have no remorse in saying “go read it online, on my website”.
Well, here’s the story: you can connect via ssh to other hosts without entering your password as long as you can prove that you are authorized to login with that identity. This is achieved by placing a public key on the host you want to connect to, so that when you try to login an authentication handshake is prompted to your machine that is then supposed to own the corresponding private key and thus to be able to complete the handshake.
This is what happend behind, you won’t see anything of this during your ssh login. But in order to make this mechanism work, you have to place that public key on the host you want to connect to. Probably for this purpose you may want to use your public RSA key generated to use ssh, that you can find in ~/.ssh/id_rsa.pub where ‘~’ is your home folder ( please be careful not mismatching this with ~/.ssh/id_rsa that is your private key: instead take care of this file by setting proper permissions and/or encryption because this file represent your identity and if leaked, anyone can access any machine where your public key is placed to consider you an “authorized” user ).
The place where ssh daemon looks for authorized keys when someone try to connect to the system as the given user is, with very small imagination, the ~user/.ssh/authorized_keys file, where ~user is the home of the user you are trying to login as e.g. with ssh user@whaterver-host.com. So basically what you have to do is append your own ~/.ssh/id_rsa.pub to the remote ~user/.ssh/authorized_keys. Here is a command you can use ( you will have to prompt the password two last times
).
ssh user@whaterver-host.com 'if [ ! -d ~/.ssh ];then mkdir ~/.ssh; fi'; cat ~/.ssh/id_rsa.pub | \ ssh user@whaterver-host.com 'cat >> ~/.ssh/authorized_keys'
Now you will be able to login to whaterver-host.com just with ‘ ssh user@whaterver-host.com ‘ without being prompted for any password, even from many machines if you keep your id_rsa pair with you across them.( But remember, keep it safe! )
Cheers!
Apache Bash Scripting Business Cool Stuffs Debian e-games EU GEYSERS Google Graphics h4t Innovation iphone Java LaTeX Linux LUG Mac Os X Networking RAID regex Security service Social Networks Solaris ssh SSL Unix VPS www xhtml xpath
WP Cumulus Flash tag cloud by Roy Tanck and Luke Morton requires Flash Player 9 or better.
