- Roundtable - muug.ca

Linux capabilities vs setuid-root
by Gilbert E. Detillieux 16 Sep '15

16 Sep '15

I mentioned Linux capabilities (setcap/getcap commands) briefly during last night's round-table session, and Trevor mentioned that he thought that recent Fedora releases had eliminated the use of setuid-root binaries in favour of capabilities-based binaries. (That's the stated goal, in any case.) Not sure about the very latest Fedora/Rawhide releases, but here are the numbers on a Fedora 21 host I was able to quickly check... $ getcap /usr/*bin/*|wc -l 10 $ ls -l /usr/*bin/*|grep '^...s'|wc -l 21 $ ls -l /usr/*bin/*|grep '^......s'|wc -l 7 $ All of the setuid binaries (in the second command) are setuid-root. The setgid binaries (last command) have varying group ID's. For comparison, here are the numbers on an EL7 host... $ getcap /usr/*bin/*|wc -l 8 $ ls -l /usr/*bin/*|grep '^...s'|wc -l 23 $ ls -l /usr/*bin/*|grep '^......s'|wc -l 9 $ The difference in counts between the two hosts likely has more to do with specific packages loaded than with actual differences in the distros, though. Note that Linux capabilities are intended to grant only specific kernel-based rights that were otherwise restricted to root, so it likely won't eliminate all setuid/setgid use cases, without some more drastic coding solutions. Gilbert -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.mb.ca> c/o Gilbert E. Detillieux Web: http://www.muug.mb.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

4 3

Free e-books
by Gilbert E. Detillieux 10 Sep '15

10 Sep '15

Someone mentioned a web site offering a different free e-book each day, on various tech topics. Here's the correct URL for the site... https://www.packtpub.com/packt/offers/free-learning Enjoy! -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.mb.ca> c/o Gilbert E. Detillieux Web: http://www.muug.mb.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

3 2

MUUG Meeting, Sept 8, 7:30pm -- Spacewalk (Room 1M28, UofW)
by Gilbert E. Detillieux 03 Sep '15

03 Sep '15

Update: Meeting will be in Room 1M28, Manitoba Hall, U of Winnipeg. ******************************************************************* The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, September 8. The meeting topic for this month is as follows: Spacewalk This month, Wyatt Zacharias will be presenting Spacewalk, an open source systems management tool. Spacewalk allows administrators to deploy, manage, configure, and monitor their enterprise Linux hosts. Spacewalk also provides update management, security scans, and more. RTFM In the RTFM segment this month, Rob Keizer will be showing us Homebrew (brew(1)). Homebrew is the easiest and most flexible way to install the UNIX tools that Apple didn't include with OS X. Door Prize This month we will be giving away (among our other usual prizes) a ticket to Bsides Winnipeg 2015. Security BSides is a global, non-profit organization that exists to facilitate the creation of local information security conferences. These conferences are ideally organized by locals, and feature local presenters. Unlike other conferences, BSides events are low-cost, relaxed, and inclusive, and attempt to encourage interaction amongst organizers, speakers, and attendees. BSides Winnipeg 2015 will take place on November 14th & 15th, 2015 at The King's Head Pub from Noon to 7pm. Cost is $20 and comes with a meal each day. The group holds its general meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ****************************************************************** Please note our *NEW* meeting location for this month: *Room 1M28* Manitoba Hall, University of Winnipeg, entrance on Ellice Ave. between Spence St. and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ****************************************************************** For more information about MUUG, and its monthly meetings, check out their web server: http://www.muug.mb.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: http://www.muug.mb.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.mb.ca> c/o Gilbert E. Detillieux Web: http://www.muug.mb.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

Setting resource limits in Ubuntu 14.04
by Kevin McGregor 01 Sep '15

01 Sep '15

I have a server VM running Ubuntu 14.04. It mostly just runs apt-cacher-ng, which I suspect is running into its limit on open files. What's the proper way to increase this limit? I know there's the limit in /etc/security/limits.conf, but I've read elsewhere that doesn't apply! I've also read about "stanzas" for "Upstart" in Ubuntu, but I have no idea where to look for the right place to put that. I'm expecting something like limit nofiles 20000 or some such. I believe the process is running under its own userid "apt-cacher-ng". Any pointers? Kevin

1 0

MUUG Meeting, Sept 8, 7:30pm -- Spacewalk
by Gilbert E. Detillieux 01 Sep '15

01 Sep '15

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, September 8. The meeting topic for this month is as follows: Spacewalk This month, Wyatt Zacharias will be presenting Spacewalk, an open source systems management tool. Spacewalk allows administrators to deploy, manage, configure, and monitor their enterprise Linux hosts. Spacewalk also provides update management, security scans, and more. RTFM In the RTFM segment this month, Rob Keizer will be showing us Homebrew (brew(1)). Homebrew is the easiest and most flexible way to install the UNIX tools that Apple didn't include with OS X. Door Prize This month we will be giving away (among our other usual prizes) a ticket to Bsides Winnipeg 2015. Security BSides is a global, non-profit organization that exists to facilitate the creation of local information security conferences. These conferences are ideally organized by locals, and feature local presenters. Unlike other conferences, BSides events are low-cost, relaxed, and inclusive, and attempt to encourage interaction amongst organizers, speakers, and attendees. BSides Winnipeg 2015 will take place on November 14th & 15th, 2015 at The King's Head Pub from Noon to 7pm. Cost is $20 and comes with a meal each day. The group holds its general meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ****************************************************************** Please note our *NEW* meeting location for this month: (Room TBA), University of Winnipeg, entrance on Ellice Ave. between Spence St. and Balmoral St. Check our web site for updates on meeting location. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ****************************************************************** For more information about MUUG, and its monthly meetings, check out their web server: http://www.muug.mb.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: http://www.muug.mb.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.mb.ca> c/o Gilbert E. Detillieux Web: http://www.muug.mb.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

Ubuntu apt sources mirror architecture stuff
by Kevin McGregor 31 Aug '15

31 Aug '15

When I use dpkg -l | grep i386 on a x86_64 Ubuntu 14.04 system, I get an empty list. So, I'd assume (I guess incorrectly) that there are no i386 stuffses on this system. But when I do apt-get update I get a bunch of messages like W: Failed to fetch http://mirror/ubuntu/dists/trusty/main/binary-i386/Packages 404 Not Found Why is it try to find info about i386 packages? How can I ensure there really are no i386 packages, and then force apt to not ever look for i386 updates? Kevin

1 0

High-expectations Linux
by Kat 29 Aug '15

29 Aug '15

Something tells me this guy is one of "those" gamers. Suicide Linux package <http://sourceforge.net/projects/suicide-linux/files/> -- ------------------------------------------------------------ Katherine Scrupa Network Technology CCNA, Hons.

1 0

Nerds vs. normals: The two solitudes of tech | rabble.ca
by Bill Reid 14 Aug '15

14 Aug '15

This article had me nodding, Yup. http://rabble.ca/columnists/2015/08/nerds-vs-normals-two-solitudes-tech Enjoy, Bill

2 1

Re: [RndTbl] Roundtable Digest, Vol 127, Issue 4
by uniquegeek＠gmail.com 12 Jul '15

12 Jul '15

Maybe it was resold from a movie set. Sent from my BlackBerry 10 smartphone on the Rogers network. Original Message From: roundtable-request(a)muug.mb.ca Sent: Saturday, July 11, 2015 4:53 PM To: roundtable(a)muug.mb.ca Reply To: roundtable(a)muug.mb.ca Subject: Roundtable Digest, Vol 127, Issue 4 Send Roundtable mailing list submissions to roundtable(a)muug.mb.ca To subscribe or unsubscribe via the World Wide Web, visit http://www.muug.mb.ca/mailman/listinfo/roundtable or, via email, send a message with subject or body 'help' to roundtable-request(a)muug.mb.ca You can reach the person managing the list at roundtable-owner(a)muug.mb.ca When replying, please edit your Subject line so it is more specific than "Re: Contents of Roundtable digest..." Today's Topics: 1. Sun making users feel better through fakery (Adam Thompson) 2. Re: Sun making users feel better through fakery (Daryl F) ---------------------------------------------------------------------- Message: 1 Date: Sat, 11 Jul 2015 14:26:36 -0500 From: Adam Thompson <athompson(a)avant.ca> To: roundtable(a)muug.mb.ca Subject: [RndTbl] Sun making users feel better through fakery Message-ID: <CAFGv8b-XwnLpFM6VFcuJ+3_guvvZ_3OtT2_6XMKiCOdw8fRZ7g(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I have a Sun Storage Array 7110. This is an "integrated" appliance, running custom hardware and custom software. In the configuration GUI, on the page where I configure the 4 gigabit network ports, there are - as with everything else in the GUI - visual aids. In this case, there are schematic-style icons of four network ports on the left-hand side of the page, with little green and yellow indicators for link and traffic respectively. I know the green dots actually track the green LEDs on the back of the chassis, i.e. they do show actual link status in (near-)real-time. However, the yellow dots also flicker in a manner than *might* reflect the physical LEDs... but I was never sure. [image: Inline image 1] Today, while doing some unrelated maintenance on the unit, I got curious and dug in. I found this in the page's javascript: akNetDevice.prototype.setActivity = function (active) > { var dev = this; > for (var i = 0; i < this.akno_widgets.length; i++) this.akno_widgets[i].setActivity(active); > this.akno_timeout = setTimeout(function () { if (dev.akno_timeout) dev.setActivity(!active); }, 100 + Math.random() * (active ? akNet.DEVICE_FLICKER_ON : akNet.DEVICE_FLICKER_OFF)); };? *Despite* having found this, the flickering yellow dots *STILL* give me a sense of satisfaction, a vague notion that "oh, OK, the network ports are working"! Someone at Sun actually listened to a UI designer, it would seem. And yet I now also feel cheated - I was hoping the UI team was geeky enough to actually flash the browser window graphics in time with the hardware :). [image: Avant logo] *Adam Thompson* Senior Systems Administrator *voice:* 204.789.9596 x24 | *email:* athompson(a)avant.ca | *web:* avant.ca

1 0

Sun making users feel better through fakery
by Adam Thompson 11 Jul '15

11 Jul '15

I have a Sun Storage Array 7110. This is an "integrated" appliance, running custom hardware and custom software. In the configuration GUI, on the page where I configure the 4 gigabit network ports, there are - as with everything else in the GUI - visual aids. In this case, there are schematic-style icons of four network ports on the left-hand side of the page, with little green and yellow indicators for link and traffic respectively. I know the green dots actually track the green LEDs on the back of the chassis, i.e. they do show actual link status in (near-)real-time. However, the yellow dots also flicker in a manner than *might* reflect the physical LEDs... but I was never sure. [image: Inline image 1] Today, while doing some unrelated maintenance on the unit, I got curious and dug in. I found this in the page's javascript: akNetDevice.prototype.setActivity = function (active) > { var dev = this; > for (var i = 0; i < this.akno_widgets.length; i++) this.akno_widgets[i].setActivity(active); > this.akno_timeout = setTimeout(function () { if (dev.akno_timeout) dev.setActivity(!active); }, 100 + Math.random() * (active ? akNet.DEVICE_FLICKER_ON : akNet.DEVICE_FLICKER_OFF)); }; *Despite* having found this, the flickering yellow dots *STILL* give me a sense of satisfaction, a vague notion that "oh, OK, the network ports are working"! Someone at Sun actually listened to a UI designer, it would seem. And yet I now also feel cheated - I was hoping the UI team was geeky enough to actually flash the browser window graphics in time with the hardware :). [image: Avant logo] *Adam Thompson* Senior Systems Administrator *voice:* 204.789.9596 x24 | *email:* athompson(a)avant.ca | *web:* avant.ca

2 1