Discuss

discuss@lists.centos.org

1 participants
34730 discussions

Re: [CentOS] Re: About strongs passwords! -- PAM
by Bryan J. Smith <b.j.smith＠ieee.org> 13 May '05

13 May '05

From: Paul Heinlein <heinlein(a)madboa.com> > Can you comment on any of the smart-card hardware that you've used? Actually, given the occupation I just switched back to last month, I'd better not right now (I'm still "testing the waters" on what disclosure is allowable). I've used them in 2 industries -- defense and financial -- but there's no reason why many others can't. The priniciples to SmartCards are pretty simple. You send in a public key encrypted information (typically a symmetric key or maybe a challenge string), you get the information out. Then you can use that information as appropriate. The SmartCard is used only for 1 small operation on the _client_ for the user. (although you can also use them on the server too, for the services). And via PAM, you can route all sorts of authentication through it. I'll send you some links when I have time early next week (I'm on the road / in the air all weekend starting in a few minutes). There are a lot of more "consumer" SmartCard capabilities out there, nothing of which I've used personally. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: Mini-centOS -- "Thin Clients" and lack of read-only boot
by Bryan J. Smith <b.j.smith＠ieee.org> 13 May '05

13 May '05

From: Greg Knaddison <greg.knaddison(a)gmail.com> > If you want to compare CentOS to this, then you have to realize that > this "lightweight" version of MS will only run a remote desktop > session (Terminal Service), a browser (IE), a music app (MSWindows > Media Player), a virus scanner and a file navigation utility > (Explorer). They are basically "Thin Clients" using a PXE boot, although local installation is an option. Long story short, Microsoft has _never_ produced a "consumer" Windows product, not DOS7 "Chicago" nor NT, that is "read-only" bootable. That's been a major limitation of DOS/NT versus UNIX systems, they _require_ the filesystem to be "read/write" during the boot process. Most of this is due to the more "consumer" libraries designed for DOS7 "Chicago" Windows (9x/Me). At the most they've created an ultra-light Win32 kernel with just enough to RDesktop out of a EEPROM. But even when they did, companies like Wyse and many others opted for a BSD kernel with Citrix code instead of Microsoft's. This is a totally different issue. Microsoft is trying to do what UNIX X-Terminals, Workstations and other UNIX-based Thin Clients have done for years. This isn't "innovative" it's "catching up" to UNIX. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: About strongs passwords! -- PAM
by Bryan J. Smith <b.j.smith＠ieee.org> 13 May '05

13 May '05

From: israel.garcia(a)cimex.com.cu > 1. My users have to work on the shell because, they run a C++ > scritp to work in tha database.. If it's just 1 or 2 scripts, consider limiting access to programs with another shell and/or a web or other front-end that only lets them launch a specific process. > 2. So I want to force my users to pick a strong password.. Is there some > command, tool to do this? Actually, modifying PAM rules are highly recommended for this. So it not only does it for a single program, but all programs that change the password. But ideally, you should consider _not_ using passwords for SSH. You should enable either public key authentication or Kerberos. It increases security ten-fold because the actual communication sent is a challenge -- i.e., a one-time, random password that is not good ever again. In the case of public key authentication, you'll want to use passphrases, and enforce strong rules on those. The passphrases protect the private key on the client, which you never want to store whole. You'll need to research how to enforce that with "ssh-keygen" and the local "/etc/ssh/*config*" on each system where they are using the SSH client. If you're really anal, you can use smart cards. Then no system ever has even the private key. It's actually easier to setup for SSH than most people think. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

Re: [CentOS] Mini-centOS
by Bryan J. Smith <b.j.smith＠ieee.org> 13 May '05

13 May '05

From: Doug Koobs <dkoobs(a)dkoobs.com> > If it helps any, I'm running CentOS4 on an old PII 400Mhz, 192MB laptop. Under > Gnome, it's not exactly snappy, but it is usable. Unser XFCE4.2, i'm quite ahppy > with it. I know you stated that you need Gnome, and I also prefer it. But if you > haven't tried some of the lightweight alternatives, give them a shot, you may be > surprised. The nice thing about XFCE is that it is a _total_ session+file+window solution, like KDE and GNOME. And if you don't like XFCE's session+file managers, you can always use Rox-Filer (which works flawlessly with XFCE's xfwm window manager). > Intereating article about the new lightweight Windows OS. There's _no_ such thing on the retail shelf or in volume Windows license. Unless you link from the _Embedded_ NT/2000/XP releases, you can't "unlink" all sorts of crap that "leeches" on the NTkernel, GDI, etc... These so-called "lightweight" Windows OS releases are nothing more than some things not bundled. It's a 100% marketing gimmick. Unfortunately, "Chicago"-designed MS IE is required by all apps since the mid-'90s, which is the crux of the resource and, more relevantly, security in the current bastardization of Win32 we call NT5.1 (XP/2003). So it's hard to get rid of if you run anything that was developed with Visual Studio. It's really sad. Some Windows architects are really sharp guys, but the "applications" developers still develop like NT is DOS7 "Chicago" -- assuming the world is safe and users have full access over the system. No wonder Marc left for Google! > However, I don't think it will meet your needs, as it will be extremely crippled, > to the point it won't even run MS Office if I read correctly. Depends on what is left out. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] Mini-centOS
by kenkensmile＠netscape.net 13 May '05

13 May '05

Chris Mauritz <chrism(a)imntv.com> wrote: >kenkensmile(a)netscape.net wrote: > >>I am using centOS for my server and centOS is extremely stable. I almost love centOS more than my wife. However, centOS is a bit heavy to run on my notebook (P III 1G, 256MB RAM). I need gnome, firefox, openoffice, realplayer, gaim, acrobat and thunderbird on my notebook, but if I install all of them (plus base-system), my notebook becomes very slow. I wish I could have a lighter version of centOS for notebooks and old desktops. Is there any project that I could have a mini-centOS in the future??? >> >> >> > > >The slowness isn't really CentOS's fault. That's not really enough >memory for an X+gnome environment if you're going to be running piggy >applications like openoffice. Also, I suspect an older P3 notebook >probably has rather slow video hardware which may make things seem worse >than they really are. The best thing you can do to speed things up is >to bump your memory up to 512mb. I suspect that will make a big >difference in perceived speed. > >Cheers, > >C > Thanks for the reply. Yes, you are exactly right. My notebook has a slow video hardware(8MB). Unfortunately, I cannot upgrade memory up to 512MB, because 256MB is the maximum capacity. I have also found an article that MS is making a new OS for old computers, so I just simply thought I would like to have a mini-centOS. http://news.com.com/2100-1016_3-5705456.html Cheers, Joe __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

5 4

Re: [CentOS] About strongs passwords!
by israel.garcia＠cimex.com.cu 13 May '05

13 May '05

Message: 5 Date: Thu, 12 May 2005 08:41:20 -0400 From: Matt Hyclak <hyclak(a)math.ohiou.edu> Subject: Re: [CentOS] About strongs passwords! To: centos(a)centos.org Message-ID: <20050512124120.GB5989(a)math.ohiou.edu> Content-Type: text/plain; charset="us-ascii" On Thu, May 12, 2005 at 08:35:03AM -0500, israel.garcia(a)cimex.com.cu enlightened us: > List, It's amazing the soon the messages on this list are answered, I am > glad and I want to thank you all for that... > > Here is my question, I have a DataBase CentOS server working with about > 150 users connected via ssh, so I want to set up for all users strongs > passwords, I mean, 8 or more caracters, with ,.;* , ect....... Is there > some option, bash command which do that? > Great, but: 1. My users have to work on the shell because, they run a C++ scritp to work in tha database.. 2. So I want to force my users to pick a strong password.. Is there some command, tool to do this? Regards, Israel The mkpasswd command included in the expect RPM can generate them for you. A little shell scripting will change the passwords for the users. Matt

2 1

When .. isnt the same? (not a problem
by Ulrik S. Kofod 13 May '05

13 May '05

I dont understand why ".." isnt working the same way for "ls" and "cd" when inside a symbolic link. The reason I ask is that I made a link to a directory with some scripts that saves output in "../output.txt" and I could not find the output until I found that ".." isnt the directory you see when you do a $pwd. I solved the problem by making a directory and then make a link to each script in there. I would just like to know: 1) if there is a good reason to this behaviour. 2) if there is a rule, so you know when ".." is level up from $ pwd and when it is one level up from the link target. 3) if there is an alternativ way to point to the parent directory. Personally I can't see why you would ever need ".." to be one level up from the link target. Example: $ ln -s /home link_to_home; cd link_to_home $ ls .. bin dev home lib misc $ cd ..;ls link_to_home Have a nice weekend Ulrik -- This message has been scanned for viruses and dangerous content by OpenProtect(http://www.openprotect.com), and is believed to be clean.

2 1

RE: [CentOS] When ".." isn't the same? (not a problem
by Marc Powell 13 May '05

13 May '05

> -----Original Message----- > From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On > Behalf Of Maciej Zenczykowski > Sent: Friday, May 13, 2005 9:19 AM > To: CentOS mailing list > Subject: RE: [CentOS] When ".." isn't the same? (not a problem > > > I believe I understand what you're describing and it's been a long time > > since I've had this 'issue' but if I remember correctly, it's a function > > of your shell, which I believe is going to be bash. It tries to be > > intelligent about its symlink handling. It remembers the cd path you > > used to get to that symlink and 'cd ..' sends you back the same way you > > got in. It basically treats symlinks as real directories, not pointers. > > This can be very useful but it can also be annoying. I'll bet if you use > > tcsh, which uses a more literal interpretation of the file-structure, it > > would work as you expect. I wasn't ever interested in it enough to see > > if it could be disabled in bash. > > I believe the proper option is -P as in "set -P" in bash to disable this > feature (IMHO very useful). Indeed -- -P If set, the shell does not follow symbolic links when executing commands such as cd that change the current working directory. It uses the physical directory structure instead. By default, bash follows the logical chain of directories when performing commands which change the current directory. -- Marc

1 0

Apache config for Squirrelmail?
by James B. Byrne 13 May '05

13 May '05

This is my corrected configuration file for squirrelmail over ssl if anyone is interested: # squirrelmail.conf 2005 May 13 James B. Byrne JBB8 # # SquirrelMail is a webmail package written in PHP. # This configuration file forces users to connect via SSL # # If the incoming request is already https:// then this # file will only be processed if the directive: # # Include /etc/httpd/conf.d/squirrelmail.conf # # is appended to ssl.conf for the default server or added # to the virtual host configuration file of the virtual # host used to process webmail. Note that ssl requires # IP addressed virtual hosts to work and that the necessary # Listen directives must be placed in the appropriate # configuration files as well. # Alias /webmail /usr/share/squirrelmail <Directory /usr/share/squirrelmail> AllowOverride None Options ExecCGI Order allow,deny Allow from all </Directory> RewriteEngine on RewriteLog "/var/log/httpd/rewrite_log" RewriteLogLevel 0 # AIDE-MEMOIRE # Arguments $1, $2 etc. refer to () matches in the # CURRENT RewriteRule line. # Arguments %1, %2 etc. refer to () matches in the # LAST matched RewriteCond. # Do not process established ssl squirrelmail sessions RewriteCond %{HTTPS} on RewriteCond %{REQUEST_URI} ^/webmail(/?|/.*)$ RewriteRule (^.*$) - [L,R] # Rewrite short form URLs whether SSL or not for forms # webmail.anything.dom and www.webmail.anything.dom RewriteCond %{HTTP_HOST} ^(www\.)?(webmail\.)(..+\.)(..+)$ [NC] RewriteCond %{REQUEST_URI} !^/webmail/ RewriteRule (^.*$) https://webmail.%3%4/webmail/ [L,R] # Force SSL otherwise RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} ^/webmail(/?|/.*)$ RewriteCond %{HTTP_HOST} ^(.*\.)?(..+\.)(..+)$ [NC] RewriteRule (^.*$) https://webmail.%2%3/webmail/ [L,R] #EOF -- *** e-mail is not a secure channel *** mailto:byrnejb.<token>@harte-lyne.ca James B. Byrne Harte & Lyne Limited vox: +1 905 561 1241 9 Brockley Drive fax: +1 905 561 0757 Hamilton, Ontario <token> = hal Canada L8E 3C3

1 0

RE: [CentOS] When ".." isn't the same? (not a problem
by Marc Powell 13 May '05

13 May '05

> -----Original Message----- > From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On > Behalf Of Ulrik S. Kofod > Sent: Friday, May 13, 2005 2:25 AM > To: centos(a)centos.org > Subject: [CentOS] When ".." isn't the same? (not a problem > > I don't understand why ".." isn't working the same way for "ls" and "cd" > when inside > a symbolic link. The reason I ask is that I made a link to a directory > with some > scripts that saves output in "../output.txt" and I could not find the > output until I > found that ".." isn't the directory you see when you do a $pwd. I solved > the problem > by making a directory and then make a link to each script in there. > > I would just like to know: > 1) if there is a good reason to this behaviour. > 2) if there is a rule, so you know when ".." is level up from $ pwd and > when it is > one level up from the link target. > 3) if there is an alternativ way to point to the parent directory. > I believe I understand what you're describing and it's been a long time since I've had this 'issue' but if I remember correctly, it's a function of your shell, which I believe is going to be bash. It tries to be intelligent about its symlink handling. It remembers the cd path you used to get to that symlink and 'cd ..' sends you back the same way you got in. It basically treats symlinks as real directories, not pointers. This can be very useful but it can also be annoying. I'll bet if you use tcsh, which uses a more literal interpretation of the file-structure, it would work as you expect. I wasn't ever interested in it enough to see if it could be disabled in bash. -- Marc

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss