Re: [Fwd: User account ( hacked ) of FC6 System]

[Tom Spec]

What do you mean by "solution"?  Do you want to stop people from logging in when
they have the correct password?

You should make your passwords strong enough so that people cannot (easily) guess/hack
them.
Don't allow people to log in as root remotely.
You can limit where people can log in from by using iptables.

Tom

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

Tom Spec wrote:

>  What do you mean by "solution"? Do you want to stop people
> from
>  logging in when they have the correct password?
>
>  You should make your passwords strong enough so that people cannot
>  (easily) guess/hack them.
>  Don't allow people to log in as root remotely.
>  You can limit where people can log in from by using iptables.
>
>  Tom 
If there is ssh-telnet service for user...
Then is there a solution to fix the problem of hack ( although someone
who know the user's password, but they can't modify / delete any profile
files, so the user who can login to the server nect time again ) ?
eg : limit user profile ( user account ) ?
if so, how to do this ?

Edward.

[Fwd: User account ( hacked ) of FC6 System]

[Les Mikesell]

edwardspl(a)ita.org.mo wrote:
>  Tom Spec wrote:
> > What do you mean by "solution"?  Do you want to stop people from 
> > logging in when they have the correct password?
> >
> > You should make your passwords strong enough so that people cannot 
> > (easily) guess/hack them.
> > Don't allow people to log in as root remotely.
> > You can limit where people can log in from by using iptables.
> >
> > Tom
>  If there is ssh-telnet service for user...
>  Then is there a solution to fix the problem of hack ( although someone 
>  who know the user's password, but they can't modify / delete any profile 
>  files, so the user who can login to the server nect time again ) ?
>  eg : limit user profile ( user account ) ?
>  if so, how to do this ?
>  
>  Edward. 
I think the real solution is to teach your user that it is important not 
to let others know his password if he hasn't figured that out himself 
yet.  And if others do need this access they should have their own 
accounts instead of being able to pretend to be someone else.

-- 
   Les Mikesell
    lesmikesell(a)gmail.com

[Fwd: User account ( hacked ) of FC6 System]

[Dotan Cohen]

On 08/02/07, Les Mikesell <lesmikesell(a)gmail.com&gt; wrote:
>  I think the real solution is to teach your user that it is important
> not
>  to let others know his password if he hasn't figured that out himself
>  yet.  And if others do need this access they should have their own
>  accounts instead of being able to pretend to be someone else.
>  
A better solution might be to gently widen the space between the chair
and the keyboard, remove anything you find on the chair, and then
replace the chair to it's former position. This should eliminate the
most failure-prone of components in your particular system.

Dotan Cohen

http://what-is-what.com/what_is/internet.html
http://dramatherapist.info

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

Les Mikesell wrote:

>  edwardspl(a)ita.org.mo wrote:
>
> > Tom Spec wrote:
> >
> >> What do you mean by "solution"? Do you want to stop people from
> >> logging in when they have the correct password?
> >>
> >> You should make your passwords strong enough so that people cannot
> >> (easily) guess/hack them.
> >> Don't allow people to log in as root remotely.
> >> You can limit where people can log in from by using iptables.
> >>
> >> Tom
> >
> > If there is ssh-telnet service for user...
> > Then is there a solution to fix the problem of hack ( although
> > someone who know the user's password, but they can't modify / delete
> > any profile files, so the user who can login to the server nect time
> > again ) ?
> > eg : limit user profile ( user account ) ?
> > if so, how to do this ?
> >
> > Edward.
>
>
>  I think the real solution is to teach your user that it is important
>  not to let others know his password if he hasn't figured that out
>  himself yet. And if others do need this access they should have their
>  own accounts instead of being able to pretend to be someone else.
>  
Hello,

But I think the user account ( profile files ) is also problem, so, I
want to know how limit the related files ( including the dot file ) !

Edward.

[Fwd: User account ( hacked ) of FC6 System]

[Les Mikesell]

edwardspl(a)ita.org.mo wrote:
> >
> > I think the real solution is to teach your user that it is important
> > not to let others know his password if he hasn't figured that out
> > himself yet. And if others do need this access they should have their
> > own accounts instead of being able to pretend to be someone else.
> > 
>  
>  But I think the user account ( profile files ) is also problem, so, I
>  want to know how limit the related files ( including the dot file ) !
>   
This was covered in another topic.
Using normal unix permissions:
https://www.redhat.com/archives/fedora-list/2007-February/msg01197.html
or with the special chattr operation:
https://www.redhat.com/archives/fedora-list/2007-February/msg01247.html

You'll have to fix them for the existing broken account first, though. 
   Either delete the account and re-add it or copy working versions of 
the files over from a working account as root.

-- 
   Les Mikesell
    lesmikesell(a)gmail.com

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

Les Mikesell wrote:

>  edwardspl(a)ita.org.mo wrote:
>
> >>
> >> I think the real solution is to teach your user that it is important
> >> not to let others know his password if he hasn't figured that out
> >> himself yet. And if others do need this access they should have their
> >> own accounts instead of being able to pretend to be someone else.
> >>
>
> >
> > But I think the user account ( profile files ) is also problem, so, I
> > want to know how limit the related files ( including the dot file ) !
> >
>
>  This was covered in another topic.
>  Using normal unix permissions:
>  https://www.redhat.com/archives/fedora-list/2007-February/msg01197.html
>  or with the special chattr operation:
>  https://www.redhat.com/archives/fedora-list/2007-February/msg01247.html
>
>  You'll have to fix them for the existing broken account first, though.
>  Either delete the account and re-add it or copy working versions of
>  the files over from a working account as root.
>  
Hello to you,

1, The System is FC6.
2, After run "adduser edward" and login with user "edward", then

[edward@svr1 ~]$ ls -l -a
total 36
drwx------ 3 edward edward 4096 Feb 6 22:51 .
drwxr-xr-x 5 root root 4096 Feb 6 22:50 ..
-rw------- 1 edward edward 67 Feb 7 12:47 .bash_history
-rw-r--r-- 1 edward edward 24 Feb 6 22:50 .bash_logout
-rw-r--r-- 1 edward edward 176 Feb 7 11:57 .bash_profile
-rw-r--r-- 1 edward edward 124 Feb 6 22:50 .bashrc
drwxr-xr-x 3 edward edward 4096 Feb 6 22:50 .kde
-rw-r--r-- 1 edward edward 658 Feb 6 22:50 .zshrc
[edward@svr1 ~]$

3, Is it :
chown root /home/edward
chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
chmod +t ( What number of +t ) /home/edward
chown root /home/edward/ All_dot_filenames

Edward.

[Fwd: User account ( hacked ) of FC6 System]

[Les Mikesell]

edwardspl(a)ita.org.mo wrote:
>  Les Mikesell wrote:
>  
> > edwardspl(a)ita.org.mo wrote:
> >
> >>> I think the real solution is to teach your user that it is important
> >>> not to let others know his password if he hasn't figured that out
> >>> himself yet. And if others do need this access they should have their
> >>> own accounts instead of being able to pretend to be someone else.
> >>>
> >> But I think the user account ( profile files ) is also problem, so, I
> >> want to know how limit the related files ( including the dot file ) !
> >>
> > This was covered in another topic.
> > Using normal unix permissions:
> > https://www.redhat.com/archives/fedora-list/2007-February/msg01197.html
> > or with the special chattr operation:
> > https://www.redhat.com/archives/fedora-list/2007-February/msg01247.html
> >
> > You'll have to fix them for the existing broken account first, though.
> > Either delete the account and re-add it or copy working versions of
> > the files over from a working account as root.
> >
>  Hello to you,
>  
>  1, The System is FC6.
>  2, After run "adduser edward" and login with user "edward", then
You'll need to do most of this as root.

>  
>  [edward@svr1 ~]$ ls -l -a
>  total 36
>  drwx------ 3 edward edward 4096 Feb 6 22:51 .
>  drwxr-xr-x 5 root root 4096 Feb 6 22:50 ..
>  -rw------- 1 edward edward 67 Feb 7 12:47 .bash_history
>  -rw-r--r-- 1 edward edward 24 Feb 6 22:50 .bash_logout
>  -rw-r--r-- 1 edward edward 176 Feb 7 11:57 .bash_profile
>  -rw-r--r-- 1 edward edward 124 Feb 6 22:50 .bashrc
>  drwxr-xr-x 3 edward edward 4096 Feb 6 22:50 .kde
>  -rw-r--r-- 1 edward edward 658 Feb 6 22:50 .zshrc
>  [edward@svr1 ~]$
>  
>  3, Is it :
>  chown root /home/edward
>  chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward 
You can use the symbolic form literally. I think it's easier to 
understand.  Let the computer do the binary/octal math.
  g+rwx means add the read, write, and execute bits for the group.

>  chmod +t ( What number of +t ) /home/edward 
Same here, you can type it that way and it means add the "sticky" bit.

>  chown root /home/edward/ All_dot_filenames 

Don't get carried away with wildcards on this one.  .* will also match 
.. which is your parent directory.

-- 
   Les Mikesell
    lesmikesell(a)gmail.com

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

Les Mikesell wrote:

>  edwardspl(a)ita.org.mo wrote:
>
> > Les Mikesell wrote:
> >
> >> edwardspl(a)ita.org.mo wrote:
> >>
> >>>> I think the real solution is to teach your user that it is important
> >>>> not to let others know his password if he hasn't figured that out
> >>>> himself yet. And if others do need this access they should have their
> >>>> own accounts instead of being able to pretend to be someone else.
> >>>>
> >>> But I think the user account ( profile files ) is also problem, so, I
> >>> want to know how limit the related files ( including the dot file ) !
> >>>
> >> This was covered in another topic.
> >> Using normal unix permissions:
> >> https://www.redhat.com/archives/fedora-list/2007-February/msg01197.html
> >> or with the special chattr operation:
> >> https://www.redhat.com/archives/fedora-list/2007-February/msg01247.html
> >>
> >> You'll have to fix them for the existing broken account first, though.
> >> Either delete the account and re-add it or copy working versions of
> >> the files over from a working account as root.
> >>
> > Hello to you,
> >
> > 1, The System is FC6.
> > 2, After run "adduser edward" and login with user "edward", then
>
>
>  You'll need to do most of this as root.
>
> >
> > [edward@svr1 ~]$ ls -l -a
> > total 36
> > drwx------ 3 edward edward 4096 Feb 6 22:51 .
> > drwxr-xr-x 5 root root 4096 Feb 6 22:50 ..
> > -rw------- 1 edward edward 67 Feb 7 12:47 .bash_history
> > -rw-r--r-- 1 edward edward 24 Feb 6 22:50 .bash_logout
> > -rw-r--r-- 1 edward edward 176 Feb 7 11:57 .bash_profile
> > -rw-r--r-- 1 edward edward 124 Feb 6 22:50 .bashrc
> > drwxr-xr-x 3 edward edward 4096 Feb 6 22:50 .kde
> > -rw-r--r-- 1 edward edward 658 Feb 6 22:50 .zshrc
> > [edward@svr1 ~]$
> >
> > 3, Is it :
> > chown root /home/edward
> > chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
>
>
>  You can use the symbolic form literally. I think it's easier to
>  understand. Let the computer do the binary/octal math.
>  g+rwx means add the read, write, and execute bits for the group. 
But I want to know what no of g+rwx...

> > chmod +t ( What number of +t ) /home/edward
>
>
>  Same here, you can type it that way and it means add the "sticky" bit. 
Also want to know...

> > chown root /home/edward/ All_dot_filenames
>
>
>
>  Don't get carried away with wildcards on this one. .* will also match
>  .. which is your parent directory.
>  
ok,
chown root /home/edward/.*

Edward.

[Fwd: User account ( hacked ) of FC6 System]

[Tim]

On Thu, 2007-02-08 at 16:38 +0800, edwardspl(a)ita.org.mo wrote:
>  But I want to know what no of g+rwx 
The RWX bits are binary flags in most significant order.

 Some examples:
 RWX = 111 (binary)
 RW- = 110 (binary)

The least-significant bit (rightmost) is worth one, the middle is worth
2, the most significant bit is worth four.

 Some examples:
 RWX = 4 + 2 + 1 = 7 (decimal)
 R-X = 4 + 0 + 1 = 6 (decimal)
 R-- = 4 + 0 + 0 = 4 (decimal)

Since we're only counting up as far as 7, you can use those numbers
directly as octal.  From 0 to 7, octal, hexadecimal, and decimal numbers
are all represented by the same symbols.

As above with RWX=7 and R=4, 
u=RWX, g=RWX o=R-- (user, group, others) = 0774 (octal, with a leading
zero to indicate that it is octal)

-- 
(This PC runs FC4, my others FC5 & FC6, in case that's important
 to the thread)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

Tim wrote:

> On Thu, 2007-02-08 at 16:38 +0800, edwardspl(a)ita.org.mo wrote:
>   
>
> >But I want to know what no of g+rwx
> >    
> >
>
> The RWX bits are binary flags in most significant order.
>
>  Some examples:
>  RWX = 111 (binary)
>  RW- = 110 (binary)
>
> The least-significant bit (rightmost) is worth one, the middle is worth
> 2, the most significant bit is worth four.
>
>  Some examples:
>  RWX = 4 + 2 + 1 = 7 (decimal)
>  R-X = 4 + 0 + 1 = 6 (decimal)
>  R-- = 4 + 0 + 0 = 4 (decimal)
>
> Since we're only counting up as far as 7, you can use those numbers
> directly as octal.  From 0 to 7, octal, hexadecimal, and decimal numbers
> are all represented by the same symbols.
>
> As above with RWX=7 and R=4, 
> u=RWX, g=RWX o=R-- (user, group, others) = 0774 (octal, with a leading
> zero to indicate that it is octal)
>
>   
>  
Hello,

So...What no for the following setting ?
1, g+rwx
2, +t

Edward.

[Fwd: User account ( hacked ) of FC6 System]

[Tim]

On Thu, 2007-02-08 at 20:36 +0800, edwardspl(a)ita.org.mo wrote:
>  So...What no for the following setting ?
>  1, g+rwx
>  2, +t  
You can work them out for yourself by reading the chmod man page.  The
information you need is in there, without having to wait for us to
reply, or make a mistake and post misleading information without
noticing it.

But I have to ask:  Why bother trying to *work* out what binary
represents g=rwx, instead of actually using g=rwx, directly?  Likewise,
for the sticky bit.  What's the point?

-- 
(This box runs FC5, my others run FC4 & FC6, in case that's
 important to the thread.)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.

[Fwd: User account ( hacked ) of FC6 System]

[Les Mikesell]

edwardspl(a)ita.org.mo wrote:

> >> chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
> >
> > You can use the symbolic form literally. I think it's easier to
> > understand. Let the computer do the binary/octal math.
> > g+rwx means add the read, write, and execute bits for the group.
>  
>  But I want to know what no of g+rwx... 
The + means it is added to the bits already permitted.  Look at them as
groups of 3 bits in binary and take the octal value.

 user   group    other
 rwx    rwx     rwx

You'll start with a home dir having rwx --- ---  so that's 111 000 000
binary or 700 octal.
Add  the group rwx and you get 111 111 000 or 770 octal

> >> chmod +t ( What number of +t ) /home/edward 
That's one more bit to the left, 1 000 000 000  binary, so 1000 octal.
Add that to what you have.

> > Same here, you can type it that way and it means add the
> "sticky" bit.
>  
>  Also want to know... 
Altogether, the octal value for the mode ends up at 1770.  But, as I
said before the computer does a better job of thinking in octal.

> >> chown root /home/edward/ All_dot_filenames
> >
> > Don't get carried away with wildcards on this one. .* will also match
> > .. which is your parent directory.
> >
>  ok,
>  chown root /home/edward/.* 
I meant not to do that.  In this case it won't break anything because
the parent (..) dir of /home/edward will alread be owned by root, but it
is a bad idea in general to wildcard .*

-- 
  Les Mikesell
  lesmikesell(a)gmail.com

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

Les Mikesell wrote:

> edwardspl(a)ita.org.mo wrote:
>
>   
>
> >>>chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
> >>>        
> >>>
> >>You can use the symbolic form literally. I think it's easier to
> >>understand. Let the computer do the binary/octal math.
> >>g+rwx means add the read, write, and execute bits for the group.
> >>      
> >>
> >But I want to know what no of g+rwx...
> >    
> >
>
> The + means it is added to the bits already permitted.  Look at them as
> groups of 3 bits in binary and take the octal value.
>
>  user   group    other
>  rwx    rwx     rwx
>
> You'll start with a home dir having rwx --- ---  so that's 111 000 000
> binary or 700 octal.
> Add  the group rwx and you get 111 111 000 or 770 octal
>   
>  
So, g+rwx = 770, right ?

> >>>chmod +t ( What number of +t ) /home/edward
> >>>        
> >>>
>
> That's one more bit to the left, 1 000 000 000  binary, so 1000 octal.
> Add that to what you have.
>
>   
>
> >>Same here, you can type it that way and it means add the "sticky" bit.
> >>      
> >>
> >Also want to know...
> >    
> >
>
> Altogether, the octal value for the mode ends up at 1770.  But, as I
> said before the computer does a better job of thinking in octal.
>   
>  
So, +t = 1770, right ?

Edward.

[Fwd: User account ( hacked ) of FC6 System]

[Les Mikesell]

edwardspl(a)ita.org.mo wrote:
> >   
> >>>> chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
> >>>>         
> >>> You can use the symbolic form literally. I think it's easier to
> >>> understand. Let the computer do the binary/octal math.
> >>> g+rwx means add the read, write, and execute bits for the group.
> >>>       
> >> But I want to know what no of g+rwx...
> >>     
> >
> > The + means it is added to the bits already permitted.  Look at them as
> > groups of 3 bits in binary and take the octal value.
> >
> >  user   group    other
> >  rwx    rwx     rwx
> >
> > You'll start with a home dir having rwx --- ---  so that's 111 000 000
> > binary or 700 octal.
> > Add  the group rwx and you get 111 111 000 or 770 octal
> >   
>  So, g+rwx = 770, right ? 
No..  Literally it means to add the 2nd 7 (the ---rwx--- positions) to 
whatever was there before.  In the case of a typical home directory it 
will be 770 because the first 7 ( rwx------) was already there.

> >>>> chmod +t ( What number of +t ) /home/edward
> >>>>         
> >
> > That's one more bit to the left, 1 000 000 000  binary, so 1000 octal.
> > Add that to what you have.
> >
> >   
> >>> Same here, you can type it that way and it means add the "sticky"
> bit.
> >>>       
> >> Also want to know...
> >>     
> >
> > Altogether, the octal value for the mode ends up at 1770.  But, as I
> > said before the computer does a better job of thinking in octal.
> >   
>  So, +t = 1770, right ? 
Again, that is the case where you already have 770 set, but +t really 
means to add the 1000 bit to whatever was there.  You can also specify 
absolute settings in the symbolic style:
chmod u=rwx,g=rwx,o=t file...
will set 1770 regardless of what is there and is easier to understand.
See 'man chmod' for more details, but it helps to know that the modes 
are simply bits where 1 gives the permission, 0 does not. The values you 
compute in octal show the combinations of the bits but they really each 
only have their own independent meaning so I think the symbolic form 
makes more sense.

-- 
   Les Mikesell
    lesmikesell(a)gmail.com

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

Les Mikesell wrote:

>  edwardspl(a)ita.org.mo wrote:
>
> >>>>> chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
> >>>>
> >>>> You can use the symbolic form literally. I think it's easier to
> >>>> understand. Let the computer do the binary/octal math.
> >>>> g+rwx means add the read, write, and execute bits for the group.
> >>>
> >>> But I want to know what no of g+rwx...
> >>
> >>
> >> The + means it is added to the bits already permitted. Look at them as
> >> groups of 3 bits in binary and take the octal value.
> >>
> >> user group other
> >> rwx rwx rwx
> >>
> >> You'll start with a home dir having rwx --- --- so that's 111 000 000
> >> binary or 700 octal.
> >> Add the group rwx and you get 111 111 000 or 770 octal
> >
> > So, g+rwx = 770, right ?
>
>
>  No.. Literally it means to add the 2nd 7 (the ---rwx--- positions) to
>  whatever was there before. In the case of a typical home directory it
>  will be 770 because the first 7 ( rwx------) was already there. 
So... what is the correct no for the pression limitation ?
Or may be chmod g+770

> >>
> >> That's one more bit to the left, 1 000 000 000 binary, so 1000 octal.
> >> Add that to what you have.
> >>
> >>>> Same here, you can type it that way and it means add the
> "sticky"
> >>>> bit.
> >>>
> >>> Also want to know...
> >>
> >>
> >> Altogether, the octal value for the mode ends up at 1770. But, as I
> >> said before the computer does a better job of thinking in octal.
> >
> > So, +t = 1770, right ?
>
>  chmod +t ( What number of +t ) /home/edward
>
>  Again, that is the case where you already have 770 set, but +t really
>  means to add the 1000 bit to whatever was there. You can also specify
>  absolute settings in the symbolic style:
>  chmod u=rwx,g=rwx,o=t file...
>  will set 1770 regardless of what is there and is easier to understand.
>  See 'man chmod' for more details, but it helps to know that the modes
>  are simply bits where 1 gives the permission, 0 does not. The values
>  you compute in octal show the combinations of the bits but they really
>  each only have their own independent meaning so I think the symbolic
>  form makes more sense.
>  
So... is it correct ?

[Fwd: User account ( hacked ) of FC6 System]

[Les Mikesell]

edwardspl(a)ita.org.mo wrote:

> >>>>>> chmod g+rwx ( What number of g+rwx, eg : ?77
> ) /home/edward
> >>> said before the computer does a better job of thinking in octal.
> >> So, +t = 1770, right ?
> > chmod +t ( What number of +t ) /home/edward
> >
> > Again, that is the case where you already have 770 set, but +t really
> > means to add the 1000 bit to whatever was there. You can also specify
> > absolute settings in the symbolic style:
> > chmod u=rwx,g=rwx,o=t file...
> > will set 1770 regardless of what is there and is easier to understand.
> > See 'man chmod' for more details, but it helps to know that the modes
> > are simply bits where 1 gives the permission, 0 does not. The values
> > you compute in octal show the combinations of the bits but they really
> > each only have their own independent meaning so I think the symbolic
> > form makes more sense.
> >
>  So... is it correct ? 
If you start with

drwx------ /home/edward
the commands

chmod g+rwx /home/edward
chmod +t /home/edward
or
chmod u=rwx,g=rwx,o=t /home/edward
or
chmod 1770 /home/edward

will all give you the same result:
drwxrwx---T  /home/edward

-- 
  Les Mikesell
   lesmikesell(a)gmail.com

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

Les Mikesell wrote:

> edwardspl(a)ita.org.mo wrote:
>
>   
>
> >>>>>>>chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
> >>>>>>>                
> >>>>>>>
> >>>>said before the computer does a better job of thinking in octal.
> >>>>          
> >>>>
> >>>So, +t = 1770, right ?
> >>>        
> >>>
> >>chmod +t ( What number of +t ) /home/edward
> >>
> >>Again, that is the case where you already have 770 set, but +t really
> >>means to add the 1000 bit to whatever was there. You can also specify
> >>absolute settings in the symbolic style:
> >>chmod u=rwx,g=rwx,o=t file...
> >>will set 1770 regardless of what is there and is easier to understand.
> >>See 'man chmod' for more details, but it helps to know that the modes
> >>are simply bits where 1 gives the permission, 0 does not. The values
> >>you compute in octal show the combinations of the bits but they really
> >>each only have their own independent meaning so I think the symbolic
> >>form makes more sense.
> >>
> >>      
> >>
> >So... is it correct ?
> >    
> >
>
> If you start with
>
> drwx------ /home/edward
> the commands
>
> chmod g+rwx /home/edward
> chmod +t /home/edward
> or
> chmod u=rwx,g=rwx,o=t /home/edward
> or
> chmod 1770 /home/edward
>
> will all give you the same result:
> drwxrwx---T  /home/edward
>
>   
>  
So.. only chmod 1770 /home/edward

[Fwd: User account ( hacked ) of FC6 System]

[Les Mikesell]

edwardspl(a)ita.org.mo wrote:

> >> So... is it correct ?
> >>     
> >
> > If you start with
> >
> > drwx------ /home/edward
> > the commands
> >
> > chmod g+rwx /home/edward
> > chmod +t /home/edward
> > or
> > chmod u=rwx,g=rwx,o=t /home/edward
> > or
> > chmod 1770 /home/edward
> >
> > will all give you the same result:
> > drwxrwx---T  /home/edward
> >
> >   
>  So.. only chmod 1770 /home/edward 
It's your choice.  The permission bits are the same any way you say it, 
but it is best to use the way that you understand and do an 'ls -ld' on 
the directory after the chmod to be sure it is right.  Remember, the 
object of this is to set the directory owner/modes so that the user can 
still create/remove his own files but can't remove/replace certain files 
that you will chown to root.

-- 
   Les Mikesell
    lesmikesell(a)gmail.com

[Fwd: User account ( hacked ) of FC6 System]

[Tim]

On Fri, 2007-02-09 at 09:44 -0600, Les Mikesell wrote:
>  Remember, the object of this is to set the directory owner/modes so
>  that the user can still create/remove his own files but can't
>  remove/replace certain files that you will chown to root. 
I am curious whether a user can cause system problems by modifying their
own files?

-- 
(This PC runs FC4, my others FC5 & FC6, in case that's important
 to the thread)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

Tim wrote:

> On Fri, 2007-02-09 at 09:44 -0600, Les Mikesell wrote:
>   
>
> >Remember, the object of this is to set the directory owner/modes so
> >that the user can still create/remove his own files but can't
> >remove/replace certain files that you will chown to root.
> >    
> >
>
> I am curious whether a user can cause system problems by modifying their
> own files?
>
>   
>  
Someone recommend disable ssh / telnet service and do the limitation for
FTP Service...

[Fwd: User account ( hacked ) of FC6 System]

[Les Mikesell]

Tim wrote:

> > Remember, the object of this is to set the directory owner/modes
> so
> > that the user can still create/remove his own files but can't
> > remove/replace certain files that you will chown to root.
>  
>  I am curious whether a user can cause system problems by modifying their
>  own files? 
Generally not, but they can get in a state where their own login does 
not work.  I think this thread started in regard to someone other than 
the real user getting access and damaging some files.

-- 
   Les Mikesell
    lesmikesell(a)gmail.com

[Fwd: User account ( hacked ) of FC6 System]

[Tim]

Tim:
> > I am curious whether a user can cause system problems by
> modifying their
> > own files? 
Les Mikesell:
>  Generally not, but they can get in a state where their own login does
>
>  not work.  I think this thread started in regard to someone other than 
>  the real user getting access and damaging some files. 
I seem to recall that, though I think that's another problem that needs
addressing in itself (I can't remember if it was).  I could also imagine
a novice user messing up their own files.  But didn't think they'd be
able to cause problems to the system or other users with their own.

-- 
(This PC runs FC4, my others FC5 & FC6, in case that's important
 to the thread)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.

[Fwd: User account ( hacked ) of FC6 System]

[Howard Howell]

On Sat, 2007-02-10 at 01:19 -0600, Les Mikesell wrote:
>  Tim wrote:
>  
>  >> Remember, the object of this is to set the directory owner/modes so
>  >> that the user can still create/remove his own files but can't
>  >> remove/replace certain files that you will chown to root.
>  > 
>  > I am curious whether a user can cause system problems by modifying their
>  > own files?
>  
>  Generally not, but they can get in a state where their own login does 
>  not work.  I think this thread started in regard to someone other than 
>  the real user getting access and damaging some files.
>   
Thanks, Les,
I forgot to mention in the information that I sent that the changes to
the user account would only affect that user.  (unless of course that
user is root, or a super user in the wrong account.)

Regards,
Les H

[Fwd: User account ( hacked ) of FC6 System]

[Howard Howell]

On Sat, 2007-02-10 at 17:14 +1030, Tim wrote:
>  On Fri, 2007-02-09 at 09:44 -0600, Les Mikesell wrote:
>  > Remember, the object of this is to set the directory owner/modes so
>  > that the user can still create/remove his own files but can't
>  > remove/replace certain files that you will chown to root.
>  
>  I am curious whether a user can cause system problems by modifying their
>  own files? 
Yes, they can.  There are many many files in the user account that
either begin with "." or reside in a directory that begins with "."
that
the user owns and can modify, which are in fact modified by the controls
for the various applications, so write capability is required for
customization.  If you go to a users directory and do the command 
	% ls -al
	
   You will see a number of files and directories that begin with "." in
each of these there are controls for the applications behavior from
".login" to ".bashrc" or ".kashrc" to various
".ini" files or ".dat"
files that are used to setup and initialize applications, or in the case
of the browser to select plugins to decode some forms of web data, such
as JAVA or Jscript, movie formats, still photograph formats, downloads,
etc. etc.

   When I maintained Unix systems, I would always have a generic user
account that I could verify settings in, so that I could take a user
back to basics to get them going again when things got messed up in
their accounts or to check that the system had not in some way become
corrupted (we did development, so lots of things could happen).

Regards,
Les H

[Fwd: User account ( hacked ) of FC6 System]

[Tim]

Tim:
> > I am curious whether a user can cause system problems by
> modifying
> > their own files? 
Les:
>  Yes, they can.  There are many many files in the user account that
>  either begin with "." or reside in a directory that begins with "."
>  that the user owns and can modify, which are in fact modified by the
>  controls for the various applications, so write capability is required
>  for customization.  If you go to a users directory and do the command 
>          % ls -al
>          
>     You will see a number of files and directories that begin with "."
>  in each of these there are controls for the applications behavior from
>  ".login" to ".bashrc" or ".kashrc" to various
> ".ini" files or ".dat"
>  files that are used to setup and initialize applications, or in the
>  case of the browser to select plugins to decode some forms of web
>  data, such as JAVA or Jscript, movie formats, still photograph
>  formats, downloads, etc. etc.  
That much I know.  They can affect how *they* use their account, but can
they affect the "system"?  i.e. What the computer does in their absence,
and how other users use it?

Sure, I can stuff up my .bash* files, and make it impossible for me to
use my account properly.  But the next person to log on isn't using my
account, and isn't affected by my mangled .bash* files.  The question is
can I do something to my personal files that isn't restricted to my own
use of a system?

-- 
(This box runs FC5, my others run FC4 & FC6, in case that's
 important to the thread.)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.

[Fwd: User account ( hacked ) of FC6 System]

On Thursday 08 February 2007 09:29, edwardspl(a)ita.org.mo 
wrote:
>  Les Mikesell wrote:
>  >edwardspl(a)ita.org.mo wrote:
>  >>>>chmod g+rwx ( What number of g+rwx, eg : ?77 )
>  >>>> /home/edward
>  >>>
>  >>>You can use the symbolic form literally. I think it's
>  >>> easier to understand. Let the computer do the
>  >>> binary/octal math. g+rwx means add the read, write,
>  >>> and execute bits for the group.
>  >>
>  >>But I want to know what no of g+rwx...
>  >
>  >The + means it is added to the bits already permitted. 
>  > Look at them as groups of 3 bits in binary and take the
>  > octal value.
>  >
>  > user   group    other
>  > rwx    rwx     rwx
>  >
>  >You'll start with a home dir having rwx --- ---  so
>  > that's 111 000 000 binary or 700 octal.
>  >Add  the group rwx and you get 111 111 000 or 770 octal
>
>  So, g+rwx = 770, right ?
>
>  >>>>chmod +t ( What number of +t ) /home/edward
>  >
>  >That's one more bit to the left, 1 000 000 000  binary,
>  > so 1000 octal. Add that to what you have.
>  >
>  >>>Same here, you can type it that way and it means add
>  >>> the "sticky" bit.
>  >>
>  >>Also want to know...
>  >
>  >Altogether, the octal value for the mode ends up at
>  > 1770.  But, as I said before the computer does a better
>  > job of thinking in octal.
>
>  So, +t = 1770, right ?
>
>  Edward. 
When I first started learning how to write the permissions 
setting RWX I could not figure out how to do it using the 
letters.  I found it very easy to understand doing it with 
the numbers.  I type it like this chmod 777 <file> to get 
the rwxrwxrwx and if I want to change it to rwxr-xr-x I 
just type chmod 755 <file> and if I want rwx------ I type 
chmod 700 <file>.  I am sure I can figure out how to write 
it with the letters now but I think it is much easier to 
use the numbers.

[Fwd: User account ( hacked ) of FC6 System]

[Edward S.P. Leong]

linuxmaillists(a)charter.net wrote:

> On Thursday 08 February 2007 09:29, edwardspl(a)ita.org.mo 
> wrote:
>   
>
> >Les Mikesell wrote:
> >    
> >
> >>edwardspl(a)ita.org.mo wrote:
> >>      
> >>
> >>>>>chmod g+rwx ( What number of g+rwx, eg : ?77 )
> >>>>>/home/edward
> >>>>>            
> >>>>>
> >>>>You can use the symbolic form literally. I think it's
> >>>>easier to understand. Let the computer do the
> >>>>binary/octal math. g+rwx means add the read, write,
> >>>>and execute bits for the group.
> >>>>          
> >>>>
> >>>But I want to know what no of g+rwx...
> >>>        
> >>>
> >>The + means it is added to the bits already permitted. 
> >>Look at them as groups of 3 bits in binary and take the
> >>octal value.
> >>
> >>user   group    other
> >>rwx    rwx     rwx
> >>
> >>You'll start with a home dir having rwx --- ---  so
> >>that's 111 000 000 binary or 700 octal.
> >>Add  the group rwx and you get 111 111 000 or 770 octal
> >>      
> >>
> >So, g+rwx = 770, right ?
> >
> >    
> >
> >>>>>chmod +t ( What number of +t ) /home/edward
> >>>>>            
> >>>>>
> >>That's one more bit to the left, 1 000 000 000  binary,
> >>so 1000 octal. Add that to what you have.
> >>
> >>      
> >>
> >>>>Same here, you can type it that way and it means add
> >>>>the "sticky" bit.
> >>>>          
> >>>>
> >>>Also want to know...
> >>>        
> >>>
> >>Altogether, the octal value for the mode ends up at
> >>1770.  But, as I said before the computer does a better
> >>job of thinking in octal.
> >>      
> >>
> >So, +t = 1770, right ?
> >
> >Edward.
> >    
> >
>
> When I first started learning how to write the permissions 
> setting RWX I could not figure out how to do it using the 
> letters.  I found it very easy to understand doing it with 
> the numbers.  I type it like this chmod 777 <file> to get 
> the rwxrwxrwx and if I want to change it to rwxr-xr-x I 
> just type chmod 755 <file> and if I want rwx------ I type 
> chmod 700 <file>.  I am sure I can figure out how to write 
> it with the letters now but I think it is much easier to 
> use the numbers.
>
>   
>  
Hello,

So...Do you know the following ( convert to the no format) ?

1, chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
2, chmod +t ( What number of +t ) /home/edward

Edward.

[Fwd: User account ( hacked ) of FC6 System]

[Howard Howell]

On Thu, 2007-02-08 at 13:36 +0800, edwardspl(a)ita.org.mo wrote:
>  Les Mikesell wrote:
>  > edwardspl(a)ita.org.mo wrote: 
>  > > Tom Spec wrote: 
>  > > > What do you mean by "solution"?  Do you want to stop people
> from
>  > > > logging in when they have the correct password? 
>  > > > 
>  > > > You should make your passwords strong enough so that people
>  > > > cannot (easily) guess/hack them. 
>  > > > Don't allow people to log in as root remotely. 
>  > > > You can limit where people can log in from by using iptables. 
>  > > > 
>  > > > Tom 
>  > > If there is ssh-telnet service for user... 
>  > > Then is there a solution to fix the problem of hack ( although
>  > > someone who know the user's password, but they can't modify /
>  > > delete any profile files, so the user who can login to the server
>  > > nect time again ) ? 
>  > > eg : limit user profile ( user account ) ? 
>  > > if so, how to do this ? 
>  > > 
>  > > Edward. 
>  > 
>  > I think the real solution is to teach your user that it is important
>  > not to let others know his password if he hasn't figured that out
>  > himself yet.  And if others do need this access they should have
>  > their own accounts instead of being able to pretend to be someone
>  > else. 
>  > 
>  Hello,
>  
>  But I think the user account ( profile files ) is also problem, so, I
>  want to know how limit the related files ( including the dot file ) !
>  
>  Edward.
>  --  
The only thing that the system "knows" about the user is the
username
and password.  If those are correct, as far as the computer is concerned
the person driving the keys is supposed to have that level of access.
There are other security methods that could be installed and used, such
as key cards, randomizer tokens to choose periodic random passwords in
sync with a randomizer server, or personal ID things such as fingerprint
scanners or even facial recognition o name a few.  But these
technologies are still quite new and the cost of implementation such
scanners is quite high.

Regards,
Les H

[Fwd: User account ( hacked ) of FC6 System]

[Manuel Arostegui Ramirez]

On Thursday 08 February 2007 11:36:21 Les wrote:
>  On Thu, 2007-02-08 at 13:36 +0800, edwardspl(a)ita.org.mo wrote:
>  > Les Mikesell wrote:
>  > > edwardspl(a)ita.org.mo wrote:
>  > > > Tom Spec wrote:
>  > > > > What do you mean by "solution"?  Do you want to stop people
> from
>  > > > > logging in when they have the correct password?
>  > > > >
>  > > > > You should make your passwords strong enough so that people
>  > > > > cannot (easily) guess/hack them.
>  > > > > Don't allow people to log in as root remotely.
>  > > > > You can limit where people can log in from by using iptables.
>  > > > >
>  > > > > Tom
>  > > >
>  > > > If there is ssh-telnet service for user...
>  > > > Then is there a solution to fix the problem of hack ( although
>  > > > someone who know the user's password, but they can't modify /
>  > > > delete any profile files, so the user who can login to the server
>  > > > nect time again ) ?
>  > > > eg : limit user profile ( user account ) ?
>  > > > if so, how to do this ?
>  > > >
>  > > > Edward.
>  > >
>  > > I think the real solution is to teach your user that it is important
>  > > not to let others know his password if he hasn't figured that out
>  > > himself yet.  And if others do need this access they should have
>  > > their own accounts instead of being able to pretend to be someone
>  > > else.
>  >
>  > Hello,
>  >
>  > But I think the user account ( profile files ) is also problem, so, I
>  > want to know how limit the related files ( including the dot file ) !
>  >
>  > Edward.
>  > --
>
>  The only thing that the system "knows" about the user is the username
>  and password.  If those are correct, as far as the computer is concerned
>  the person driving the keys is supposed to have that level of access.
>  There are other security methods that could be installed and used, such
>  as key cards, randomizer tokens to choose periodic random passwords in
>  sync with a randomizer server, or personal ID things such as fingerprint
>  scanners or even facial recognition o name a few.  But these
>  technologies are still quite new and the cost of implementation such
>  scanners is quite high.
>
>  Regards,
>  Les H 
Don't know if someone has already talked about it or not during the whole 
thread.
But...what if the user account which was hacked had some ssh-keys on it .ssh/
It might be stolen :-)

Just to keep this thread alive :-)

-- 
Un saludo,

        Manuel Arostegui
        Tecnico de Sistemas
        c/ Marques de Monteagudo 15, 4 -  28028 Madrid
        Tel. [phone] - Fax. [phone] - http://www.artica.es
        GNUPG Key  http://www.artica.es/gnupg/marostegui.asc

Este e-mail es confidencial y destinado únicamente a la  persona a la cual va
dirigido. Si Ud. no es el destinatario al cual va dirigido este e-mail o lo
recibe por error, queda advertido que cualquier uso, difusión, impresión o
copia de este mensaje está estrictamente prohibido. Si lo ha recibido por
error, por favor, notifíquelo al remitente del mensaje.