MIRC6:2011OSUpgradeChat - Revision history

Monnierast at 23:02, 15 May 2011

2011-05-15T23:02:32Z

← Older revision		Revision as of 23:02, 15 May 2011
Line 57:		Line 57:
	'''		'''

	~~'''~~
	'''EP: I thought you did not like sudo and wanted a root account. Debian does not use sudo by default but rather su. There is a remote possibility that changing debian from su to sudo authentication may break something, probably the package manager gui (which we do not use anyway). If we use sudo we should disable the root login. This does not mean that root is disabled but rather that you cannot login with a root password. To access the root account you type "sudo su -" and type your password.The advantage is that an attacher cannot try to guess the root password (because passwd login is disabled) but rather find out who has sudo privileges and guess the password.		''EP: I thought you did not like sudo and wanted a root account. Debian does not use sudo by default but rather su. There is a remote possibility that changing debian from su to sudo authentication may break something, probably the package manager gui (which we do not use anyway). If we use sudo we should disable the root login. This does not mean that root is disabled but rather that you cannot login with a root password. To access the root account you type "sudo su -" and type your password.The advantage is that an attacher cannot try to guess the root password (because passwd login is disabled) but rather find out who has sudo privileges and guess the password.
	~~''''''~~
	This is the old Mirkwood sudoers file (use visudo to edit. If you screw up you will not able to login any more)		This is the old Mirkwood sudoers file (use visudo to edit. If you screw up you will not able to login any more)
			''
	# sudoers file.		# sudoers file.
	#		#

Monnierast at 23:01, 15 May 2011

2011-05-15T23:01:21Z

← Older revision		Revision as of 23:01, 15 May 2011
Line 58:		Line 58:

	'''		'''
	EP: I thought you did not like sudo and wanted a root account. Debian does not use sudo by default but rather su. There is a remote possibility that changing debian from su to sudo authentication may break something, probably the package manager gui (which we do not use anyway). If we use sudo we should disable the root login. This does not mean that root is disabled but rather that you cannot login with a root password. To access the root account you type "sudo su -" and type your password.The advantage is that an attacher cannot try to guess the root password (because passwd login is disabled) but rather find out who has sudo privileges and guess the password.		'''EP: I thought you did not like sudo and wanted a root account. Debian does not use sudo by default but rather su. There is a remote possibility that changing debian from su to sudo authentication may break something, probably the package manager gui (which we do not use anyway). If we use sudo we should disable the root login. This does not mean that root is disabled but rather that you cannot login with a root password. To access the root account you type "sudo su -" and type your password.The advantage is that an attacher cannot try to guess the root password (because passwd login is disabled) but rather find out who has sudo privileges and guess the password.
	'''		''''''
	This is the old Mirkwood sudoers file (use visudo to edit. If you screw up you will not able to login any more)		This is the old Mirkwood sudoers file (use visudo to edit. If you screw up you will not able to login any more)

Line 115:		Line 115:
	# %users localhost=/sbin/shutdown -h now		# %users localhost=/sbin/shutdown -h now

	As you can see towards the end you can configure root privilege for specific users and for specific commands.		As you can see towards the end you can configure root privilege for specific users and for specific commands.
	----		----

Monnierast at 22:44, 15 May 2011

2011-05-15T22:44:51Z

← Older revision		Revision as of 22:44, 15 May 2011
Line 72:		Line 72:

	# User alias specification		# User alias specification
	Cmnd_Alias SPOOL = /usr/local/bin/spooler, /bin/su spooler -		Cmnd_Alias SPOOL = /usr/local/bin/spooler, /bin/su spooler -
	Cmnd_Alias ASTRO = /usr/local/bin/astropci_usr,/bin/mount /mnt/cdrom,/bin/umount /mnt/cdrom,/bin/mount /backup,/bin/umount /backup,/sbin/reboot,/sbin/halt		Cmnd_Alias ASTRO = /usr/local/bin/astropci_usr,/bin/mount /mnt/cdrom,/bin/umount /mnt/cdrom,/bin/mount /backup,/bin/umount /backup,/sbin/reboot,/sbin/halt

	# Cmnd alias specification		# Cmnd alias specification

	# Defaults specification		# Defaults specification

	# Reset environment by default		# Reset environment by default
	Defaults env_reset		Defaults env_reset
	# Uncomment to allow people in group wheel to export variables		# Uncomment to allow people in group wheel to export variables
	# Defaults:%wheel !env_reset		# Defaults:%wheel !env_reset

	# Allow people in group users to export specific variables		# Allow people in group users to export specific variables
	# Defaults:%users env_keep=TZ		# Defaults:%users env_keep=TZ

			Defaults:iluvatar !env_reset

	~~Defaults:iluvatar !env_reset~~		# Runas alias specification

	# ~~Runas alias specification~~		# * REMEMBER *************************************************
			# * GIVING SUDO ACCESS TO USERS ALLOWS THEM TO RUN THE SPECIFIED *
			# * COMMANDS WITH ELEVATED PRIVILEGES. *
			# * *
			# * ONLY PERMIT SUDO ACCESS SPARINGLY, AND NEVER ALLOW ACCESS TO *
			# * UNTRUSTED USERS. *
			# ****************************************************************

	# ~~* REMEMBER *************************************************~~		# User privilege specification
	# * GIVING SUDO ACCESS TO USERS ALLOWS THEM TO RUN THE SPECIFIED *		root ALL=(ALL) ALL
	# * COMMANDS WITH ELEVATED PRIVILEGES. *		iluvatar ALL=(ALL) ALL
	# * *
	# * ONLY PERMIT SUDO ACCESS SPARINGLY, AND NEVER ALLOW ACCESS TO *
	# * UNTRUSTED USERS. *
	# ****************************************************************

	# ~~User privilege specification~~		# Uncomment to allow people in group wheel to run all commands
	~~root ALL=(ALL) ALL~~		# %wheel ALL=(ALL) ALL
	~~iluvatar~~ ALL=(ALL) ALL

	# ~~Uncomment to allow people in group wheel to run all commands~~		# Same thing without a password
	# %wheel ALL=(ALL) ALL		# %wheel ALL=(ALL) NOPASSWD: ALL

	# ~~Same thing without a password~~		# Samples
	# ~~%wheel~~ ALL=(~~ALL~~) NOPASSWD: ~~ALL~~		#users ALL=NOPASSWD:/bin/mount,/mnt/cdrom,/bin/umount,/mnt/cdrom,/bin/mount,/data,/bin/umount /data
			mircdev ALL = NOPASSWD: /usr/bin/make astropci_install,/home/mircdev/control/astropci-rtai/user/astropci_usr
			observer ALL = (spooler,root) NOPASSWD:SPOOL, NOPASSWD: ASTRO
			# %users localhost=/sbin/shutdown -h now

	~~# Samples~~		As you can see towards the end you can configure root privilege for specific users and for specific commands.
	~~#users~~ ~~ALL=NOPASSWD:/bin/mount,/mnt/cdrom,/bin/umount,/mnt/cdrom,/bin/mount,/data,/bin/umount /data~~
	~~mircdev ALL = NOPASSWD: /usr/bin/make astropci_install,/home/mircdev/control/astropci-rtai/user/astropci_usr~~
	~~observer ALL = (spooler,root) NOPASSWD:SPOOL, NOPASSWD: ASTRO~~
	~~# %users localhost=/sbin/shutdown -h now~~

	As you can see towards the end you can configure root privilege for specific users and for specific commands.
	----		----

Monnierast at 22:41, 15 May 2011

2011-05-15T22:41:52Z

← Older revision		Revision as of 22:41, 15 May 2011
Line 62:		Line 62:
	This is the old Mirkwood sudoers file (use visudo to edit. If you screw up you will not able to login any more)		This is the old Mirkwood sudoers file (use visudo to edit. If you screw up you will not able to login any more)

	# sudoers file.		# sudoers file.
	#		#
	# This file MUST be edited with the 'visudo' command as root.		# This file MUST be edited with the 'visudo' command as root.
	#		#
	# See the sudoers man page for the details on how to write a sudoers file.		# See the sudoers man page for the details on how to write a sudoers file.
	#		#

	# Host alias specification		# Host alias specification

	# User alias specification		# User alias specification
	Cmnd_Alias SPOOL = /usr/local/bin/spooler, /bin/su spooler -		Cmnd_Alias SPOOL = /usr/local/bin/spooler, /bin/su spooler -
	Cmnd_Alias ASTRO = /usr/local/bin/astropci_usr,/bin/mount /mnt/cdrom,/bin/umount /mnt/cdrom,/bin/mount /backup,/bin/umount /backup,/sbin/reboot,/sbin/halt		Cmnd_Alias ASTRO = /usr/local/bin/astropci_usr,/bin/mount /mnt/cdrom,/bin/umount /mnt/cdrom,/bin/mount /backup,/bin/umount /backup,/sbin/reboot,/sbin/halt

Monnierast at 22:40, 15 May 2011

2011-05-15T22:40:19Z

@@ Line 58: / Line 58: @@
 '''
-EP: I thought you did not like sudo and wanted a root account. Debian does not use sudo by default but rather su. If we use sudo we should disable the root login. This does not mean that root is disabled but rather that you cannot login with a root password. To access the root account you type "sudo su -" and type your password.The advantage is that an attacher cannot try to guess the root password (because passwd login is disabled) but rather find out who has sudo privileges and guess the password.
+EP: I thought you did not like sudo and wanted a root account. Debian does not use sudo by default but rather su.  There is a remote possibility that changing debian from su to sudo authentication may break something, probably the package manager gui (which we do not use anyway). If we use sudo we should disable the root login. This does not mean that root is disabled but rather that you cannot login with a root password. To access the root account you type "sudo su -" and type your password.The advantage is that an attacher cannot try to guess the root password (because passwd login is disabled) but rather find out who has sudo privileges and guess the password.
 '''
 ----

Monnierast at 22:16, 15 May 2011

2011-05-15T22:16:47Z

← Older revision		Revision as of 22:16, 15 May 2011
Line 55:		Line 55:

	''' JDM:two problems with this: 1) login as root!? this does not sound like an improvement for security when observers are using mirc. 2) we often want to run our OWN experimental version not the installed version . how do we do this without logging in as root? it sounds like Xiao has figured out how to do with sudo, so maybe that is our best option.		''' JDM:two problems with this: 1) login as root!? this does not sound like an improvement for security when observers are using mirc. 2) we often want to run our OWN experimental version not the installed version . how do we do this without logging in as root? it sounds like Xiao has figured out how to do with sudo, so maybe that is our best option.
			'''

			'''
			EP: I thought you did not like sudo and wanted a root account. Debian does not use sudo by default but rather su. If we use sudo we should disable the root login. This does not mean that root is disabled but rather that you cannot login with a root password. To access the root account you type "sudo su -" and type your password.The advantage is that an attacher cannot try to guess the root password (because passwd login is disabled) but rather find out who has sudo privileges and guess the password.
	'''		'''
	----		----

69.244.182.148 at 20:22, 15 May 2011

2011-05-15T20:22:02Z

← Older revision		Revision as of 20:22, 15 May 2011
Line 44:		Line 44:
	}}		}}

			'''JDM: presumably the next step is to find where the memory for these variables is allocated and to make sure there was enough space allocated!'''

	----		----

69.244.182.148 at 12:29, 15 May 2011

2011-05-15T12:29:39Z

← Older revision		Revision as of 12:29, 15 May 2011
Line 52:		Line 52:

	To execute you could do this: open a terminal, login as root and execute RTscheduler (if it is installed in /usr/local/bin or ./RTScheduler (60000 may be redundant).		To execute you could do this: open a terminal, login as root and execute RTscheduler (if it is installed in /usr/local/bin or ./RTScheduler (60000 may be redundant).

			''' JDM:two problems with this: 1) login as root!? this does not sound like an improvement for security when observers are using mirc. 2) we often want to run our OWN experimental version not the installed version . how do we do this without logging in as root? it sounds like Xiao has figured out how to do with sudo, so maybe that is our best option.
			'''
			----

	For the spooler login as spooler and type spooler (or ,/spooler from your directory)		For the spooler login as spooler and type spooler (or ,/spooler from your directory)

Monnierast at 01:23, 15 May 2011

2011-05-15T01:23:13Z

← Older revision		Revision as of 01:23, 15 May 2011
Line 69:		Line 69:
	The CHARA libs are more finicky. I just checked out the essential libs. Theo told me to checkout and compile everything, but that is HUGE and half of it does not compile. I just checked out and compiled the minimum necessary.		The CHARA libs are more finicky. I just checked out the essential libs. Theo told me to checkout and compile everything, but that is HUGE and half of it does not compile. I just checked out and compiled the minimum necessary.

	The other possibility would be to mount the CHARA libs from michelson on /usr/local or somewhere else. This could be done using sshfs instead of NFS.		The other possibility would be to mount the CHARA libs from michelson on /usr/local or somewhere else. This could be done using sshfs instead of NFS.The advantage would be that when Theo changes something in the libs it will be immediately available to us. The disadvantage is that when Theo changes something it will probably break our system.

Monnierast at 01:18, 15 May 2011

2011-05-15T01:18:40Z

← Older revision		Revision as of 01:18, 15 May 2011
Line 50:		Line 50:

	EP: I just reminded myself... The CHARA lib and header are in /usr/local, MIRC binaries are installed in /usr/local/bin when you type make install. You just checkout control/MIRC, cd control/MIRC and make. I just tried and it works		EP: I just reminded myself... The CHARA lib and header are in /usr/local, MIRC binaries are installed in /usr/local/bin when you type make install. You just checkout control/MIRC, cd control/MIRC and make. I just tried and it works

			To execute you could do this: open a terminal, login as root and execute RTscheduler (if it is installed in /usr/local/bin or ./RTScheduler (60000 may be redundant).

			For the spooler login as spooler and type spooler (or ,/spooler from your directory)

	----		----