Oracle: Unbreak my Linux Heart

Using sudoers in Linux to implement security is commonly done. Often administrators or operators allow themselves to 'sudo su -' to become root, without the need to know the root password. This is more comfortable as you don't need to type "sudo" in front of every command and your sudoers file becomes less exhaustive without the need to specify every command operators and sysadmins need. However, enforcing everyone - even sysadmins - to prepend every command with "sudo" creates an audit trail when sudo logs to a file. This often required for compliancy reasons. Now there is a command to playback sudo logs: Sudoreplay Manual .

Dell TechCenter has released a LiveDVD image with OMSA to update firmware and BIOS on Dell hardware using a CentOS Linux distro.

For some reason I had a few copies of the same GPG key in my RPM key store and removing them was tricky. Normally, you list your key using rpm -qa gpg-* and can remove them using rpm -e gpg-pubkey-12345678 . Just like anything installed with rpm, for that matter. But what if you have multiple keys? You'll get multiple matches... Easy! Just use rpm -e --allmatches gpg-pubkey-12345678 . :) Source: Red Hat archives

A recent article on Linux security showed that an old backdoor (cve-2007-4573) , patched in kernel 2.6.22.7, has resurfaced . Using the leak, any user that has a local user account on a 64 bit server, can easily get root rights, using the compatibility layer. While I don't fully understand the workings, I do understand that all OEL4/OEL5 64 bit servers are potentially harmed as they have kernels 2.6.9 and 2.6.18, resp. So I logged a SR on Metalink to see if I have a big security issue in the data center. Update: CVE-2007-4573 has been renamed CVE-2010-3301 and RHEL states : This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 5, and Red Hat Enterprise MRG, as they do not contain the upstream commit d4d67150 that introduced this flaw. Update2: the issue is also listed as CVE-2010-3081 , which is slightly different and Red Hat does track this one, as it affects RHEL5 . Update3: Ksplice has a test available to verify your syste...

I've had a long feud at work with business units who work with outside contractors who insist on writing web apps using the very latest version of PHP, Apache and MySQL. While I welcome the use of open source, state-of-the-art technology, the one thing these contractors often overlook is the need for stability and continuity in enterprise-grade applications. Even web applications. It's useless to use the latest greatest feature set in PHP or MySQL, if the organizations you're targeting are all running RHEL 4u8, 5u2 or even RHEL3! And many do. The Enterprise Distributions for Linux lag behind public version for up to 18 months! And they won't easily upgrade just because you ask or because your application was built using the most recent version of an open source package. The company may be able to give you a special server in some DMZ but you may lack access to certain key servers, because the security status of your app and server have not (yet) been approved. Inste...

How does ordinary virtualization relate to virtualization used in a cloud computing environment? That was the topic of a talk at the Cloud Computing Expo in Santa Clara last week. Is there a difference? Or is it merely a logical or organizational distinction but the techniques used are still the same? Adam Hawley talked about this , slides linked to in the article, and how Oracle's products do or will fit into this paradigm. Database services in the cloud, Application Server services in the cloud, middleware provisioning in the cloud for yourself and your customers, isolation, privacy, security, replication, disaster management. Everything is still the same yet different.

On Wim Coekaerts Blog I read that Zend and Oracle are working closer together. This makes PHP/Zend Server more integrated with Oracle Enterprise Linux (OEL). Zend Server is a complete, Oracle-enabled, enterprise-ready Web application Server for running and managing PHP applications that require a high level of reliability, performance and security. Connectivity to Oracle databases is delivered out of the box. We have a long history of working with Zend and the PHP community to ensure that the latest and greatest Oracle features are available in the PHP database connectivity libraries. Oracle now hosts an rpm package on their ULN servers called zend-server-repo , which updates yum to also look at the software repositories hosted by Zend. (Note: you may need to use a proxy server to get to it, if you have ULN locally mirrored, or mirror the Zend repo as well!) When a user wants to install Zend Server, just a simple command will install the zend-server product directly. FYI, the zend rp...

Oracle is pleased to announce the general availability of Enterprise Linux Release 5 Update 4 for x86 (32 bit) and x86_64 (64 Bit) architectures. This update includes the following kernel/driver changes: Bug Fixes added by Oracle * Check to see if hypervisor supports memory reservation change [orabug 7556514] * Add entropy support to igb [orabug 7607479] * Convert ENETUNREACH to ENOTCONN [orabug 7689332] * Add xen pv/bonding netconsole support [orabug 6993043] * Shrink zone patch [orabug 6086839] * Fix aacraid not to reset during kexec [orabug 8516042] * Fix failure of file creation from hpux client [orabug 7579314] Fixes/Additions from the upstream distribution provider * A new tunable parameter /proc/sys/vm/max_writeback_pages has been added to the kernel, allowing system administrators to change the maximum number of modified pages kupdate writes to disk per iteration each time it runs. It defaults to 1024 or 4MB ...

Red Hat Enterprise Linux 5.4 Bèta is now available. Most interesting improvements, apart from the usual bug fixes, performance benefits and better hardware support, are the introduction of KVM virtualization (in addition to regular Xen-based virtualization). New hardware support in virtual environments through SRIOV ( Single Root I/O for Virtualization ), utilities for management of FCoE cards over Internet, FIPS-140 security certification and a libvirt Perl interface for virtualization. Read the release notes for full details. Better yet is this announcement: " An important feature of any Red Hat Enterprise Linux update is that kernel and user APIs are unchanged, so that Red Hat Enterprise Linux 5 applications do not need to be rebuilt or re-certified. This situation extends to virtualized environments: with a fully integrated hypervisor, the application binary interface (ABI) consistency offered by Red Hat Enterprise Linux means that applications certified to run on Red Hat ...

Been testing my new Oracle Linux stack based on RHEL 5.3. We have a lot of problems with sysops and admins editing files to fix problems. Only recently we started using subversion for release management so we can check for specific versions and verify the (unmodifed) integrity on files. Subversion will also let those sysops and admins commit their changes back into subversion, so changes get documented, verified, discussed and distributed through bug fix releases. However, OEL/RHEL 5 comes bundled with AIDE - Advanced Intrusion Detection Environment and I've started running tests on my test servers. When you initialize the AIDE database as part of the final post installation steps, you run aide -i . This creates base reference database - aka snapshot - of all files that you use later on for any modifications. Using aide -u you update that db. Small problem is that you may a lot of lgetfilecon_raw failed errors. In my case, this had to do SELinux being disabled and aide checking ...

Xming has been updated recently. It is an X server for Windows, so you can easily use your (corporate) Windows desktop to maintain your Linux/Unix servers. It is free and uses Putty to make an SSH connection to your *nix server. With a few simple commands the X11 client on Linux can transmit its output (i.e. screen/window) to the X11 server running on Windows. By using a secure SSH session, the process is pretty secure too and can be used from home, with or without a VPN connection.

Just received notice that Red Hat Enterprise Linux 5.3 Beta has been out since October 28th... Sjeez! Why didn't I know that sooner...? Anyway the bèta will last until January 9th, 2009, so when I get from holidays, I'll have my work cut of out for me. RHEL 5U3 brings many, many virtualization (Xen) improvements. A new kernel (kernel-2.6.18-120.el5), rebased versions of monitoring tools (lm-sensors, net-snmp, openIPMI, openldap), new versions of yum and rpm, updated Kerberos subsystem, newer SAMBA (3.0.32) with support for Vista and Windows Server 2008, a ton kernel fixes and features, new hardware drivers (bcm43xx, bnx2/bnx2x, cpufreq, e1000/e1000e, mptscsi, qla24xx, etc.) and some interesting Technology Previews! dm-multipath install, which should allow anaconda to install Linux on systems with 2 or more HBAs. Support for ext4 file systems. CIFS (aka SAMBA) enhancements in the form of kernel DFS support and Kerberos security. Check the complete Release Notes for a full upda...

Just want to blog this article about using Restricted Accounts And Vi(m) Tricks in Linux And Unix to increase security and limit the tricks people can do by breaking out shells and editors. For instance, if people or processes need to be able to write in a specific location on your system, and you want to lock them down as far as you can, you could use a chroot jail together with a restricted shell to limit their options completely.

A never ending problem when you run Linux in the enterprise, is security (and stability) of the systems and access control to allow users, contractors, developers to install software and create or tweak configurations so that some application or service runs. Ideally, only you the sysop can install or configure software and everyone else has to turn to Using sudo , you can define tons of ways for users or groups to be able to run (or not) some commands on some or all systems. You can setup that they may run commands as other users without needing their password. Or you can turn off passwords all together. However, as soon as you start building a list of commands that a certain user or user group can or cannot run, you create the possibility for knowledgeable hackers users to work their way around your system by creating loopholes, symbolic links or abuse buffer overflows. Perhaps, we should all use sudo to allow or deny general access to machines or users and use consolehelper to cre...

There was a message from Michael Brown on the Dell PowerEdge mailing list, that I thought is important enough to repeat here as many people may not know about that list. Dell has an active OpenManage infra setup for Linux to help monitor and manage their hardware. As we have their 2950s, I'm monitoring that list. "After several months of work, I am ready to announce a bèta period for the Dell Community Linux repository at http://linux.dell.com/repo/community . When complete, this repository will be the replacement for the current software repository. Please read the details on the repository homepage. I will be running a two week beta period to ensure that the repository is functioning properly. After two weeks, I will redirect software repo bootstrap so that new installs will use the community repo. And two weeks after that, I will redirect all current software repo users to the community repository. Early this year I asked the community if people would be willing to submit...

US-CERT is aware of active attacks against Linux-based computing infrastructures using compromised SSH keys. The attack appears to initially use stolen SSH keys to gain access to a system, and then uses local kernel exploits to gain root access. Once root access has been obtained, a rootkit known as " phalanx2 " is installed. Read more at US-CERT.

Often, when getting started using sudo and /etc/sudoers on a Linux system to authorize users to do something somewhere, you would like to debug sudoers and see why things fail when you think it should work. First, try sudo -l on any system as any user and get a list of things (if any) that you are allowed to do. Check and see if anything is missing. The sudo mailing list also hinted to a way to parse the sudoers file to see if anything is malformed. This can verify at the sudoers does not contain any typos or syntax errors. Finally, and most importantly, know this : "When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match)." So order matters!!! Start with general rules and become most specific towards the end of the sudoers file. If you grant something at the top and deny it at the bottom, sudo won't allow it for the reason above. In that case, change th...

While backups are usually often considered when designing high-availability server parks, doing an actual restore is often overlooked. You simply don't want to pull a plug and rather wait for the actual disaster to happen. Having a full file system image of a server, while space and time consuming can be the fastest way to get a server back online after a failure. If you have a SAN available, it can clone LUNs for your transparently and you can swap them back in when a machine fails or burn down. However, not everyone has one. Using clonezilla , you can easily pull images off of Linux or even Windows servers and restore them (even using multicast!) in minutes. As it only copies used blocks, that 300 GB local disk can result in a 5 GB image. For a restore, Clonezilla restores the appropriate image based on MAC address.

While reading an article to get you started on using a configuration deployment system that keeps all your servers configured in the same way, I read about the integrit file verification system . It's a simple tool that fingerprints your file system when you yourself have finished with it and let's you know when and where changes where made. Either by a user with too many rights, or by a hacker, or by a runaway process in a badly coded script or any combination of the above. Bottom-line, you can use integrit to help detect intrusions, hackers or your own admins doing something they probably shouldn't (at least not without your knowledge!)

Someone alerted me to a possible security risk because of cURL. So I checked the cURL - Vulernability Table and found they are in some part right. cURL, libcurl, has a set of known vulnerabilities that are fixed but our Oracle Linux release does not (yet) use the most stable version released. Instead, it uses the version Oracle has included based on Red Hat's sources. So we may need to do an update across our servers. Especially those connected to the Internet...