Re: Protections on inetd (and /sbin/* /usr/sbin/* in general)

2001-01-16 Thread Walter W. Hop

The exploit managed to start inetd, camped on the specified port

I guess, if it doesn't exist already, that it wouldn't be so hard to
create a small patch to the kernel, so that only processes owned by root,
or a certain group of users (let's say "daemon"), were allowed to set up
listeners...

walter

--
 Walter W. Hop [EMAIL PROTECTED] | +31 6 24290808 | NEW KEY: 0x84813998




To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message



Boot process robustness

2000-12-28 Thread Walter W. Hop

Hi all,

I was wondering how to increase the robustness of the booting process,
so that a box would be able to keep itself on its feet without
intervention of the console. I think this would be of great value to the
many people who administer colocated boxes.

I'm not much of a coder so all I can do is mailing this (at the risk of
wasting your time with total useless crap ofcourse, in which case I
apologize.)

1. Old kernel recovery
   When 'make install'ing a new kernel, a flag is raised (say,
   'revert_on_fail') which is only cleared after a successful system
   initialisation. When the new kernel boots, a panic in this state or
   an unexpected reboot (reset after a system hang) would cause
   /kernel.old to be loaded on the next boot instead (maybe the same
   could work for /etc/rc.conf.old)

2. Automatic file system checks
   In case of a powercycle or crash, it could be that a filesystem needs
   fixing. Now I don't know much about fs internals, but I guess that in
   most cases just answering 'Y' to fsck's questions will fix things. I
   would appreciate an option where an inconsistency would start up fsck
   in an "automatic" repair mode, with all actions logged and "undo"
   data being saved (in case manual review is needed).

There!
(Merry etc etc, by the way!)

walter

-- 
 Walter W. Hop [EMAIL PROTECTED] | +31 6 24290808 | PGP key: 0xD4DD8DEB




To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message