Root security implemented - SSH, Apache/PHP CP -need help

[Billped]

... but could possibly make use of a much older smaller drive you have laying around.  Selecting this would use the configure the drive as a swap device.

 

Joe L.

 

One interesting part about the application as you describe it is that the smaller older drive needn't be reliable thus it wouldn't need to be part of the array.  Most unraid users aren't users due to uptime concerns, but data "backup" (yeah, I know) needs.  If I take an old 80GB drive sitting around and it crashes, so what?  Assuming some sort of graceful loss could be proposed, either the system could keep running without swap (preferred) or I would have to take the system down and replace it.  Either way, that isn't a huge deal for me.

 

 

Bill

[limetech]

Good point although I'm not sure if you can get to the "md" devices before the array is started or after it is stopped. 

You could just use 'swapon' command after system is booted.

 

You probably would be safe using a swap space on a disk you do not assign to the array.  Just leave a disk "unassignd" and then using the linux swap commands, assign it as the swap device.

 

Hey Tom, how about another choice in the drive assignment drop-down list.  Choices could be...

"parity"

"unassigned"

"disk1" thru "disk15"

"swap"      <------------- this is NEW and would not be used by most people, but could possibly make use of a much older smaller drive you have laying around.  Selecting this would configure the drive as a swap device.

 

Joe L.

 

Very interesting idea...

[bubbaQ]

OK... I got swap working from a spare HD not in the array.  On mu Athlon 64 300 Asus K8n-e deluxe with GigE and 512MB, my write performance increased about 20% and browsing shares seems snappier.

 

I'd like to get rid of the RAMdisk next.  along with the swap partition, I created a 2GB EXT2 partition on the spare drive, and would like to use that instead of the RAMdrive.  If I modify the init sequence to mount that partition instead of the RAMdrive, will unRAID work, or is it tied to specific device names?

[Joe L.]

OK... I got swap working from a spare HD not in the array.  On mu Athlon 64 300 Asus K8n-e deluxe with GigE and 512MB, my write performance increased about 20% and browsing shares seems snappier.

Very interesting. Impressive improvement in performance. 20% is Very Nice

I'd like to get rid of the RAMdisk next.  along with the swap partition, I created a 2GB EXT2 partition on the spare drive, and would like to use that instead of the RAMdrive.  If I modify the init sequence to mount that partition instead of the RAMdrive, will unRAID work, or is it tied to specific device names?

It should work just fine.  Basically, you will be installing Linux on the new partition. Let us know how it works out.

 

Joe L.

[bubbaQ]

I had been working with unRaid ver 3 to add swap to non-array disk, Apache, and some other packages, and decided to start working with the latest version (4.1) to get the newer kernel, but when I dd the bzroot image after un-gziping it, it is not a recognizable file system.  Any suggestions?

[Glimmerman911]

Very interesting, tagging along this thread.

[bubbaQ]

(slapping self) I'm an idiot.  Instead of modifying the ramdisk image (bzroot), all you need to do is use pivot_root and chroot to point to a new root.  Why didn't I think of it before?  This can be done after booting using the config/go script on the flash.... like this:

 

mount /dev/hda1 /new-root

cd /new-root

pivot_root . old-root

exec chroot . sh <dev/console >dev/console 2>&1

umount /old-root

 

So you can do a full Slackware install on /dev/hda1, a swap on /dev/hda2, and install packages to your heart's content.... and they will be on the HD instead of the flash, and last through reboots.  You may want to not unmount the /old-root in order to get to some scripts and such that were customized.... I also think you have to make sure you have all the same mount points on the new root as the old one.  I'll have to try this method this afternoon.

[bubbaQ]

Ok.  As of kernel 2.6, initramfs was implemented instead of a ramdisk, so pivot_root won't work since bzimage is an initramfs.  Other utilities such as switch_root or run-init are used in other distros, but I can not find any reference to switch_root or run-init in Slackware 11. Slackware is not my usual distro so I may have missed it.)

 

So I'm looking for the alternative to pivot_root for an intramfs in Slackware 11.  Stay tuned....

[bubbaQ]

Answered my own question... it is an initramfs image.  To extract it you use:

 

zcat bzroot | cpio -i -d -H newc --no-absolute-filenames

[bubbaQ]

Because swap_root must be run from /init as pid=1, I can't do it.... that would have to be done in the distribution /sbin/init from unRAID.

 

But, I now have a simple working procedure for adding Slackware packages to the unRAID 4.1 bzroot file.  I'm going to refine it and clean it up with instructions and post it here.  But I have a question for the audience.  I have a non-array disk in my unRAID box, that is partitioned and formatted as EXT2, and a swap partition.  After unRAID boots, this partition is mounted along with the swap.  This is the easiest way to do it since all the unzipped working files are on the HD, and the new bzroot is built from there straight to the unRAID flash.  For those of you interested in this party, is that a configuration you can work with?

 

It might work with a second flash drive instead of a HD ... *if* unRAID boots from flash, and there is a second flash drive installed, will unRAID see it as a mountable device!  But I don't have a second flash drive to test that idea with.

 

 

[toonz]

Hey everyone,

 

So after reading this thread and knowing how much I was SSH access to my server, I got thinking and have managed to implement root security in a different way. The end result isn't as 'nice' as modifying the bzroot image, but it does allow upgrades to newer unRAID versions a little easier as you don't need to modify the bzroot image at all.

 

So far, I've got OpenSSH and FTP running on my box, all password protected. The SSH is because I use MacFusion to mount my drives using sshfs, very handy when I'm away from home.

 

I'm still having some problems with FTP and permissions. Currently my user and my 'guest' user for ftp and setup in the 'root' group, however if I chmod my files to 750 for eg, my Windows PC's can't see any files in the user shares, so this is still needing to be fixes.

 

So how did I do it, well... I added the appropriate user accounts and set their passwords on the unRAID server. I then backed up the files to the flash drive in /boot/config/etc. Every boot, I add the user accounts back using the /boot/config/go script and sync /boot/config/etc to /etc. So far it seems to be working a dream.

 

Note: I'm not a big unix guy, so please offer suggestions!

 

So, for my configuration now, I've got:

* The following files in /boot/config/etc

csh.login
group
gshadow
inetd.conf
login.defs
passwd
profile
proftpd.conf
shadow
samba/smb.conf
ssh/moduli
ssh/ssh_config
ssh/ssh_host_dsa_key
ssh/ssh_host_dsa_key.pub
ssh/ssh_host_key
ssh/ssh_host_key.pub
ssh/ssh_host_rsa_key
ssh/ssh_host_rsa_key.pub
ssh/sshd_config

 

* /boot/config/authorized_keys for ssh key logins and sshd_config pointing to this file

 

* my full /boot/config/go script is:

#!/bin/bash

#
# Install all custom packages
#
installpkg /boot/packages/openssl-0.9.7g-i486-1.tgz
installpkg /boot/packages/openssh-4.6p1-i486-1.tgz
installpkg /boot/packages/proftpd-1.3.0a-i486-1.tgz
installpkg /boot/packages/rsync-2.6.9-i486-1.tgz
installpkg /boot/packages/wget-1.10.2-i486-1.tgz


#
# Setup custom configuration
#   Creates users:
#   Restores user passwords
#

useradd -d /home/username -s /bin/bash -G root -c "User Full Name" username
mkdir /home/username

useradd -d /home/guest -s /bin/bash -G root -c "Guest User" guest
mkdir /home/guest

rsync -r /boot/config/etc/ /etc/


#
# Changes default folder permissions
#
umask 002

#
# Start the Management Utility
#
/usr/local/sbin/emhttp &

#
# Sleep for 2 seconds to ensure all disks are mounted
#
sleep 2s

#
# Create sym link for easier typing access to user shares
#
ln -s /mnt/user /data

#
# Modify root crontabs file
#
cat /boot/config/crontabs >> /var/spool/cron/crontabs/r


#
# Start sshd daemon
#
/etc/rc.d/rc.sshd start

#
# Start rsync
#
rsync --daemon --config=/boot/config/rsyncd.conf

#
# Start proftpd
#
/etc/rc.d/rc.inetd restart


#
# Set /home permissions
#
chown username:users /home/username
chmod go-r /home/username
chown guest:users /home/guest
chmod go-r /home/guest

 

[bubbaQ]

Thats a good way to get what you want.  I started this project because I want to install more complex packages that have to be compiled, such as Asterisk and Apache, and can't do that with the go script; I wanted a real HD swap, and I want to pivot/switch root to the HD.

 

I'm looking at the rc.S script now as a vector to pivot the root while still pid=1 .... if I can get that to work, it will be the holy grail.

[fgunnars]

Following this discussion with great interest. I think the extra HD for swap is nice, especially since the flash will be worn out quickly if it is extensively used for writing. This will also speak against using a secondary flash for swap. In any case, if anyone really wants the secondary flash for swap option, it can be mounted as an IDE drive using the CF to IDE connection.

 

I am particularly keen on using the server for Slimserver, which then could drop logs and the data base on the swap, maybe also playlists.

 

As a linux novice, do you guys think it the process to get there is passable for someone like me?

 

B.R.

 

/Fredrik

[bubbaQ]

Swap in Windows is a file.  Swap in Linux is a self contained disk partition.  So under Linux, you need to fdisk the extra drive to create a swap partition of say 4 GB, and that partition will be dedicated to swap... you can't store other stuff such as logs on swap.  Then create an additional partition of the rest of the disk for an ext2 file system.  So a 40GB disk would have a 4GB swap partition, and a 36GB ext2 partition.

 

Linux also makes use of a lot of temporary files, and the place to put them is /tmp.  So I format the rest of the extra disk and mount it to /tmp, and configure all utilities and other things that create temporary files or logs to stick them on /tmp

[limetech]

You can also use a file for linux swap.