what is/does nscd?

daemon to speed up name service requests (user, hosts, ...) (query SuSE Support Database for "nscd", I didn't find any other information)

and why the hell it is enabeld by default?

I think all these demons (nscd, httpd,.....) should NOT be enabeld/started by default by /etc/rc.config (SuSE). Especially for a Linux-new-users it is

absolutely right ----------------------------------------------------------------------- Peter Griessl, System Administrator email: griessl@ihs.ac.at Institute for Advanced Studies Tel: +43-1- 599 91 222 Stumpergasse 56, A-1060 Vienna, Austria Fax: +43-1- 597 06 35 -----------------------------------------------------------------------

It should be very useful, if further yast-versions asks the user whether

And TELL(!) him what it will do!!!

his host acts as standalone client or server.

Hi all!

...

It should be very useful, if further yast-versions asks the user whether his host acts as standalone client or server.

And then give the user a choice of what demons it wants run, and then warn

Maybe - if you´re the sysadmin of a server, you must check and modify the system in any cases. A "normal user" instead normally does not have a internet connection 24h a day and also no static ip-adress. So it´s not very important, if the security-level of the system is not very high. Liebe Gruesse, Stephan Lauffer [ Paedagogische Hochschule Freiburg - Systemtechnik - Germany ] [ ZIK Zentrum fuer Informations- und Kommunikationstechnologie ] [ Tel.: 0761 - 682 459 Mobil: 0172 - 7145 197 ]

Hi all! I don´t want to increase the traffic on this list about this diskussion, but...

...

A "normal user" instead normally does not have a internet connection 24h a day and also no static ip-adress. So it´s not very important, if the security-level of the system is not very high. Sounds like Security Through Obscurity. That, "...is the microsoft approach... and should never be allowed" [-- Linus Torvald] I´m hard working for secure systems. But everyone knows, that this is not done by a distribution itself. I´m also thinking, that telnet is such useful as win95 ,) and it would be nicer if suse will disable telnet as default. But when do you mean your system/ distribution is secure enough. The apache daemon designed as helpsystem is a good idea - why not?

By the way; pop3, imap, ftp, telnet, samba without encrypt passwords, nis are not secure. So, if you´re planing to sell a secure distribution, you must not distribute netscape, because all users can configure a pop3 account. ;) pop3 without ssl, oder imap without ssl is a high risc. Maybe now you understand my comment right: "So it´s not very important, if the security-level of the system is not very high". Secure systems are in any cases important - but I think, you can´t define it deffinetifly when a distribution is good enough. Ok, I´m quite. :) Liebe Gruesse, Stephan Lauffer [ Paedagogische Hochschule Freiburg - Systemtechnik - Germany ] [ ZIK Zentrum fuer Informations- und Kommunikationstechnologie ] [ Tel.: 0761 - 682 459 Mobil: 0172 - 7145 197 ]

I have personally witnessed break-ins on MSWinXX machines using dynamic IPs over dial-up lines. Port scanners are often used by malicious ( and otherwise ) hackers to find vulnerabilities in systems on an ISP ( it is much easier to find a target by scanning ISP users for vulnarabilities than it is to find one using a random IP off the net. ISPs generally own one C class subnet or so, and rent out the last four digits to users dynamically. Ignoring security issues and trusting the upstream to do it for you does _not_ make them go away. It just makes users lazy in their regard to security, which puts corporate and home networks at risk. Robert_Helmer http://robert.namodn.com Stephan Lauffer wrote:

Hi all!

...

...

It should be very useful, if further yast-versions asks the user whether his host acts as standalone client or server.

And then give the user a choice of what demons it wants run, and then warn

Maybe - if you´re the sysadmin of a server, you must check and modify the system in any cases. A "normal user" instead normally does not have a internet connection 24h a day and also no static ip-adress. So it´s not very important, if the security-level of the system is not very high.

Liebe Gruesse, Stephan Lauffer

[ Paedagogische Hochschule Freiburg - Systemtechnik - Germany ] [ ZIK Zentrum fuer Informations- und Kommunikationstechnologie ] [ Tel.: 0761 - 682 459 Mobil: 0172 - 7145 197 ]

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Anyway, you should always disable EVERY daemon until you know exactly what it does and how to configure.

Now, there are two ways to go: a) If you don't install a daemon that you don't know it won't be enabled by default/yast. It's much better to read the man page first -and install a daemon if it is needed. b) If you choose a standard installation with various daemons check your /etc/inetd.conf, disable all unknown daemons (that are enabled by yast) and edit your configuration file (in that you can disable those daemons).

No problem to do this for somebody who knows Linux well. But even userers who are using Linux now for more than 2 years do not know a lot about the interns and the relatet security-risks. 99% of them do not know "Know Your Enemy" and 99% of them use some "Standard-Installation". And they aren´t that able to edit conf and rc scripts. (BTW: for nscd there seems to be no manpage/documentation. And I do not remember beeing asked at installation if I want to install nscd or not.) Hartmut

...

And they aren´t that able to edit conf and rc scripts.

They don't need to. It's an option in yast: edit configuration file.

That is (nearly) the same for those kind of useres. The "Konfigurtionsdatei verändern" in Yast is still very long an cryptic even for slightly advanced users.

is enabled - that's a problem if you are connected to the internet permanently. In that case your sysadmin should configure the box. For home users I think it would be secure enough to disable inetd.

I´m talking about all those boxes that are indeed 24h connected to the net, standalone desktops at Universities etc., or as Derek just told homecomputers of " "power user" != "knowledgeable system administrator" " with 24h/statics (I think we will have those here in germany too sometime in the future). (Btw: at home a lot of people also need inetd running because they have a small home-network running) And these useres are almost their own sysadmins! I thing it is good that people emigrate from that frustrating, time-wasting m*-tr**h but this doesn´t mean Linuxinstallation/-administration needs less time or is much easier (but you are much more successfull :-) ). What has to be done by a Linuxdistribution (imho) is to give the (new-)user an (self-)explaning and transparent system and the information and the right consciousness (about network-secuity... and so on) to run such a system - even when it is online on the net! This is the difference with Linux! You are ALLOWED TO and you CAN DO EVERYTHING (nearly) with your system! Everything means everything - in Good as in Bad, knowingly or ignorant!

...

(BTW: for nscd there seems to be no manpage/documentation. And I do not remember beeing asked at installation if I want to install nscd or not.)

ARGH! What are you doing, SuSE?

Yes, SuSE-6.2. Thats the reason why I am posting here at [suse-security] ;-) -------Markus Gaugusch wrote: ------ nscd is included in shlibs.rpm and related files are (I think): [output of rpm -ql shlibs |grep nsc] /etc/nscd.conf /usr/sbin/nscd /usr/sbin/nscd_nischeck ------------------------------ Yea, that is all I found! :-(( So, hey ho, lets go... Hartmut

On Wed, 22 Sep 1999, Martin P. Peikert wrote:

One paper to start securing linux ishttp://www.interact.com/~lspitz/linux.html and, if you are more interested in security, the 'Know Your Enemy'-series that you can find in .../~lspitz/pubs.html. Subscribe to bugtraq. Read Howtos and man pages....

interact.com is not showing up on our nameservers. Are you getting the same where you are today? dproc

* Hartmut Gerlicher (h.gerlicher@tu-bs.de) [19990922 13:25] spoke: [...] | what is/does nscd? | | and why the hell it is enabeld by default? | | (I hate programs beeing enabeld by default [...] I enjoyed reading this thread. Yes, most of you *hate* sloppy default-setups, and those security holes a SuSE-System has, if used by an unexperienced user. But, i think it's not fair to blame SuSE for that ( well, especially if they documented their policy anywhere... e.g. drop a note about things like nscd..) they do a damn good job in helping unexperienced users to get a working system set up, a system that *can* be made secure afterwards, without having to build from scratch. A newbie *can* use it out of the box, can play and test a lot, without having to bother to get the stuff simply to run. Imagine, how disappointing it is for a newbie, if he *cant* test all that funny services on his localhost, if he had to wander through all collected wisdom of wizardhood, just for getting to know how a UNIX behaves. Of course, this system *can not* be perfectly secure, by far not secure enough for a cable connection w/ statIP. You have to know what you're doing then, and YaST *can* be a valuable help then ( can be a threat also.. ;-) ). I'd suggest to the SuSE-People to prepare some kind of 'profile', with an outline of a setup for various tasks, and ask the user, if he wants a machine for standalone, family or www-server use. These set of permissions from "easy" to "paranoid" is already a good idea; why not try something in this fashion for the services ? Maybe increase the verbosity-level of package selection ( "hey U idiot, don't tell me U want *that* package on a server ? No, i won't install that." ) ;-) Bye ! -- Gruss / with best regards Jens-Eike Jesau /*************************************************************************** * `v'- Home: hp9001.fh-bielefeld.de/~jens * || |`. Linux on a single Disk: www.toms.net/rb * " The number of UNIX installations has grown to 10, with more expected " ( The UNIX Programmers Manual, 2nd Edition, June 1972.) */

On Sun, Sep 26, 1999 at 10:34 +0200, Juergen Braukmann wrote:

Jens-Eike Jesau wrote:

...

* Hartmut Gerlicher (h.gerlicher@tu-bs.de) [19990922 13:25] spoke:

| and why the hell it is enabeld by default? | (I hate programs beeing enabeld by default

I enjoyed reading this thread. Yes, most of you *hate* sloppy default-setups, and those security holes a SuSE-System has, if used by an unexperienced user.

...

But, i think it's not fair to blame SuSE for that ( well, especially if they documented their policy anywhere... e.g. drop a note about things like nscd..) they do a damn good job in helping unexperienced users to get a working system set up, a system that *can* be made secure afterwards, without having to build from scratch.

I think the catchword we're looking for is "AWARENESS" which has to be "injected" into an administrator's mind at installation time. It has to be obeyed (and freshened?) when further configuring the system. And to be of real use and effectiveness, knowledge should be its companion. But that's an ideal hard to reach ...

...

A newbie *can* use it out of the box, can play and test a lot, without having to bother to get the stuff simply to run.

That's ONE approach: Offer any service (read: "potential hole") and block away what is not needed. When you're lazy or unsure, you won't take any action, since "everything works". This one seems most similar to what a newbee would like (and what's common in other operating systems' areas). The other approach is to install an almost nonfunctional (in terms of application software) system which just offers the ability to configure itself. Then one could build up the services nessecary for one's own purposes. The result will be slim and fits perfectly to what it is meant to do. This one requires skill and most of all knowledge (I guess "orientation" is what newbies lack most, following a learning route once you know what you WANT should be easy to do). On the other hand -- everyone who has built up a system this way KNOWS what he has done. And since one saw it "grow" there's more understanding for the relations of the components inside, which I feel is a great point for free UNIXes (and what attracted me most and kept me with these for several years now). A compromise would be to install a minimal system AND some additional services, which is done by almost every distribution available these days. But I wouldn't know WHERE to place the warning "never run an unconfigured system" and "always know what you're doing and do it consiously(sp?)". I just think of the fact that YaST creates a normal user and despite people run around as root. I guess that is the habit of "I paid the hardware, so I want to be the master. How can a computer dare to stop me from doing something?" I didn't quite settle down in computer users' minds that restriction could be some sort of self defence. It seems hard to teach people in a polite way that "easily setup" means "almost unconfigured if at all useful". Nothing comes for free. Where should all the advantages come from Linux is said to have if not from the APPROPRIATE use of the mechanisms?

I am not a newbie anymore, but I am utterly confused by all these services, deamons and particulary what they are good for. Since I do not exactly know what to look for or ask, the amount of stuff to read (=time to spend) is enourmous.

But I never had to regret the effort I spent to learn the UNIX mechanisms. I always got something in return: flexibility, stability, knowledge (applicable in other fields, too), fun (don't underestimate the feeling of "having something mastered AND doing it the right way(TM)").

...

I'd suggest to the SuSE-People to prepare some kind of 'profile', with an outline of a setup for various tasks, and ask the user, if he wants a machine for standalone, family or www-server use. These set of permissions from "easy" to "paranoid" is already a good idea; why not try something in this fashion for the services ?

Wasn't there mention of a SuSE hardening project (or script at least)? AFAIR this one asked some questions to create a profile of the intended use and took some action to customize some of the system's configuration. Didn't this make it into the newer releases?

...

( "hey U idiot, don't tell me U want *that* package on a server ? No, i won't install that." ) ;-)

I could accept the installer buzzing on me when I tried stupid things. But I would never want a software telling me "I know better than YOU do" -- that's exactly what drove me away from Windows ... Keep in mind "UNIX was not designed to stop its users from doing stupid things, as that would also stop them from doing clever things." :>

Well, it does not need to be SuSE by the way. Imagine a "tool" that "edits" or "recreates" the relevant files in a style the kernel config works. If I press help in there, I get a nice description about an uncomprehensive option in a mostly umcomprehencive help text ending with "If you don't know what we talk about you probaply won't need this." or "It's save for most users to say NO here". I Like that ;-)

Once you reach a stage of interest for "is it configured properly" you're free to release the hounds, i.e. run Cops and Nessus and Satan and nmap against the machine. 'ps aux ww' and 'netstat -an' is something one anyway issues after installation. But then again, one should be able to judge the output -- I see the problem ("Ein Teufelskreis ..." :). But I always prefer things pushing me to learn how to handle a new tool in an appropriate way -- this way I get much more from using it. If I just want to keep stuck with old behaviour I might miss the actual advantage of the tool: I won't get any effect or not what I expected, maybe I even break some things. If I squeeze a new tool to behave like the old one, I could have stuck with the old one (which saves me from the effort of changing my tools at all).

One of my personal fears is something like the "windows effect". You install a new small tool that works perfect and two weeks later when you use your scanner the next time, it won't work. I fear similar things happen with disabled services. I know this is a lame comparision, but that's what I fear.

That's the case when disbling something that was there before (and you didn't know what it was good for). That's NOT happening when you configure a system to fit your needs in the beginning and ADD features as you need them. The hard way I sketched above is just a special form of it: Deliver a skeleton and fill it with every function YOU need assuming NOTHING at the delivering party. I'm ALWAYS uncomfortable with default setups, since they NEVER meet MY requirements. I feel there's no real problem with technical aspects, it's the mind barrier: "I did it this way under Windows, I want to do is THIS way under Linux. And it doesn't work. Linux is crap!" It seems VERY hard to understand that UNIX is somewhat different. But once that's understood (and accepted, which makes people act differently) the result is great: anything is possible. "addicted to a scheme" seems to be a problem here. How hard is it to tell somebody that every feature has a downside (the ones even believing in the nice colored advertisements don't know better)? Should there be some bugtraq reading for the amusement of the admin (at the desktop: joe average user?) while YaST copies packages in background? BTW the repetition of always the same mistakes is somewhat scary -- will people never learn? "Those who don't know the past are doomed to reimplement it". And the accumulation of always the same program names (and companies) seems symptomatic. Another point comes to mind and is hard to teach, too: Security cannot be "delivered". It's not an automatic thing you can install. It's a point of view, it's a progress, it's the action one takes (again and again, learning and evolving on the way). A distribution can just create a sense or sharpen it, it's always the admin implementing it. And Linux users should get into their head that they ARE admins. If that's too much work for me, I should take the consequence and quit that job. I would never make a difference between private and professional security, but in maximum between isolated installation and connected computers. I don't see a point in saying "I won't be attacked since I'm just a newby sitting at my home computer". People really should realize what they do when putting the plug into the wall socket. virtually yours - Gerhard Sittig -- If you don't understand or are scared by any of the above ask your parents or an adult to help you.

On Wed, 22 Sep 1999, Mark Lutz wrote:

Date: Wed, 22 Sep 1999 11:59:08 +0200 (CEST) From: Mark Lutz To: Bryan Porter Cc: suse-security@suse.com Subject: Re: [suse-security] YaST problems

I noticed some problems with nscd and "The Internet Junkbuster" (ijb). Sometimes multiple sessions of ijb were started. After I had disabled nscd the problems were gone. Anyone experiencing the same behavior?

yes i did. ijb isn't working properly with started nscd ... why ? thx nolo -- --- Manuel Paul [dAx] ================= email: nolo@altavista.net www: www.homepages.de/home/iwarf ICQ: 15775184 (preferred) PGP: Key is available at any server ----------------- There're many things that will be left unexplained. It's your thirst of knowledge that will find the answers. As the structural figure of our mind resembles our own, it might be predictable to forecast the future. Then again, maybe not. - Man from tomorrow - -----------------