Now setuid and setgid

Now setuid and setgid

Sometimes, unprivileged users must be able to accomplish tasks that require
privileges. An example is the passwd program, which allows you to change your
password. Changing a user's password requires modifying the password field in the
/etc/passwd file. However, you should not give a user access to change this file
directly- the user could change everybody else's password as well! Likewise, the mail
program requires that you be able to insert a message into the mailbox of another
user, yet you should not to give one user unrestricted access to another's mailbox.
To get around these problems, linux allows programs to be implemented with special
privileges. Processes executing these programs can assume another UID or GID

when they're running. A program that changes its UID is called a SUID program (set-
UID); a program that changes its GID is called a SGID program (set-GID). A
program can be both SUID and SGID at the same time.
When a SUID program is run, its effective UID becomes that of the owner of the file,
rather than of the user who is running it.
If setuid permission is applied on a file like :
[root@mainserver / ]# chmod 4511 myprogram.sh
then myprogram.sh has the ownership and permissions as :
-r-s--x--x 1 root admin 16336 Feb 14 2003 myprogram.sh
,then this means that whenever any user, like kamran logs on to the system and runs
this program then this program is run as not user kamran but user root !!!!. The “ s ”
in the owner's permission set indicates that this file has setuid bit on.
If setgid permission is applied on a file like :
[root@mainserver / ]# chmod 2711 myprogram.sh
then myprogram.sh has the ownership and permissions as :
-rwx--s--x 1 root admin 16336 Feb 14 2003 myprogram.sh
,then this means that any process that executes this SGID program has its effective
GID changed to the program's GID (admin in this case). Files created by the process
can have their primary group set to this GID as well, depending on the permissions of
the directory in which the files are created. The “ s ”in the group permission set
indicates that this file has setgid bit on.
The setgid bit is normally useful on directories. For example you have a directory
named newproject and it has ownership as root:students and permissions like:


[root@mainserver / ]# chmod 2770 myprogram.sh
[root@mainserver / ]# ls -l
drwxrws--- 2 root students 4096 Jul 13 21:38 newproject
This means that any user who creates an object within this directory will effectively
create that object with students in the group ownership.
In other words, the SGID bit on a directory controls the way that groups are assigned
for files created in the directory. If the SGID bit is set, files created in the directory
have the same group as the directory if the process creating the file also is in that
group. Otherwise, if the SGID bit is not set, or if the process is not in the same group,
files created inside the directory have the same group as the user's effective group ID
(usually the primary group ID).
Setuid and setgid can be security risk you can find files which have setuid and setgid
set on them by:
[root@mainserver / ]# find / \(-perm -004000 -o -perm -002000 \)
 -type f -print
This find command starts in the root directory (/) and looks for all files that match
mode 002000 (SGID) or mode 004000 (SUID). The -type f option causes the search
to be restricted to files. The -print option causes the name of every matching file to
be printed.
Note that if you are using NFS, you should execute find commands only on your file
servers. You should further restrict the find command so that it does not try to search
networked disks. Otherwise, use of this command may cause an excessive amount of
NFS traffic on your network. To restrict your find command, use the following:
[root@mainserver / ]# find / \( -local -o -prune \)
 \( -perm -004000 -o -perm -002000 \) type f -print

Recommended cache_mem Size for Squid Proxy Server

OPTIONS WHICH AFFECT THE CACHE SIZE

Tags under this section deals with cache memory configurations like cache memory size, swap size, maximum and minimum object

size, cache and memory replacement policies.

TAG NAME cache_mem

Description

cache_mem defines the ideal amount of memory to be used for In-Transit objects, Hot Objects, Negative-

Cached

objects

Build Option Default

Usage cache_mem size

Default cache_mem 8 MB

Recommended Cache_mem Size

1/4 of Ram Size, like if you have a 1gb ram of your squid caching server then cache_mem will be 256mb

Synopsis

Data for these objects are stored in 4 KB blocks. This parameter specifies the ideal upper limit on the total size of 4 KB blocks

allocated.

In-transit objects have priority over the others. When additional space is needed for incoming data, Negative-cached and Hot objects

will be released. In other words, the negative-cached and hot objects will fill up any unused space not needed for In-transit objects.

If circumstances require, this limit will be exceeded. Specifically, if your incoming request rate requires more than cache_mem of

memory to hold In-transit objects, Squid will exceed this limit to satisfy the new requests. When the load decreases, blocks will be

freed until the high-water mark is reached. Thereafter, blocks will be used to store hot objects.

Note: This tag does not specify the maximum process size. It places a limit on one aspect of squid's memory usage. Squid uses

memory for other things as well. Process will probably become twice or three times bigger than the value put here.

Arguments

size Cache memory size

Example(s)

cache_mem 32 MB

How to Transparent Proxy With Squid

Partition Table Information
Filesystem Size Used Avail Use% Mounted on
/dev/hda2 12G 663M 12G 6% /
tmpfs 1005M 0 1005M 0% /dev/shm
/dev/hda1 102M 36M 66M 36% /boot
/dev/hda7 3.2G 33M 3.2G 1% /home
/dev/hda6 5.0G 131M 4.9G 3% /tmp
/dev/hda3 16G 363M 15G 3% /var
/dev/hdb1 38G 17G 21G 45% /var/cache/squid

Package for Installation: squid-2.5.STABLE9-4.2
Checking for Installation: rpm –qa grep squid
Installing Squid through yast2:
yast2->Install and Remove S/W->Ctrl+S->search for squid->then install

Configuration File: /etc/squid/squid.conf

http_port 8080
cache_dir ufs /var/cache/squid 38000 16 256
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log

http_access allow all

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

Traffic Redirection Rule (iptables rule for transparent proxy):
iptables –A PREROUTING –i eth0 –p tcp –m tcp –dport 80 –j REDIRECT –to-port 8080

Note: Save the rule in a file by using the following command, because when the system reboots it flushes all iptables rules

iptables-save > redirect

Now restore the iptables rules by specifying the following command in the /etc/init.d/boot.local file:

Iptables-restore <>