Category: RedHat

Dirty Cow Vulnerability (CVE-2016-5195)

October 27, 2016

On October 19, 2016, a privilege escalation vulnerability in the Linux kernel was disclosed. The bug is nicknamed Dirty COW because the underlying issue was a race condition in the way kernel handles copy-on-write (COW). Dirty COW has existed for a long time — at least since 2007, with kernel version 2.6.22 — so the vast majority of servers are at risk. Exploiting this bug means that a regular, unprivileged user on your server can gain write access to any file they can read, and can therefore increase their privileges on the system. More information can be found on CVE-2016-5195 from Canonical, Red Hat, and Debian. Fortunately, most major distributions have already released a fix. You can follow this tutorial to see if your server is vulnerable and to apply updates as needed. Check Vulnerability Ubuntu/Debian To find out if your server is affected, check your kernel version. uname -rv

Remote access via ssh with RedHat Rescue Disk

July 7, 2009

Insert Rescue Disk and boot server. At the first prompt type “linux rescue” and hit enter. Follow boot disk prompts to start networking. Enter the system’s ip address, netmask, gateway and name server. Continue with prompts until the root partition is mounted and you get a command prompt. Verify network configuration with ifconfig and route. Use the following commands to start sshd:

cd /mnt/sysimage
chroot /mnt/sysimage
mount /dev/pts
/sbin/service sshd start

cd /mnt/sysimage

chroot /mnt/sysimage

mount /dev/pts

/sbin/service sshd start

You should now be able to SSH into the server.

Mount Windows drive share on RHEL5

April 24, 2009

RHEL5 replaced the old smbmount command with mount.cifs so to mount a shared Windows drive do something like:


mount -t cifs //servername/sharename /mnt/mountpoint \
 -o username=myusername,password=mypassword

mount -t cifs //servername/sharename /mnt/mountpoint \

-o username=myusername,password=mypassword

Reinstall grub in MBR

April 14, 2009

Two approaches to this. The first is to use the grub-install utility:


grub-install --root-directory=/boot /dev/???

grub-install --root-directory=/boot /dev/???

The second approach is to use the grub command line: 1. Start the grub command line:

grub

grub

2. Determine the boot device:

find /boot/grub/stage1

1	find /boot/grub/stage1

You’ll get something like “(hd0,0)”. 3. Tell grub where the root is:

root (hd0,0)

1	root (hd0,0)

4. Install the MBR:

setup (hd0,0)

1	setup (hd0,0)

Fix strange characters from pstree on RedHat.

April 10, 2009

By default on Redhat, the output from pstree is scrambled like this:

initââ¬âEvMgrCâââEvMgrCâââ4*[EvMgrC]
     ââatd
     ââbdflush
     ââcrondâââcrondâââshâââwget
     ââcvdâââcvdâââ8*[cvd]
     ââhttpdâââ31*[httpd]
     ââirqbalance
     ââkeventd
     ââkhubd
     ââ2*[kjournald]
     ââklogd
     ââkscand
     ââksoftirqd/0
     ââksoftirqd/1
     ââksoftirqd/2
     ââksoftirqd/3
     ââkswapd
     ââkupdated
     ââmdrecoveryd
     ââ6*[mingetty]
     ââminiserv.pl
     ââmysqld_safeâââmysqld
     âânsrexecdââânsrexecd
     ââportmap
     ââ2*[portsentry]
     âârhnsd
     ââsaslauthdâââ4*[saslauthd]
     ââscsi_eh_0
     ââsshdâââsshdâââsshdâââbashâââsuâââbashâââpstree
     ââsvscanbootââ¬âreadproctitle
     â            ââsvscanââ¬âsuperviseâââqmail-sendââ¬âqmail-clean
     â                     â                        ââqmail-lspawn
     â                     â                        ââqmail-rspawn
     â                     ââ3*[superviseâââmultilog]
     â                     ââsuperviseâââtcpserverâââ6*[rblsmtpdâââfixcrio]
     â                     ââsuperviseâââtcpserver
     ââsyslogd
     ââvsftpd
     ââxinetd

initââ¬âEvMgrCâââEvMgrCâââ4*[EvMgrC]

ââatd

ââbdflush

ââcrondâââcrondâââshâââwget

ââcvdâââcvdâââ8*[cvd]

ââhttpdâââ31*[httpd]

ââirqbalance

ââkeventd

ââkhubd

ââ2*[kjournald]

ââklogd

ââkscand

ââksoftirqd/0

ââksoftirqd/1

ââksoftirqd/2

ââksoftirqd/3

ââkswapd

ââkupdated

ââmdrecoveryd

ââ6*[mingetty]

ââminiserv.pl

ââmysqld_safeâââmysqld

âânsrexecdââânsrexecd

ââportmap

ââ2*[portsentry]

âârhnsd

ââsaslauthdâââ4*[saslauthd]

ââscsi_eh_0

ââsshdâââsshdâââsshdâââbashâââsuâââbashâââpstree

ââsvscanbootââ¬âreadproctitle

â ââsvscanââ¬âsuperviseâââqmail-sendââ¬âqmail-clean

â â ââqmail-lspawn

â â ââqmail-rspawn

â ââ3*[superviseâââmultilog]

â ââsuperviseâââtcpserverâââ6*[rblsmtpdâââfixcrio]

â ââsuperviseâââtcpserver

ââsyslogd

ââvsftpd

ââxinetd

There are a couple of ways to clear this up so that it looks like this:

init─┬─EvMgrC───EvMgrC───4*[EvMgrC]
     ├─atd
     ├─bdflush
     ├─crond
     ├─cvd───cvd───8*[cvd]
     ├─httpd───22*[httpd]
     ├─irqbalance
     ├─keventd
     ├─khubd
     ├─2*[kjournald]
     ├─klogd
     ├─kscand
     ├─ksoftirqd/0
     ├─ksoftirqd/1
     ├─ksoftirqd/2
     ├─ksoftirqd/3
     ├─kswapd
     ├─kupdated
     ├─mdrecoveryd
     ├─6*[mingetty]
     ├─miniserv.pl
     ├─mysqld_safe───mysqld
     ├─nsrexecd───nsrexecd
     ├─portmap
     ├─2*[portsentry]
     ├─rhnsd
     ├─saslauthd───4*[saslauthd]
     ├─scsi_eh_0
     ├─sshd───sshd───sshd───bash───su───bash───pstree
     ├─svscanboot─┬─readproctitle
     │            └─svscan─┬─supervise───qmail-send─┬─qmail-clean
     │                     │                        ├─qmail-lspawn
     │                     │                        └─qmail-rspawn
     │                     ├─3*[supervise───multilog]
     │                     ├─supervise───tcpserver───12*[rblsmtpd───fixcrio]
     │                     └─supervise───tcpserver
     ├─syslogd
     ├─vsftpd
     └─xinetd

init─┬─EvMgrC───EvMgrC───4*[EvMgrC]

├─atd

├─bdflush

├─crond

├─cvd───cvd───8*[cvd]

├─httpd───22*[httpd]

├─irqbalance

├─keventd

├─khubd

├─2*[kjournald]

├─klogd

├─kscand

├─ksoftirqd/0

├─ksoftirqd/1

├─ksoftirqd/2

├─ksoftirqd/3

├─kswapd

├─kupdated

├─mdrecoveryd

├─6*[mingetty]

├─miniserv.pl

├─mysqld_safe───mysqld

├─nsrexecd───nsrexecd

├─portmap

├─2*[portsentry]

├─rhnsd

├─saslauthd───4*[saslauthd]

├─scsi_eh_0

├─sshd───sshd───sshd───bash───su───bash───pstree

├─svscanboot─┬─readproctitle

│ └─svscan─┬─supervise───qmail-send─┬─qmail-clean

│ │ ├─qmail-lspawn

│ │ └─qmail-rspawn

│ ├─3*[supervise───multilog]

│ ├─supervise───tcpserver───12*[rblsmtpd───fixcrio]

│ └─supervise───tcpserver

├─syslogd

├─vsftpd

└─xinetd

Here are two possible solutions: 1. Use “pstree -G” to force VT100 line drawing 2. Do “export LANG=’en_US’” to change the language from UTF-8 to English