topic Re: Paranoid security, bypass resetting permissions in Secure OS Software for Linux

Paranoid security, bypass resetting permissions

Raynald Boucher — Tue, 26 Aug 2003 18:32:36 GMT

Good Day all,

We have installed Linux (mandrake 9) with a security level of "paranoid". While this is good, it can get quite annoying. for example:
there is a cron job that appears to reset ownership of all subdirectories and files under /var to root with permisions 700 and 600 respectively.
A real pain because no other user can read anything from /var/log.

Is there a way to disable this functionality for /var/log or a subdirectory?

I suspect I could store my reports somewhere else under some /home/ to avoid this problem, but I'd rather know how to configure security properly.

Thanks &
Take care.

Re: Paranoid security, bypass resetting permissions

Kodjo Agbenu — Tue, 26 Aug 2003 19:17:25 GMT

I don't know how Mandrake implement this functionality, but I remember in an old SuSE version I used few years ago, there were a file in /etc for configuring that (something like /etc/perms).

Check in Mandrake documentation or simply grep in /etc to find the right config file.

Good luck.

Kodjo

Re: Paranoid security, bypass resetting permissions

Steven E. Protter — Tue, 26 Aug 2003 19:39:45 GMT

crontab -e

Most likely there will be comments and you can find and modify the offending cron job.

SEP

Re: Paranoid security, bypass resetting permissions

Jean-Pierre Denis — Wed, 27 Aug 2003 07:14:43 GMT

Hi,

msec by default is making this happen...

Go look in :
/usr/share/msec

and take a look at the perm.5 file. (this is if you are running msec at level 5. I think "paranoid" which is the highest level is level5.)

you will see this for /var/log:
/var/log/ root.root 711
/var/log/* root.root 600
/var/log/*/* current 600
/var/log/*/*/* current 600
/var/log/*/. current 700

Simply replace the 600 or 700 with the permission you want to set.

Them run msec 5 again and all the permission will be applied to your system.

Thanks,
JP

Re: Paranoid security, bypass resetting permissions

Jean-Pierre Denis — Wed, 27 Aug 2003 07:19:52 GMT

Hi again,

instead of changing the file in /usr/share/msec you can create the file /etc/security/msec/perm.local and set your local permission in there.

This will overwrite the change made by perm.5 and if you upgrade msec one of there days your "local" config will be kept.

Thank,
JP

Re: Paranoid security, bypass resetting permissions

Raynald Boucher — Wed, 27 Aug 2003 13:03:53 GMT

Merci Jean-Pierre.

I was getting close but got sidetracked by that Python code.

Thanks all.