how does my system know itself ?

[Jerome Henry]

Hi everybody,

Lying in the dark last night, I was wondering about a tiny thing :

I'm running RH9 : who can list all the files the system uses to know that fact ?

In other term, what cold I change to make my system believe that it's a Rh 11, for example (know it's silly) ?

I would make experiments on one box and get a bunny for the full list...
(SEP please post twice, I owe you sth).

Thanks.

Jerome

[Caesar_3]

Hello!

The fact in the linux systems it's not the
version of OS (RH9, SuSe 8, Mandrake 9.1)
That's nothing the whole program that you
will want to install and so on not depend
on the OS version number,
it depend on kernel version, and if program for
X then version of XFree, rpm for some rpm version. That's not like on HPUX, AIX, Solaris
that's not the part of the OS.

You by your self could make your linux you
can call it Jerome 1.0 and take the same sources that RH 9 compiled and you have new
name that work like other.

Caesar

[Jerome Henry]

Thanks for the Tip, Caesar,

I was thinking about some HP progs, that can install only on rh7.3, even with latest kernel, and not on 8.0, even with rh8 first kernel.

I was also thinking about the welcome.msg anouncing RH 9(shrike) at login time...

What do Hp progs read to tell me 'wrong RH version' ?

J

[Umapathy S · Accepted solution]

Jerome,
As caesor has said, it depends upon the distributor and how he wants to name it.

A distribution will contain a set of packages and that will form a unique no. Normally the Major version change is done when the OS is upgraded fully from the kernels to the utilities. Then the minor version packages will form a dependency tree based on the base release of the major version.

So the HP Progs you are talking about may
1. go and check for the version of the individual RPM packages it is dependent on
2. check some other files (flat files) of the distribution.
3. May be content with simply running uname on the distribution.

Hope this brings some light into the dark (like the shooting stars).

HTH,
Umapathy

[Caesar_3]

Hi,

For the welcame that you see it's wrote in
/etc/redhat-release
You can write what ever you want there but
about what programs you talk, what names?

Caesar

[Jerome Henry]

Thanks gentlemen !

On modifying /etc/redhat-release I had some progs believe I was on rh7.3.

Some didn't. I modified sources for graphic libs to show old version, and it works : my system RH9 is seen as 7.3, I can install some old progs like Kheopss , which won't accept new versions.

OK, it's not that useful, but I like to hack systems...

Have a nice w.e. !

J

[Caesar_3]

Hi,

Linux is the system for hack!
You can change also every realese number
of any product because you have the sources.
You can change the kernel that it could be
1.1 version only by changing few files.

I don't know the program that you wrote but
it's something stupif if it check the realese
of the OS itself.

You also have command that caled strace
that shows the sys calls of program that you
run it with: strace
and then you will see where it's abort and
on which operation.

Caesar

[Jerome Henry]

Thanks for the tips Caesar,

Kheops is not exactly a program I wrote, it's an snmp tool, and... it was modified somehow, and some systems have it trusted on that version, as kind of peripherical. So you have a box, looking on a network like something stupid like a hub or a printer, from which you can do things that a hub is not supposed to try.

I have this tool, and I feel that some bad guys do also, and I want to have it work to know how to prevent its effects... apart from my personal wish to know things !

J

[Caesar_3]

Jerome,

Security for today very it's important.
In linux you have a lot of tools that
will give you maximum security.

For the "stupid" that i wrote i mean the
disgin of the program that check this thing.

And again that's what linux give to all of
us is to rulle the system and not that the
system will rulle you.

Good luck!

Caesar

[Steven E. Protter]

There are better things to do at night than wonder about this. See my hobby thread.

You can change the file noted earlier in the thread, you can even upgrade the kernel.

Externally, the system might report itself to be a different version number, but the core of the OS is the core of the OS.

Linux was designed to allow for kernel upgrades, without upgrading the software and everything else. Since the real identity of the operating system is the kernel, the only safe, practical way to accomplish this goal is a kernel upgrade.

I would like to know why exactly this interests you.

From a security standpoint, HP's general security guidelines which apply to any Unix system are to strip a system of its identifing information.

/etc/issue should not include the machine type and distribution. Neither should the Linux equivalent.

The reason is simple, why should you make things easy for the hacker. If they get a blank prompt screen, let them spend some time figuring out what kind of system it is. Further, don't announce the kernel you ar running, so the hacker can pick and choose whick kernel vulnerability document to use to screw your system.

Bastille deals with some of these issues.

Thanks for the offer Jerome, but I'll reserve the double post for when my mouse screws up.

Have a good weekend.

SEP