Re: Shared memory DoS's (Redhat retraction)

From: Jim Dennis (jimdat_private)
Date: Mon Jul 19 1999 - 04:03:29 PDT

  • Next message: Chris McDonough: "Re: AMaViS virus scanner for Linux - root exploit"

    > I've been waiting all day for my post to be approved so I could
    > post a retraction for Redhat Linux and its derivatives. :)
    
    > It seems I forgot all about pam. Thanks to Mike Johnson of Redhat
    > for bringing pam_limits.so to my attention. Any distribution that
    > uses pam can set limits to prevent this.
    
    > However, other distributions like Slackware and the default debian
    > install still need some method to set the RLIMIT_AS limit. You
    > need to patch login.c and other methods of authentication (ssh &
    > rlogin, etc), or replace the appropriate functions in the lshell
    > distribution (ftp://metalab.unc.edu/pub/Linux/system/admin/login),
    > and wrap your shells accordingly. I still don't know what to do
    > about dgb in that case. The alternative is to patch all your
    > system shells and set the rlimits via the worldwide rc scrips.
    
    	Actually any Linux using the Shadow password suite
    	(from Julianne Haugh?) should be fine.  You should be
    	able to create a file named /etc/login.defs and use
    	that to set ULIMIT and other limitations (which
    	that version of login should read).  You could
    	easily run your version of login under strace
    	to confirm that it does read the /etc/login.defs
    	file.  Better distributions using this suite will
    	also have a man page for it.  (the PAM suite is largely
    	based on the Shadow suite so it seems to support
    	/etc/login.defs by default).
    
    --
    Jim Dennis                                             jdennisat_private
    Linuxcare: Linux Corporate Support Team:            http://www.linuxcare.com
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:52:40 PDT