<quote who="Glen Turner"> > Voytek Eymont wrote: > Sigh. There as stack of stuff run when you login. See /etc/profile > and /etc/profile.d/*. These are running commands like id, egrep, uname. > But hey, you haven't allowed non-root users to run those so they can't > be run when a non-root user logs in.
Glen, yes, I clearly stuffed up, I was following up on advice I took from several web docs, and, I should've revied the docs prior to doing what I done, rather than, relying on memory. in the last few days, I went over maybe 30-odd documents, and, it seem my memory cross linked a few of them, but the time I executed advice, my recollection was correct in general idea, incorrect in finer details, like chmod value as it was, the advice was to: ==== ...By simply chmod'ing the files so that no none-wheel or root user can use them we can eliminate many possible problems. The downside to doing this is that shell users will be inconvenienced by not being able to use the the commands below. This may cause some problem if your users are trying to use ... -----command----- chmod 750 /usr/bin/rcp ... ==== the genreal idea of this seemed wise to me, but, (a) I ended up using incorrect chmod value, and, (b) decided to 'add a few more', 'for a good measure' of course, in hindsight, (b) wasn't so clever, but, well, I'll reverse it and, yes, I should've rechecked the doc, and, yes, I should've realized that myself. I can't argue, that was, for a want of a kinder description, dumb. (if it wasn't reversible, it woul;d have been moronic, as well as dumb) > Because they can't be run there's no return code and the "if [" statements > fall over. > > Now for some free advice. When you are hacked do a clean install of the > vendors latest OS and patches and then copy across the configuration and > data from your hacked machine. > > I also think you need to seriously consider your level of expertise > compared to what you are trying to achieve. You're seeking advice > for the most trivial stuff (see your question above) which indicates > a beginning level of understanding. So rather than wholesale part of my problem is, I only have one single Linux machine, and, it is physically remote to me. I do not have any other Linux machine either at work or home, which often makes it more dificult to acomplish even trivial things. I haven't used Linux, apart from this machine, and, my expierence is limited to reading RH docs (I'm also collecting replies to mine, and, others, question here into 'my own faq') had I had the benefit of another machine, I'd have tried the 'mods' 1st. as it was, I didn't. the compromised machine will be re-installed of course. the reason I copied some binaries over, was following suggestion from root tool kit detection faq, to supply 'known good binaries' that the root tool detection kit uses. > customisation > of the machine, use the mechanisms the vendor has supplied (at least > until you've got more experience than the vendor). You now understand > why the vendor chose SELinux rather than file permissions -- because > SELinux allows differing access depending if the accessor is a web server > or a user logging in. > > You'll note that this advice has been offered to you by other people > on this list. and, I'm following up on most of it, as appropriate, with corrections to the circumstances, and, include in my linuxhow2 all in all, sorry for asking many dumb/trivial Q, and, thanks for all the advice, all advice has been very helpful, and, applied, as appropriate -- Voytek -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
