Dr Fragen in the operating room


  • WordPress, WebDAV and htaccess

    So I moved my WordPress install to my domain root and the WordPress specific htaccess instructions have borked my WebDAV. Fortunately a little googling and I鈥檝e got a solution.
    Since running a multisite install, my htaccess rewrites a lot. Turning off the RewriteEngine inside he WebDAV direcetory solves this issue.
    [code lang=shell]
    <IfModule mod_rewrite.c>
    RewriteEngine Off
    Thanks Tim

  • chroot'd SFTP on Mac OS X server

    So here you are finding that you need to grant someone else SFTP access to your server. There are lots of reasons to do this, in my case it’s because I needed to grant access to someone’s web designer. We initially worked it out by him emailing me files and me SFTP’ing them up to the server in the correct location. Now he needs direct access to fix some things and I want to give him only what he needs without compromising security. Enter the chroot jail. After lots of googling and some encouragement from the Mac OS X Server email list, I’ve got it working. Here’s how it works.
    First, you should create the new user in Workgroup Admin and either assign them access privileges for SSH via Server Admin or assign them to a group that has SSH access privileges. Further discussion is below.
    From the Terminal, start off right.

    sudo cp /etc/sshd_config /etc/sshd_config.bkup
    sudo chown root /
    sudo chmod 755 /
    sudo mkdir -p /chroot/user/scratchpad
    sudo chown -R root /chroot
    sudo chown user /chroot/user/scratchpad
    sudo chmod -R 755 /chroot

    Every additional new user added will then be something along the lines of the following.

    sudo mkdir -p /chroot/user2/scratchpad
    sudo chown root /chroot/user2
    sudo chown user2 /chroot/user2/scratchpad
    sudo chmod -R 755 /chroot/user2

    Every folder in the path to the chroot jail must be owned by root. I don’t think it matters what group the folder is in. What I did above was to

    1. backup /etc/sshd_config
    2. change ownership of the root directory to root
    3. change permissions of the root directory to 755
    4. create a chroot folder
    5. create a user folder inside the chroot folder
    6. create a folder inside the user folder that user can modify
    7. set ownership and permissions

    Now to edit /etc/sshd_config to the following.

    #Subsystem sftp /usr/libexec/sftp-server
    Subsystem sftp internal-sftp
    Match User user
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp
    ChrootDirectory /chroot/userCode language: PHP (php)

    This creates a chroot jail. When the user logs in will drop them into the folder /chroot/user, in that folder is a folder they can add things to /chroot/user/scratchpad.
    If you want to create a Group in Workgroup Admin for ‘Chroot Users’ then add the new users that you created in Workgroup Admin to the Group; you won’t have to keep editing the /etc/sshd_config file. Instead of the above, add the following. Make sure you add the ‘Chroot Users’ group to the SSH access ACL in Server Admin.

    #Subsystem sftp /usr/libexec/sftp-server
    Subsystem sftp internal-sftp
    Match Group chrootusers
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp
    ChrootDirectory /chroot/%uCode language: PHP (php)

    If you have more than one chroot group just repeat the Match Group setup again.
    To test whether the above is working, issue the following from the terminal.

    $ sftp user@domain.com

    Getting in is one thing. Now you have to mount the folder you want to use. Unfortunately you can’t use a symlink inside of a chroot jail. This is where Homebrew is your best friend. I don’t know why I’ve never seen fit to install this before. After installation just issue the following commands.

    brew install bindfs

    You might have to restart. Now with an empty folder created in /chroot/user you can mount --bind to a folder outside of the chroot jail. For example

    sudo /usr/local/bin/bindfs -u user /Library/Server/Web/Sites/Server/Documents/mysite/yourfolder /chroot/user/scratchpad

    So far this seems to work here.
    Update for Mountain Lion Server
    As I’ve updated my server from Snow Leopard to Mountain Lion, there’s one extra step.
    From Workgroup Manager, you will need to create a home folder. Nothing really has to go into it, but it needs to be present. My settings are as follows.
    Mac OS X Server/Share Point URL:afp://myserver.example.com/Users
    Path to Home Folderusername
    Full Path/Network/Servers/myserver.example.com/Users/username
    After setting this up the first time it seems to auto-populate for every other user. You’ll have to go to the Home tab, select it and Save.

  • Squirrelmail Plugins

    Just an FYI post.
    I save all my added Squirrelmail plugins in /Users/Shared/squirrelmail_plugins/. Consequently if I need to reinstall any or all of them all I have to do is issue the following…
    sudo cp -R /Users/Shared/squirrelmail_plugins/PLUGIN_FOLDER
    sudo /usr/share/squirrelmail/config/conf.pl
    Activate the plugins, save, quit and you’re good to go.

  • Setting up WebDAV Share in Mac OS X Server

    As I attempt to transition from a laptop to an iPad, with no specific reason other than the iPad is sooooo kewl; I need to create my own online storage. Yes I have a Dropbox account, but I don’t control Dropbox.
    Here’s what I did, YMMV.

    1. From Server Admin, make new Web > Realm and set appropriate ACLs.
    2. Create a folder in location/volume where data for Share is physically located.
    3. Change permissions of folder to _www:admin (that’s what works for me)
    4. Create a symlink to the share folder in the folder where your web server looks to for the domain’s data.

    I know there’s probably a bit of information missing and if I showed images of the actual steps it might make things a bit clearer but I’m a little paranoid about my server and I don’t want to risk opening it up to further attack.
    All this needs to be done before OS X will allow a "Connect to Server..." and mount your WebDAV share.

  • Updating DNS settings

    Just to document. I’ve updated the settings in /etc/named/named.ca by using the following command and then restarting DNS.

    sudo curl ftp://ftp.internic.net/domain/named.root -o /var/named/named.ca

    Not sure how often this should be done.
    I also added the following to /etc/named.conf to reduced the error logging. I got that tidbit from google groups

    logging {
    category lame-servers { null; };
    category edns-disabled { null; };

  • Fail2ban Problems and Solutions

    If you use Fail2ban then you are probably aware of the fact that you must add a rule number to the ipfw deny rule for actionban in ipfw.conf. If you don’t add a rule number then there is no way for fail2ban to delete the rule after it expires. The problem lies in that you can easily set a different rule number for each filter but if the filter adds many rules within it’s ban time then when that first actionunban gets triggered all rules with the same number are removed, even if there full ban time has not transpired.
    I was looking for an elegant solution to this and finally figured out how to do it myself. What I’ve done is in the ipfw.conf file I’ve added a variable that will create a random number between 10000 and 12000 to use as the rule number.
    The code is pretty simple.

    echo $((RANDOM%2000+10000))

    There needs to be an extra % in there for it to work. I think it has something to do with python. So far it seems to be working pretty good here. While it is possible that I could get a duplicate rule number, it’s unlikely.
    I’ve modified my installation of Fail2ban significantly; but only by adding filters, jails, etc. Here’s a bundled version of all of my modifications. Here are instructions for using my modifications. So far everything seems to be working great. I’ve had to add a few items to ignoreregex so I don’t ban people using their iPhones on 3G or at home from certain dynamic IP cable providers.
    What I’ve done is a host lookup on the IP that’s banned and if I find it’s a local ISP, like Verizon or Time Warner Cable, I add part of their host lookup to the ignoreregex list. So far it seems to be doing the trick.