On 07/12/2011 12:49 PM, Mike O'Connor wrote: > chown root:xenusers /usr/bin/dtc-xen_userconsole > chmod -s /usr/bin/dtc-xen_userconsole
I think that the -s is there to correct an issue with an older setup, but I can't remember why there was a chown. I'll remove it (but do not worry too much, I don't think it's hurting security in any way, considering how restricted the tty1 VM console is). > It assumes I have ssh installed. If I don't, the script terminates early with > an error. Sure, it assumes sshd to be installed: that's the hole point of the script! Do you think it should be made more explicit? If so, please suggest something else that what is already in the Debconf template: "This script will remove port forwarding from the current sshd_config file and add the permission to access the xm console to the group xenusers so that users can login to the physical console." > The script does a poor job of interpreting /etc/ssh/sshd_config: > grep "AllowTcpForwarding no" /etc/ssh/sshd_config > is not a reliable way to see if TCPForwarding is disabled. If that fails, then > grep "AllowTcpForwarding" /etc/ssh/sshd_config > is not a reliable way to see if TCPForwarding is enabled. Remember that the goal is to provide a helper to quickly disable port forwarding. It does work on a freshly installed server. I don't mind improving the script if you can think of improvements. How would you do it then? Also, I thought about using /etc/sudoers.d instead of the above. But then, you'd have access to the tty1 before the TCPForwarding set to no, and that would be a security issue. I'd be happy to find a solution for this. I will for sure use /etc/sudoers.d instead of the ugly hack that is currently in dtc-xen_finish_install, but I don't think I can put that in the dtc-xen package just yet. Any thoughts? > The script checks to see what stuff might exist in /usr/share/dtc-xen-os, > which > doesn't seem to be a directory in any debian package. I don't seem to find > any > documentation that tells me what might go there. The /usr/share/dtc-xen-os is a repository of OS templates that can be installed automatically by dtc-xen (see "man dtc_reinstall_os", particularly the -os option). Of course, these aren't available in Debian, I don't see the security team doing the security updates of other distributions (and frankly, the images we provide are on the best effort basis, some should be upgraded). > Then you tell the user that they should add a sources.list entry for a third > party repsitory which seems to have packages for lenny ?!? Why is this. Are > there packages in this repository that are needed for using dtc-xen? Yes, see above. The packages in the repository for Lenny are working without any issue in any Debian release anyway, it's just some tar.gz and some tiny scripts to do the setup of these images. > It appears that since /usr/share/dtc-xen-os doens't exist, you will then tell > the user to run: > "apt-get install" > > Which seems rather pointless. were you going to tell them to apt-get update? > apt-key add? The idea is to give pointers to the user that there are some image templates available. I agree that the message needs to be updated, and I will. But now, do you really think that an administrator wouldn't know how to use apt? Thomas -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
