Andrey Sapegin's questions

As a part of a bigger setup (docker container with safe environment for running python scripts), I need to configure a jailed user. I have looked at different options and decided to try Jailkit. Unfortunately, I have a problem with trying to setup a jail for user - basically, a jail does not work for me at all. The steps I have done are:

#install jailkit
apt-get install -y wget make python2.7 gcc
wget http://olivier.sessink.nl/jailkit/jailkit-2.19.tar.gz
tar -xzvf jailkit-2.19.tar.gz
cd jailkit-2.19
./configure; make;
sudo checkinstall

# create new user
sudo adduser --disabled-password --gecos Python python

# create a jail for this user
sudo mkdir /home/tjail
sudo jk_init -v -j /home/tjail jk_lsh
sudo jk_init -v -j /home/tjail basicshell
sudo jk_jailuser -m -j /home/tjail python

Now I expected to try to login as this user:

sudo su - python

However, nothing happens after I execute this command, I'm not getting switched to the jailed user. Do you know, what could be wrong?

I'm using Ubuntu 12.04, but also have the same issue on 14.04...

UPDATE: /etc/password looks good:

python:x:1001:1001:Python,,,:/home/tjail/./home/python:/usr/sbin/jk_chrootsh

UPDATE 2: I have also tried changing /usr/sbin/jk_chrootsh to /bin/bash. Now I can su to this user, but then the jail seems not to be working. E.g., I can go to the real system root, browse real home, see settings in the /etc or read /etc/passwd file (normal one)...

I have 2 external USB hard drives encrypted with LUKS in Ubuntu 12.04. Generally, the both drives are very slow with LUKS/dmcrypt, e.g. 7 MB/s for both read/write, but I could live with this.

However, when I try to copy files from one encrypted disk to another one, it becomes unacceptable. Using rsync, the copy process freezes every several seconds for up to 20 seconds. When it freezes, rsync progress shows either nothing (just filename), or something like:

32768   1%    0.00kB/s    0:00:00

sometimes speed could be up to 100kB/s, but the number of bytes copied does not change. In very rare cases, the progress freezes with something like

72908800  27%    5.40MB/s    0:00:34

(and the numbers are not changing for several seconds).

It seems that this only happens when I copy from one LUKS drive to another. E.g., when I tried to copy a large file from one encrypted drive first to my home directory, and then from there to the other encrypted drive, there were no freezes (however, copy speed was constantly going down from initial ~20 MB/s to about 7 MB/s).

Any suggestions are welcome!

I have Cisco ASA 8.2(5) and would like to configure port forwarding.

Cisco ASA has 2 interfaces:

outside with IP 192.168.57.2
inside with IP 192.168.1.1

I have two subnets reachable through outside interface:

192.168.17.0/24
192.168.18.0/24

And two subnets reachable through inside interface:

192.168.14.0/24
192.168.15.0/24

Now I would like to setup port forwarding so, that the same port on outside interface of ASA is forwarded to different inside hosts, depending on subnet of the client outside:

1. If client from one subnet connects from outside to ASA on port 4000 (from 192.168.17.124 to 192.168.57.2:4000), I want to forward it to 192.168.14.5:3389.
2. If client from another subnet connects to the same port on outside interface of ASA (from 192.168.18.124 to 192.168.57.2:4000), I want to forward it to host in another subnet (192.168.15.5:3389).

Is such configuration possible? How could I configure it?

P.S. My current configuration just always forwards the port to the same IP, not depending on client subnet:

object-group service OpenedPorts tcp-udp
 port-object eq 4000
 port-object eq 4002
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp

access-list outside_access_in extended permit object-group TCPUDP any any object-group OpenedPorts

access-group outside_access_in in interface outside

static (inside,outside) tcp interface 4000 192.168.14.5 3389 netmask 255.255.255.255
static (inside,outside) tcp interface 4002 192.168.14.6 22 netmask 255.255.255.255

I have a demo of Cisco IOS XRv and I would like to setup logging for connections.

E.g. for ASA "show logging" shows log messages for every TCP connection built or teardown:

Jun 11 12:29:31 10.10.10.254 %ASA-6-302013: Built outbound TCP connection 8236065 for outside:x.x.x.x/443 (x.x.x.x/443) to inside:y.y.y.y/58772 (z.z.z.z/58772) 
Jun 11 12:29:36 10.10.10.254 %ASA-6-302014: Teardown TCP connection 8236059 for outside:x.x.x.x/443 to inside:y.y.y.y/49350 duration 0:00:00 bytes 11460 TCP FINs 

However, if I execute "show logging" on IOS, it only shows information about configuration changes, but no connection traces.

Do I need any additional configuration to enable such connection logging on IOS (to see the connection traces like on ASA)? Or it's not supported at all and I need a separate ASA virtual machine for it?

can somebody give an advice how to change the LDAP password already expired?

I have an LDAP user and the password for this user is expired:

# su user
You are required to change your password immediately (password aged)
su: Authentication token is no longer valid; new one required
(Ignored)

then I can change the password using 'passwd'. But if I try to login once again, the message still appears. If I try the ssh login, I also get the following message: "You are required to change your password immediately (password aged)"

Then I change the password. But if I try to login once again, the message remains...

Thank you in advance.

P.S. I have also tried:

user@server$ ldappasswd

Please enter your password: 
ldap_sasl_interactive_bind_s: Invalid credentials (49)
additional info: SASL(-13): user not found: no secret in database

we have a couple of servers with PAM+LDAP.

The configuration is standard (see http://arthurdejong.org/nss-pam-ldapd/setup or http://wiki.debian.org/LDAP/PAM). For example, /etc/pam.d/common-auth contains:

auth sufficient pam_unix.so nullok_secure
auth requisite pam_succeed_if.so uid >= 1000 quiet
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so

And, of course, it works for both ldap and local users. But every login goes first to pam_unix.so, fails, and only then tries pam_ldap.so successfully. As a result, we have a well-known failure message for every single ldap user login:

pam_unix(<some_service>:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=<some_host>  user=<some_user>

I have up to 60000 of such log messages per day and I want to change the configuration so, that PAM will try ldap authentication first, and only if it fails - try pam_unix.so (I think it can improve the i/o performance of the server). But if I change common-auth to the following:

auth sufficient pam_ldap.so use_first_pass
auth sufficient pam_unix.so nullok_secure
auth required pam_deny.so

Then I simply can't login anymore with local (non-ldap) user (e.g., via ssh).

Does somebody know the right configuration? Why Debian and nss-pam-ldapd have pam_unix.so at first by default? Is there really no way to change it?

Thank you in advance.

P.S. I don't want to disable logs, but want to set ldap authentication on the first place.

I'm looking for a solution (or at least for some guide/pathway/manual) to boot AND SYNCHRONISE Linux images from network. I already understand how network boot (PXE, DHCP, TFTP) works.

In my organisation we have many PC's with the same (or different too) hardware configuration with Linux (Ubuntu LTS). And when we make an upgrade I need to go and upgrade every PC manually. The same when somebody asks for software update (e.g., LibreOffice, Eclipse, VMware). Of course, I don't like to do it manually.

And now I'm looking for solution which will allow me to create a custom Linux image with custom software set and SYNCHRONISE it with users' PCs during boot process.

The goal is to have one OS on all (in one department) users' computers with the same configuration and software.

I'm NOT interested in Diskless Clients or Linux Terminal Server. And I'm looking NOT ONLY for network installation. I want to make a custom Linux image and then install it on the users' computers during boot - create a local installation on each user computer.

BUT THEN, if I change something (e.g., add new software into this image, or just run 'apt-get upgrade') in the image, I want these updates appear on users' computers during next network boot/synchronisation. I want to synchronise the system configuration (/etc, /usr, /opt, and others), without users' /home or data in /media.

Thank You very much in advance.

P.S. I'm also looking for option to support users computers with different hardware.

P.P.S. Another option is to synchronise custom manually preinstalled Linux with the image from network (image should overwrite custom installation).

P.P.P.S. I'm also dreaming doing the same for Windows.

Can somebody give me a pathway (or link to the documentation / how to) to implement two-factor authentication (LDAP password + certificate) on Cisco ASA for RemoteVPN (with Anyconnect client)?

Currently our Cisco ASA (5505, 8.4.3) is configured for password authentication using OpenLDAP server. We use RemoteVPN with AnyConnect Client (SSL VPN). And I would like to add certificates into authentication/authorisation process. I don't want to use any external Certificate Authority. I even probably don't need personal certificates for every user.

What I need is just to check if user has a valid certificate before/after/during authentication/authorisation on LDAP with password.

To be honest, now I don't clearly understand how it should work.

1) First of all, I don't understand, where should it be configured on Cisco ASA.

Should I just enable both certificate and aaa authentication "(config-tunnel-webvpn)# authentication aaa certificate" for my tunnel group through my OpenLDAP server? How will it work then? Does OpenLDAP support certificate validation?

Or I need to use secondary authentication to add certificates? Do I need then to configure some server then for secondary authentication?

Or I need to make any other configuration, like CA authority? How then CA authority can get usernames from OpenLDAP? Or can I just make one certificate for all users (such a security level is totally enough for my company)?

2) How the certificate validation process should work? How Cisco ASA will validate the certificate? Is it something like openssl private/public keys or not? Can I set up Local CA Authority on ASA, but still get all users from OpenLDAP? Will it just extract username from the certificate or it will somehow use the certificate itself for authentication?

Thank You very much in advance.