jouell's questions

Trying Create a Launch Configuration item, I get this error:

Launch Config problem: An error occurred (ValidationError) when calling the operation: Invalid IamInstanceProfile:AWS_EC2_INSTANCE_PROFILE_ROLE

executing this type of code w/boto 3:

self.as_client.create_launch_configuration(
                KeyName=f"{self.vpcid}-{self.profile_name}.pem",
                IamInstanceProfile=self.inst_prof_name,
                ImageId=self.ec2_inst.ami,
                InstanceType=self.ec2_inst.type,
                LaunchConfigurationName=self.ec2_inst.lc_name,
                SecurityGroups=[x.id for x in self.sec_groups.values()],
                UserData=userdata,
            )

I created 2 locally managed policies and attached them to a Role and assigned the role to an instance profile. (It seems boto3 does not allow viewing locally managed policies in the Role, only managed AWS ones, except when explicitly trying):

print(iam_client.get_role_policy(RoleName="EC2AppRole",PolicyName="CloudWatchSendPolicy"))
print(iam_client.get_role_policy(RoleName="EC2AppRole",PolicyName="AwsSecretsPolicy"))

Here's the Role w/ policy details:

== Role: EC2AppRole ==

{'RoleName': 'EC2AppRole', 'PolicyName': 'CloudWatchSendPolicy', 'PolicyDocument': {'Version': '2012-10-17', 'Statement': [{'Action': ['autoscaling:Describe*', 'cloudwatch:', 'logs:', 'sns:'], 'Effect': 'Allow', 'Resource': ''}]},

{'RoleName': 'EC2AppRole', 'PolicyName': 'AwsSecretsPolicy', 'PolicyDocument': {'Version': '2012-10-17', 'Statement': {'Effect': 'Allow', 'Action': ['secretsmanager:Describe*', 'secretsmanager:Get*', 'secretsmanager:List*'], 'Resource': '*'}},

The Instance Profiles seems OK:

== Instance Profile == {'Path': '/', 'InstanceProfileName': 'AWS_EC2_INSTANCE_PROFILE_ROLE', 'InstanceProfileId': 'AIPAXQXBO3GJ2LGTKDJ3L', 'Arn': 'arn:aws:iam::516942649747:instance-profile/AWS_EC2_INSTANCE_PROFILE_ROLE', 'CreateDate': datetime.datetime(2020, 12, 24, 5, 30, 4, tzinfo=tzutc()), 'Roles': [{'Path': '/', 'RoleName': 'EC2AppRole', 'RoleId': 'AROAXQXBO3GJ2AUOHJMVV', 'Arn': 'arn:aws:iam::516942649747:role/EC2AppRole', 'CreateDate': datetime.datetime(2020, 12, 24, 5, 30, 4, tzinfo=tzutc()), 'AssumeRolePolicyDocument': {'Version': '2012-10-17', 'Statement': [{'Effect': 'Allow', 'Principal': {'Service': 'ec2.amazonaws.com'}, 'Action': 'sts:AssumeRole'}]}}]}

Sorry I don't know how to properly format this post very well.

Any information I can share to help clarify?

I've tested everything in the create_launch_configuration call to be correct as best I can tell.

Connecting to a VIP/loadbalancer w/Tomcat behind it.

(tcpdump appears clean so far..no RSTs)

Using openssl version 1.2.q

$openssl s_client -connect "blah:443" -msg

    CONNECTED(00000003)

    >>> TLS 1.2  [length 0005]

        16 03 01 01 2c

    >>> TLS 1.2 Handshake [length 012c], ClientHello

        01 00 01 28 03 03 a8 3c de fd fd 63 19 ea 64 01

        <snip>

    <<< ??? [length 0005]

        16 03 03 00 51

    <<< TLS 1.2 Handshake [length 0051], ServerHello

        02 00 00 4d 03 03 dc dd fa a6 70 ab 42 29 26 5c

       <snip>

    <<< ??? [length 0005]

        16 03 03 11 9b

    <<< TLS 1.2 Handshake [length 119b], Certificate

        0b 00 11 97 00 11 94 00 06 01 30 82 05 fd 30 82

        <snip>

    verify error:num=20:unable to get local issuer certificate

    <<< ??? [length 0005]

        16 03 03 00 2e

    <<< TLS 1.2 Handshake [length 002a], CertificateRequest

        0d 00 00 26 03 01 02 40 00 1e 06 01 06 02 06 03

        05 01 05 02 05 03 04 01 04 02 04 03 03 01 03 02

        03 03 02 01 02 02 02 03 00 00

    <<< TLS 1.2 Handshake [length 0004], ServerHelloDone

        0e 00 00 00

    >>> ??? [length 0005]

        16 03 03 00 07

    >>> TLS 1.2 Handshake [length 0007], Certificate

        0b 00 00 03 00 00 00

    >>> ??? [length 0005]

        16 03 03 01 06

    >>> TLS 1.2 Handshake [length 0106], ClientKeyExchange

        10 00 01 02 01 00 93 7b b5 46 e4 a0 33 ef 9d 25

        <snip>

    >>> ??? [length 0005]

        14 03 03 00 01

    >>> TLS 1.2 ChangeCipherSpec [length 0001]

        01

    >>> ??? [length 0005]

        16 03 03 00 50

    >>> TLS 1.2 Handshake [length 0010], Finished

        14 00 00 0c f6 30 0b ca 0d 1c e9 b1 2d ec 91 90

    140048048748200:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:



No client certificate CA names sent

Client Certificate Types: RSA sign, DSA sign, ECDSA sign

Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1

Shared Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1

---

SSL handshake has read 4649 bytes and written 370 bytes

---

New, TLSv1/SSLv3, Cipher is AES256-SHA256

Server public key is 2048 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

No ALPN negotiated

SSL-Session:

    Protocol  : TLSv1.2

    Cipher    : AES256-SHA256

    Session-ID: <snip>    
    Session-ID-ctx:

    Master-Key: <snip>    
    Key-Arg   : None

    PSK identity: None

    PSK identity hint: None

    SRP username: None

    Start Time: 1548174269

    Timeout   : 300 (sec)

    Verify return code: 20 (unable to get local issuer certificate)

everthing seems to proceed nicely except I see "140048048748200:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:" after the finished message.

(FWIW, my goal is to connect with python3 using ssl to collect the certificate but currently cannot)

Any pointers here? I don't have the ability to try 1.1.0 or 1.1.1 at my location.

Wondering how Ansible works at a brick level. Most sites say a module is pushed and Ansible does not need an agent on the remote host - just SSH and Python.

It seems like Ansible would need to create a python script locally and copy it to the remote host. What is sent? Is it literally a .py file or a .pyc file - or other?

How is it possible the remote host will not need any additional Python packages?

Setup:

1. Domain1 - Win Server 2016 DC - PATRICA.COM

2. Win 7 Client is joined to Domain 1 - viewing shares on the DC work fine. www.thomas.com is added to 'local network' in IE 10

3. Domain2 - MIT Kerberos KDC - THOMAS.COM

4. Apache WWW/Mod_auth_kerb - keytabs for HTTP/[email protected] and other relevant forms.
5. Unix/Ubuntu client

All on 192.168.0.X - test network.

Two-way transitive trust setup w/same password.

The unix client can make a kerberized connection OK to WWW.

The windows client does not seem to lookup how to find THOMAS.COM. It looks up it's DNS name and does get a 401 Negoatiate back from the WWW server and then tries ntlm. I've tried running "ksetup /addkdc REALM IP" on both the windows client and the win 2016 DC. How does the client figure out www.thomas.com is part of THOMAS.COM?

How would someone implement an HSM if they wanted to encrypt all the tables of a database for example in a 3-tier environment?

Does the app server query the DB, get the encrypted blob and ask the hsm to decrypt it? That seems like a lot of data for the HSM to pass back and forth.

I've setup Ubuntu for testing purposes. -Installed MIT kerberos (latest) -Installed OpeenSsh(latest)

I've setup and have working both KerberosAuthentication and pam_krb5 types of authentication as well as GSSAPIAuthentication. All is well there.

When I setup only to use "KerberosAuthentication" or "pam_krb5" I see requests for host/:

Nov 20 00:09:11 kdcname krb5kdc[12476](info): AS_REQ (2 etypes {16 17}) 192.168.1.104: NEEDED_PREAUTH: [email protected] for krbtgt/[email protected], Additional pre-authentication required
Nov 20 00:09:11 kdcname krb5kdc[12476](info): AS_REQ (2 etypes {16 17}) 192.168.1.104: NEEDED_PREAUTH: [email protected] for krbtgt/[email protected], Additional pre-authentication required
Nov 20 00:09:11 kdcname krb5kdc[12476](info): AS_REQ (2 etypes {16 17}) 192.168.1.104: ISSUE: authtime 1511154551, etypes {rep=17 tkt=18 ses=17}, [email protected] for krbtgt/[email protected]
Nov 20 00:09:11 kdcname krb5kdc[12476](info): AS_REQ (2 etypes {16 17}) 192.168.1.104: ISSUE: authtime 1511154551, etypes {rep=17 tkt=18 ses=17}, [email protected] for krbtgt/[email protected]
Nov 20 00:09:11 kdcname krb5kdc[12476](info): TGS_REQ (2 etypes {16 17}) 192.168.1.104: ISSUE: authtime 1511154551, etypes {rep=17 tkt=18 ses=17}, [email protected] for host/[email protected]
Nov 20 00:09:11 kdcname krb5kdc[12476](info): TGS_REQ (2 etypes {16 17}) 192.168.1.104: ISSUE: authtime 1511154551, etypes {rep=17 tkt=18 ses=17}, [email protected] for host/[email protected]

Is the host/ service principal needed for something (TGS_REQ)?

In my mind all you need is AS_REQ to validate the user's password.

When setting up sshd with Kerberos on Ubuntu, one needs to "make sure that each each user has a valid account, either on the local host (via adduser or similar), or through a shared source such as LDAP

Why is that?

I can see if you use the GSSAPIAuthentication option or KerberosAuthentication, you've validated the user against a KDC.

Is this simply a matter of needing to map the username to a userid?

We had an unexpected increase on one of our mount points (~40GB) on a old RHEL 4 server (2.6.9-89.0.2 x86_64 kernel). It hit %100 usage ( Size and Used both said 37G, Avail said 0) as per df -h.

I found a directory that appeared to unused (some old backup software that we don't use at all). lsof had no record of it at all (including lsof | grep deleted). It was about 200 MB. I moved it to another disk partition with space available (and used sym link to point back to it.) It didn't reclaim any space. I ran sync; sync. Are my expectations off?

I've set up Apache to use HSTS as follows just for testing and learning purposes only:

/etc/apache2/sites-enabled/000-default.conf

NameVirtualHost 192.168.3.55:80
NameVirtualHost 192.168.3.55:443
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
<Directory /var/www/>
    Options Indexes FollowSymLinks MultiViews
    AllowOverride None
    Order allow,deny
    allow from all
 </Directory>
<VirtualHost www:80>
 ServerName www
 ServerAdmin webmaster@localhost
 DocumentRoot /var/www/html
</VirtualHost>
<VirtualHost www:443>
 ServerAdmin webmaster@localhost
 DocumentRoot /var/www/html
 ServerName www
 SSLEngine on
 SSLCertificateFile "/etc/apache2/ssl/mysitename.crt"
 SSLCertificateKeyFile "/etc/apache2/ssl/mysitename.key"
 Header always set Strict-Transport-Security "max-age=63072000;includeSubdomains;"
</VirtualHost>

I can connect to port 80 and port 443 just fine. The first site is not encrypted and the latter is. All Good there.

After I visit HTTPS site, I see the hsts headers just fine:

Strict-Transport-Security:max-age=63072000; includeSubdomains; 

When I then type in http://www I do see:

Upgrade-Insecure-Requests: 1 in the header using developer tools

However, the browser connects to the HTTP site, I tcpdump the request and see the response is in the clear as well still.

Shouldn't it be a secured connection or am I missing something? I thought the browser would only attempt to visit the secured site from now on)

For testing, I've changed my global open file limit to 3000:

#sysctl -w fs.file-max=3000
fs.file-max = 3000

#cat /proc/sys/fs/file-nr
2016    0       3000

I've created some files:

 i=1; while [ "$i" -le 1000  ]; do : >> "$i"; i=$(($i + 1)); done

I've held them open:

i=1; while [ "$i" -le 1000  ]; do less  "$i" & ; i=$(($i + 1)); done

I've seen the chaos I just created:

ksh: /bin/less: cannot execute [Too many open files in system]

I know I hit the limit....

# cat  /proc/sys/fs/file-nr
3008    0       3000

If I now raise the open file limit up (so I can ssh in using another console) and if I check on one of the recent less's I spawned after setting the open file max to 3000, I see:

# cat /proc/28282/limits  | grep 'Max open files'
Limit                     Soft Limit           Hard Limit       Units
Max open files            1024                 16384            files

The "Hard limit" is still set high, though no mention of 3000. So we hit the system limit, not the per process limit.

Why would'nt a newly created process be instructed to inherit 3000 vs 16384?

I logg'ed in in a new terminal with a new shell, so why wouldn't my shell be told 3000 and pass that down to less?

This is a 2.6.32 kernel

I see here: https://httpd.apache.org/docs/current/invoking.html

"If the Listen specified in the configuration file is default of 80 (or any other port below 1024), then it is necessary to have root privileges in order to start apache, so that it can bind to this privileged port.

Once the server has started and performed a few preliminary activities such as opening its log files, it will launch several child processes which do the work of listening for and answering requests from clients. The main httpd process continues to run as the root user, but the child processes run as a less privileged user. "

Question is: How can a child process do so? The incoming request happens on port 80 which the master is now bound to.

I am guessing the master process will call the bind() call and the child can then do a listen() call against the bound socket? Or Does the master server pass the children the incoming data?

We have a Wireless Lan controller set to authenticate users against (Lucent) Radius server. The username and password is stored in a database. About once a week the cpu on the radius/java process spikes to %100 cpu and all users for REALM-X get access denied/rejected authentication while users of REALM-Y are unaffected.

After we restart the radius service we then see ACCESS-ACCEPT messages for REALM-X users again. We notice in the logs what appears to be most of the clients/supplicants repeated sending auth requests. There can be up to 500-1000 auths for some users within an hour or so.

I believe the high cpu is a function of the high load. We are trying to understand why the supplicants (android/iphones/various laptops) send so many auth requests. We have the session set for 1 hour. Once the supplicant is authenticated isn't is 'done' with radius?

I don't understand the openssl output. Running openssl as follows:

#openssl s_client -connect google.com:443 -CAfile cacert.pem < /dev/null

Ultimately all is well in that the end entity's cert was verified OK: Verify return code: 0 (ok)

but what about w/the verify return:1 in the beginning of the output for the intermediates below? What does that mean or what is it's point?

depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2 verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = google.com verify return:1

---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=google.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
---

We have Apache set to run as www user on a RedHat box, but it's logs are written w/root ownership as the process itself run as root. It seems the best course of running would be to 1) run rotatelogs as a non root user, and 2) to put the logs in a place set aside for the user w/proper permissions.

Can this be done? I don't see a method here:

https://httpd.apache.org/docs/2.2/programs/rotatelogs.html

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there.

But if you don't have a local user in /etc/passwd but you can get a host/XXXXXX service ticket (GSSAPI works), sshd fails the login and never get prompts for SecurID (our pam radius points to a SecurID). I understand that. Since the server 'authenticated' the user and pam_unix knows the user is not in /etc/passwd, there's no need to engage any other auth methods.

However, my question is why is it if I first run kdestroy (intentionally have GSSAPI fail), (and still don't exist in /etc/passwd) do I all of a sudden get a Securid prompt (i.e PAM is engaged)?

Running sshd with debug shows: postponed keyboard-interactive for invalid user "user". First, why wouldn't it simply fail? Second why delay? pam_radius is 'requisite', not 'required'.

I would expect to also to simply fail because even though I have not authenticated, I never going to get past pam_unix.

Files:

/etc/ssh/sshd_config

....  
ChallengeResponseAuthentication yes  
GSSAPIAuthentication            yes  
HostbasedAuthentication         no  
KerberosAuthentication          no  
PasswordAuthentication          no  
PubkeyAuthentication            yes  
RhostsRSAAuthentication         no  
RSAAuthentication               yes  
UsePAM                          yes      
....

/etc/pam.d/sshd

auth       requisite        pam_radius_auth.so conf=pam_radius_auth.conf debug retry=3  
auth       required     pam_nologin.so  
auth     required     pam_krb5.so.1  
account  sufficient      pam_radius_auth.so conf=pam_radius_auth.conf  
account    required     pam_stack.so service=system-auth  
password   required     pam_stack.so service=system-auth  
session    required     pam_stack.so service=system-auth  
session    required     pam_limits.so  
session    optional     pam_console.so  

/etc/pam.d/system-auth

auth        required      pam_env.so  
auth        sufficient    pam_krb5.so.1  
auth        sufficient    pam_unix.so  
auth        required      pam_deny.so  
account     required      pam_unix.so  
password    required      pam_cracklib.so retry=3  
password    sufficient    pam_unix.so use_authtok md5 shadow  
password    required      pam_deny.so  
session     required      pam_limits.so  
session     required      pam_unix.so  

I understand kerberos provides authentication using encryption. I see it exchanges session keys. Are those session keys used for applications send their data over that network encryption after authentication is performed?

For an example to clarify:

If I kerberize my telnet server and client will my client and server session then also be encrypted (presumably using the aforementioned session keys) (i.e a sniffer can't see the commands I type in the session)?

I see that HTTP based SPNEGO kerberos does not follow this and one would need to use SSL to secure the session.

If I deploy a server call FOO/host.example.com@myrealm how does a client become aware that the service name is FOO?

ENV: Unix / MIT kerberos 1.4 or 1.10

I see windows has some sort of mapping: How exactly does the HOST/machine SPN work?, what about unix?