Kevin Buchs's questions

TDLR: I have a Catch 22 where, depending on permissions on the user's home directory, I can get the SSH authentication to work, or the user directory constraints, but not both.

BTW, I really want to roll my own SFTP server. Please don't recommend I try AWS Transfer service or something alternative. Thanks.

Here is relevant (changed from default) content in /etc/ssh/sshd_config:

Subsystem sftp internal-sftp
Port 22
Port 2299
Match Group sftpusers LocalPort 2299
  ChrootDirectory /sftp-data/%u
  ForceCommand internal-sftp
Match Group sftpusers LocalPort 22
  DenyGroups sftpusers
Match LocalPort 2299  Group *,!sftpusers
  DenyUsers *

I want port 22 functioning as ssh typically does, but only for non-sftp users. For sftp users, in group "sftpusers", I want port 2299 to function as sftp only, and not ssh. For non-sftpusers, I want access to port 2299 denied.

Ok, so, I created a user "user1" with home directory /sftp-data/user1 and shell /sbin/nologin. I created /sftp-data/user1/.ssh/authorized_keys and populated that with the public ssh key. /sftp-data is owned by root with 700 permissions. /sftp-data/user1/.ssh and below are owned by user1, and /sftp-data/user1/.ssh/authorized_keys has permission 600. The ownership/permissions of /sftp-data/user1 are under question here. More below.

I created the user group sftpusers and added user1 to that group. The built-in ec2-user you get with AWS is not a member of that group, however. Testing with ec2-user worked great: access via ssh, port 22 worked as it always does, but no access to port 2299.

So, testing with user1 is where it got interesting. User1 has no access to port 22 - that's great! With user1 owning /sftp-data/user1, the ssh public key authentication succeeds on port 2299, but the user is immediately logged out, with this message saved in /var/log/secure:

Sep  2 19:21:38 ip-192-168-0-25 sshd[10369]: Accepted publickey for user1 from <ip-address redacted> port 61110 ssh2: ECDSA SHA256:<sha redacted>
Sep  2 19:13:23 ip-192-168-0-25 sshd[9803]: pam_unix(sshd:session): session opened for user user1 by (uid=0)
Sep  2 19:13:23 ip-192-168-0-25 sshd[9803]: fatal: bad ownership or modes for chroot directory "/sftp-data/user1" [postauth]
Sep  2 19:13:23 ip-192-168-0-25 sshd[9803]: pam_unix(sshd:session): session closed for user user1

Sure, that makes sense. Chroot requires /sftp-data/user1 to be owned by root, permissions 700. So, make that so, and now the sftp (ssh key) authentication fails.

Sep  2 19:41:00 ip-192-168-0-25 sshd[11693]: error: AuthorizedKeysCommand /opt/aws/bin/eic_run_authorized_keys user1 SHA256:<sha redacted> failed, status 22

BTW, eic_run_authorized_keys is a wrapper AWS puts around standard ssh authentication to enable AWS Instance Connect.

For extra credit... if the above problem is not challenging enough, can you come up with a scheme where I can give particular sftp users access to particular project directories, and only those, without creating a group for every project? Link from each user's home directory to a project directory would be awesome.

Additional info requested by @anx:

# getent passwd user1
user1:x:1001:1001::/sftp-data/user1:/sbin/nologin
# namei -l /sftp-data/user1/.ssh/authorized_keys
f: /sftp-data/user1/.ssh/authorized_keys
dr-xr-xr-x root  root      /
drwxr-xr-x root  root      sftp-data
drwx------ root  root      user1
drwx------ user1 sftpusers .ssh
-rw------- user1 sftpusers authorized_keys

I turned on DEBUG logging for sshd. Using the ChrootDirectory directive, with /sftp-data/user1 owned by root, and SSH authentication failing, I see this in /var/log/secure:

debug1: Could not open authorized keys '/sftp-data/user1/.ssh/authorized_keys': Permission denied

ps clearly shows me that root is running the sshd process.

I'm running on Ubuntu 20.04 on Circle CI "machine" executor. Today I see that:

sudo apt-get install -y pkg1 pkg2

is throwing this warning:

W: --force-yes is deprecated, use one of the options starting with --allow instead

I'm not using "--force-yes". Where is this coming from? Even

sudo apt-get update

throws the same warning.

Any way to do this in Console? If not Console, is there an API/SDK option?

We have GKE containers emitting log messages via stdout to the console and they are being forwarded to the standard GCP logging platform. However, somehow the messages get an ERROR severity attached. The messages have a JSON payload, which has INFO level in it. I am wondering where this severity is coming from, and how I can change it. Here is an example:

Google Cloud Scheduler can be used to hit the http endpoint associated with a Google Cloud Function, so that you can run your function off a timer/scheduler. Cloud Functions have two options for their exposure: (1) Allow all traffic or (2) Allow internal traffic only (Only traffic from within the same project or VPC SC perimiter allowed). I'd like to do the latter, but the scheduler fails to access it with an HTTP 403.

With being open to all traffic, then it just remains for someone to guess my URL and they can trigger it as much as they wish. Now, of course, I can put authentication into my function and have Scheduler pass an appropriate header, but my function is not dangerous for someone else to trigger. However, if someone else can trigger it, they can call it as much as they want, and even with authentication, it will still incur charges for all those invocations. I want to ensure no one else besides Scheduler (ideally) can even reach the URL, so it is not triggered except on my schedule. Is there some way to make this possible?

I will freely admit that I am a newbie to GCP App Engine. I am the inheritor of a complex configuration that seems to have grown organically with multiple chefs and no code to back it up and documentation? Hah! So, I am looking at a list of Custom domain names (App Engine -> Settings -> Custom domains) that are CNAMES with aliases that are similar to the Services in App Engine, except periods in the aliases seemingly translate to dashes in the services. When viewing the services I see many have Dispatch routes. There is no dispatch.yml file I have, however. I am trying to determine the connections here between the dots. So:

1) Do the periods get automatically mapped to dashes? 2) If the above is "no", then is there some other mapping of custom domain names to services? 3) How can I find the source of the Dispatch routes?

I have a (modified) configuration looking like this:

When I try to commit, however, I get an error message: "Configuration error: "OUR-SERVERS" is not a valid IP range. I really want to have individual (/32) addresses in the group that the rule references. How can I do that?

Just pulled down the ISO for the latest stable vyos today, 1.1.8, and ran on my Mac under VirtualBox. It emits this message about every 5 minutes:

INIT: Id "TO" respawning too fast: disabled for 5 minutes

What is that about?

I am one short step away from being able to replace numerous customized Jenkinsfiles with one. All I need to get is the directory containing the Jenkinsfile under execution. I am using the Declarative pipeline syntax.

I looked at several ideas in groovy code, but could not find how to obtain this.

For those that need to see something specific, a Jenkinsfile looks like this at the top:

#!/usr/bin/env groovy
pipeline {
  agent any
  environment {
    tf='/var/lib/jenkins/tools/terraform0108/terraform'
    dir='clients/xyz/us-east-1/dev'
}

That variable dir is assigned to the location of that Jenkinsfile. dir is accessed later in the groovy code. I want to be able to omit that assignment and just pick up that directory from context of the executing script.

I tried several different things like steps containing

script {
    println __FILE__
}

and

script { 
    scriptDir = new File(getClass().protectionDomain.codeSource.location.path).parent
    println scriptDir
}

Neither of which ran (gave non-existent variable in FILE case and permission violation in the second case). I tried "${FILE}" and other variants.

I need to use the directory in a steps -- sh block so I believe it needs to be in an environment item.

Now, the Jenkins job configuration gives the path to the Jenkins file, but I don't want to have to repeat that to create another environment variable at that level.

Already consulted:

• Get absolute path of the script directory that is being processed by Job DSL
• Get absolute path to workspace directory in Jenkins Pipeline plugin
• How can I reference the Jenkinsfile directory, with Pipeline?
• as well as many more Google hits and other sites.

Help is appreciated.

I have two different examples of where Apache Httpd 2.4 on Centos7 is configured to perform redirects with the R=301 flag, but they are actually returning 302 redirects. One is an extremely simple case, just redirecting http to https. Here is the extent of the rewrite rules:

<VirtualHost ...>
  ... other content ...
  RewriteEngine On
  RewriteCond %{HTTP_HOST} ^example\.com$ [NC]
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^/(.*)$ https://%{HTTP_HOST}/$1 [NC,R=301,L]
</VirtualHost>

Why is this returning a 302 redirect instead of 301?

# apachectl -S
VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
*:80                   example.com (/etc/httpd/sites- 
enabled/example.com.conf:5)
*:443                  example.com (/etc/httpd/sites- 
enabled/example.com.conf:23)
Syntax OK

On a Mac, High Sierra 10.13.5, I'm seeing a difference in TLS certification validation. Chrome and Safari are happy with TLS validation when visiting https://www.visitflorida.com. Also, curl has no complaints and I am NOT using '-k'. However, openssl complains that it cannot find the intermediate certificate when trying this openssl s_client -connect www.visitflorida.com:443 < /dev/null | openssl x509 -subject -noout. I have used both the base openssl and brew-installed one.

I have tried to add in -CAfile intermediate.pem (where I downloaded the intermediate certificate from TrustWave). Even though the intermediate certificate does not appear anywhere in my KeyChain, I have exported my KeyChain System Roots into a single file and tried that via -CAfile also. Nothing is working. The only filesystem location I see certificates is /etc/ssl/cert.pem and when I specify that via -CAfile, it still fails.

Someone has suggested that my browsers and curl have a looser requirement for TLS validation than openssl. Is that really the case? I have a hard time believing it. Can anyone help me explain this behavior?

BTW, I know this can be resolved by including the intermediate certificate with the endpoint certificate on the TLS endpoint for www.visitflorida.com. Now if we could just find that missing key file!

Browser happiness:

Curl log:

RE: https://docs.chef.io/knife_deps.html

With the knife deps --remote option, I can query our chef server. knife cookbook list -a will return all the cookbook versions. How can I use knife deps to query the dependencies of a particular version of a cookbook? I tried all sorts of delimiters to append the version number to the cookbook name and I have tried them as separate arguments. Tried to dig into the ruby code and found that is difficult to do - the purpose and organization of all those gems is very unclear.

I have the context of a task right before me: I want to create a Scheduled Task on WinServer2012 which is triggered by events generated from a file's lastwrite date changing.

I've got Powershell code in my hands (thanks to https://gallery.technet.microsoft.com/scriptcenter/Powershell-FileSystemWatche-dfd7084b ) which monitors for such events and calls-back a specific action, e.g.:

$folder = 'c:\temp' # Enter the root path you want to monitor. 
$filter = 'test.txt'  # You can enter a wildcard filter here. 
$fsw = New-Object IO.FileSystemWatcher $folder, $filter -Property  @{IncludeSubdirectories = $false;NotifyFilter = [IO.NotifyFilters]'FileName, LastWrite'} 

Register-ObjectEvent $fsw Changed -SourceIdentifier FileChanged -Action { 
  $name = $Event.SourceEventArgs.Name 
  $changeType = $Event.SourceEventArgs.ChangeType 
  $timeStamp = $Event.TimeGenerated 
  Write-Host "The file '$name' was $changeType at $timeStamp" -fore white 
}

It seems this code creates a mechanism for producing such events and also registers a callback for responding to such events. Is that a correct understanding? Or are the events produced regardless? When I review the documentation for the FileSystemWatcher class, https://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher(v=vs.110).aspx , it appears that file change notifications are present without an instantiation of this class. Are notifications different from events? That class documentation says it monitors notifications and raises events. So that suggests the events are not present unless this class is instantiated. And it suggests that notifications are different from events.

In the Task Scheduler utility, I can create a task which is triggered on events and I can use the 3 fields: Log, Source and Event ID to indentify which event I want to trigger on. Perusing the Log choices, I see some resemblance to the variations of event logs available in the Event Viewer utility. Is it the case that all events are, by definition, sent to a particular log?

How would I determine what the different Log, Source and Event IDs that are available and to what they refer? Any documentation?

Is there a connection between the Powershell code and what I could configured for a trigger in Task Scheduler? Perhaps the trigger could not be made so specific as to monitor a single file for a LastWrite change and the task would be called too frequently on all sorts of file system events. It may be the best solution to the task I have at hand is to run the powershell code at boot up, however, I really am seeking a deeper understanding of how events work.

Thanks for your help.

Background We run a series of CentOS 6.5 servers which each host multiple users (~100s) coming in via X-Window XDMP from their MS Windows desktops. These users don't need the host of default applications that get launched, like pulse, volume-control, vino, polkit, etc. So we want to customize the default set of applications launched. However, we do routine yum updates on these machines and do not want our customization overwritten. Yum/rpm includes some provisions for preserving changes to designated configuration files.

Question We can customize the set of applications launched by either 1) deleting or 2) inserting the line "Hidden=true" into the appropriate .desktop files in /etc/xdg/autostart/, however, several of these .desktop files are not specified as configuration files in the RPM packages that install them (e.g. gnome-media, polkit-gnome, policycoreutils, vino). This means these files might be overwritten by a yum update operation should the package be updated.

Proposed Solution (1) Brute force: write an after-yum-update script which goes and redoes the changes we made. Either manually run this or perhaps yum can be customized to run it automatically.

Proposed Solution (2) Subtle but dicey: create our own custom RPM package which installs the files with changes. Then force this RPM to be installed. Future RPM updates that want to change the files will then halt because of the conflict. This will interrupt the routine yum update and we would follow a manual procedure to preserve/restore the customization.

Alternative solutions, thoughts and critiques are most welcome! Thanks.