[Slackbuilds-users] HAR and ntpd, named and libcap-ng

[Menno Duursma]

Hello list readers,

About a talk at HAR2009, of which the outline can be found here:
http://druiloor.punt.nl/?id=469116

(Sunny wether: didn't go to well, shit happens, yada yada yada).

Anyways besides my own stuff i used ntpd and named as examples. Of which
the first can be linked against libcap, as described by slackamp here:
http://www.linuxquestions.org/questions/slackware-14/run-ntpd-as-non-root-617019/

(Or last i tried, at least).

BIND named can be started with '-u <user>' as described in its rc file.
One thing not to overlook might be group access to /etc/rndc.key there.

Otherwise chroot them . Or maybe wrap 'm. PAM and redesign roots access
rights, whatever. Unless u trust those daemons to never have a 0-day.

One thing libcap-ng can be used for is to easily check for cap-bits set
on running processes (a build-script for that package is attached).

Looking up the filesystem bits maybe a bit harder, cfengine/puppet/etc
should be able to support it (probably with external scripts currently).

Besides libcap-ng, some interesting stuff is available here:
http://www.friedhoff.org/downloads.html

(Note capable_probe.tar.bz2 needs kernel probes enabled).

Hope this helps, take care,
-Menno.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: libcap-ng.tar.gz
Type: application/octet-stream
Size: 1842 bytes
Desc: 
URL: <http://lists.slackbuilds.org/pipermail/slackbuilds-users/attachments/20090820/546783d2/attachment.obj>