SUDO CVE-2021-3156 and how to upgrade CentOS 6

January 30, 2021 ServerAdmin 1 Comment

Sudo is a powerful utility built in almost all Linux distributions and we have a bad news for you – a recent privilege escalation vulnerability (CVE-2021-3156) has been discovered.

The vulnerability affects all the following sudo versions:

All legacy versions from 1.8.2 to 1.8.31p2
All stable versions from 1.9.0 to 1.9.5p1

A successful exploitation allows any unprivileged user to escalate its privileges to root on the vulnerable host. Of course, since it’s a privilege escalation vulnerability, it requires access to a local user on the vulnerable host in order to actually exploit it.

To test your host for this vulnerability just execute the next command

sudoedit -s /

In case you receive the next response

usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file ...

your host is safe but in case you receive the something like

sudoedit: /: not a regular file

please upgrade

For CentOS 7 and CentOS 8 this is not a problem (yum -y update sudo) but if you’re using CentOS 6 then there are no way to upgrade from the official mirrors (since CentOS 6 is EOL)

You can download the rpm files from HERE (https://www.sudo.ws/download.html#binary)

Or directly
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_5p2/sudo-1.9.5-3.el6.x86_64.rpm
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_5p2/sudo-logsrvd-1.9.5-3.el6.x86_64.rpm

Then install the rpms with

rpm -U sudo-1.9.5-3.el6.x86_64.rpm
rpm -U sudo-logsrvd-1.9.5-3.el6.x86_64.rpm

Linux, Networks, Red Hat/CentOS, Server project

Time and date on CentOS 7 Howto

July 29, 2019 ServerAdmin Leave a comment

NTP stands for Network Transport Protocol and it is used to keep the time on the servers synced with each other using a common reliable source to get the time.

The example below is for a basic NTP client/server setup.

NTP client

Install NTP with

yum install ntp

Then check timezone with

timedatectl

If you’re not satisfied with your timezone and you wish to change, first list available zones with

timedatectl list-timezones

and set your time zone with command below: (e.g. Berlin)

timedatectl set-timezone Europe/Berlin

Active the NTPD service at boot:

systemctl enable ntpd
systemctl start ntpd

To get a basic report you can use commands ntpstat or date

And to get some information about the time synchronization process

ntpq -p

All of your NTP configurations is available in /etc/ntp.conf file.

To be able to use your server as a NTP server for local network, please be sure you have a line

restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

where 192.168.1.0/24 is a local network you want to sync with your NTP server.

You can get the public NTP servers specific to your region from pool.ntp.org.

PHP

Laravel whoops output – How to hide. env passwords

January 26, 2019 ServerAdmin 3 Comments

As of Laravel 5.5.13, there’s a new feature that allows you to blacklist certain variables in config/app.php under the key debug_blacklist.

When an exception is thrown, whoops will mask these values with asterisks * for each character.

To activate this feature, add the next lines inside config/app.php

...
    'debug_blacklist' => [
        '_ENV' => [
            'APP_KEY',
            'DB_PASSWORD',
            'REDIS_PASSWORD',
            'MAIL_PASSWORD',
            'PUSHER_APP_KEY',
            'PUSHER_APP_SECRET',
        ],
        '_SERVER' => [
            'APP_KEY',
            'DB_PASSWORD',
            'REDIS_PASSWORD',
            'MAIL_PASSWORD',
            'PUSHER_APP_KEY',
            'PUSHER_APP_SECRET',
        ],
        '_POST' => [
            'password',
        ],
    ],
...

Save the file and clear the config cache with

php artisan config:clear

After this, all keys added inside debug_blacklist array will be replaced with asterisks (************)

Hardware

Intel CPUs affected by Spectre & Meltdown

December 1, 2018 ServerAdmin Leave a comment

Intel® Core™ i3 processor (45nm and 32nm)
Intel® Core™ i5 processor (45nm and 32nm)
Intel® Core™ i7 processor (45nm and 32nm)
Intel® Core™ M processor family (45nm and 32nm)
2nd generation Intel® Core™ processors
3rd generation Intel® Core™ processors
4th generation Intel® Core™ processors
5th generation Intel® Core™ processors
6th generation Intel® Core™ processors
7th generation Intel® Core™ processors
8th generation Intel® Core™ processors
Intel® Core™ X-series Processor Family for Intel® X99 platforms
Intel® Core™ X-series Processor Family for Intel® X299 platforms
Intel® Xeon® processor 3400 series
Intel® Xeon® processor 3600 series
Intel® Xeon® processor 5500 series
Intel® Xeon® processor 5600 series
Intel® Xeon® processor 6500 series
Intel® Xeon® processor 7500 series
Intel® Xeon® Processor E3 Family
Intel® Xeon® Processor E3 v2 Family
Intel® Xeon® Processor E3 v3 Family
Intel® Xeon® Processor E3 v4 Family
Intel® Xeon® Processor E3 v5 Family
Intel® Xeon® Processor E3 v6 Family
Intel® Xeon® Processor E5 Family
Intel® Xeon® Processor E5 v2 Family
Intel® Xeon® Processor E5 v3 Family
Intel® Xeon® Processor E5 v4 Family
Intel® Xeon® Processor E7 Family
Intel® Xeon® Processor E7 v2 Family
Intel® Xeon® Processor E7 v3 Family
Intel® Xeon® Processor E7 v4 Family
Intel® Xeon® Processor Scalable Family
Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series
Intel® Atom™ Processor C Series
Intel® Atom™ Processor E Series
Intel® Atom™ Processor A Series
Intel® Atom™ Processor x3 Series
Intel® Atom™ Processor Z Series
Intel® Celeron® Processor J Series
Intel® Celeron® Processor N Series
Intel® Pentium® Processor J Series
Intel® Pentium® Processor N Series

Source: https://www.tweaktown.com

Mint Linux

Skype for Linux 8.13 not working

January 12, 2018 ServerAdmin 3 Comments

The latest Skype for Linux update (8.13.) seems broken on Ubuntu 14.04/Mint Linux 17.x. The application loads but all I can see is the white window with the menu.

During load, I see the application screen for a second before the center of the application window turns white again. Reinstall process didn’t help

Since official fix doesn’t exist (for now), the only solution is to remove the latest version and install the older one

sudo apt-get remove skypeforlinux
sudo apt-get install skypeforlinux=8.11.0.4

optionally you can “lock” Skype so it won’t ask for update (at least until they fix this problem)

sudo apt-mark hold skypeforlinux

Hardware, Linux

Librem 5 – A Security and Privacy Focused Phone

September 30, 2017 ServerAdmin Leave a comment

The idea to build and use the phone OS which doesn’t rely on Apple or Google is quite old. Since the Ubuntu Edge project, there have been several attempts, but nothing which can even scratch those two giants.

The new attempt is here – The Purism project, which is seeking funds right now (link here). The idea is to build a true Linux powered smartphone that focuses on security by design and privacy protection by default.

The device will ship with GNOME Shell UI or KDE Plasma Mobile UI by default. Also, through various partnerships and development efforts in the community, the users will be able to replace it with other UIs!

Once again, here is the LINK. Pledges starts from $20 so you can support it if you like.

Tips & Tricks

There is no suitable CSPRNG installed on your system

March 3, 2017 ServerAdmin Leave a comment

Some PHP packages may stop working after update with error message: “There is no suitable CSPRNG installed on your system”.

The reason for this that they stopped using OpenSSL and now they need access to /dev/urandom which isn’t readable by your PHP configuration.

To fix this problem, all you need to do is to add /dev/urandom to your open_base configuration which limits the files that can be accessed by PHP to the specified directory-tree (or trees).

In case you’re using php-fpm, add the “/dev/urandom” in existing php_admin_value[open_basedir] definition (or add this line if it doesn’t exist)

For example:

php_admin_value[open_basedir] = /var/www/html/domain.tld:/usr/share/php5:/usr/share/php:/tmp:/usr/share/phpmyadmin:/etc/phpmyadmin:/var/lib/phpmyadmin:/dev/random:/dev/urandom

or if you’re using mod_fcgi, inside .php-fcgi-starter script add parameter

-d open_basedir="/var/www/html/domain.tld:....:/dev/urandom"

Tips & Tricks

CentOS 6.x boot GRUB on software RAID /dev/md0

February 28, 2017 ServerAdmin Leave a comment

If you’ve just installed CentOS 6.x on software RAID and it won’t boot from /dev/md0, don’t worry. It can be fixed.

– Insert CentOS media/DVD and boot in rescue mode (select “Rescue mode” during boot)
– Select the “start shell” option
– chroot with

chroot /mnt/sysimage

– install GRUB into /dev/md0 with

grub-install /dev/md0

– enter exit and than reboot

The other option is to enter into rescue mode and inside grub shell type the next commands:

grub> device (hd0) /dev/sda
grub> device (hd1) /dev/sdb
grub> root (hd0,0)
grub> setup (hd0)
grub> root (hd1,0)
grub> setup (hd1)
grub> quit

Java, Mint Linux, Programming

Oracle Java 8 on Ubuntu 14.04 / Mint 17.3

January 6, 2017 ServerAdmin Leave a comment

Default “Java” version of Mint Linux 17.3 (or Ubuntu 14.04) is OpenJDK 1.7 which works fine, but some SDKs won’t install until you upgrade to 1.8 (for example Tizen IDE studio complains on OpenJDK 1.7)

Before you start, check the current version with “java -version”

java version "1.7.0_121"
OpenJDK Runtime Environment (IcedTea 2.6.8) (7u121-2.6.8-1ubuntu0.14.04.1)
OpenJDK 64-Bit Server VM (build 24.121-b00, mixed mode)

Add the PPA, update and install oracle-java8-installer

sudo apt-add-repository ppa:webupd8team/java
sudo apt-get update
sudo apt-get install oracle-java8-installer

(During the install process you’ll need to accept the Oracle terms)

Now, check again with “java -version”

java version "1.8.0_111"
Java(TM) SE Runtime Environment (build 1.8.0_111-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.111-b14, mixed mode)

In case you’re still receiving the 1.7 versions as response, install “oracle-java8-set-default” package with

sudo apt install oracle-java8-set-default

and check again.

PostgreSQL, Red Hat/CentOS, Server project

PostgreSQL on CentOS 7 – Howto

December 24, 2016 ServerAdmin Leave a comment

In this post I’ll try to show you how to install PostgreSQL 9.6 on CentOS 7.3 which is the current versions of PostgreSQL and CentOS.

The default PostgreSQL version on CentOS 7.3 is PostgreSQL 9.2 which is still maintained, but in case you’re more for a “cutting edge” technology, try to follow the next steps

First, remove the already installed version (in case you installed the default version)

yum remove postgresql-server postgresql-contrib

Install official PostgreSQL Yum repo with

yum -y install https://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-7-x86_64/pgdg-centos96-9.6-3.noarch.rpm

which will create a new repo file /etc/yum.repos.d/pgdg-96-centos.repo with the next content

[pgdg96]
name=PostgreSQL 9.6 $releasever - $basearch
baseurl=https://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-$releasever-$basearch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-96
 
[pgdg96-source]
name=PostgreSQL 9.6 $releasever - $basearch - Source
failovermethod=priority
baseurl=https://download.postgresql.org/pub/repos/yum/srpms/9.6/redhat/rhel-$releasever-$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-96
 
[pgdg96-updates-testing]
name=PostgreSQL 9.6 $releasever - $basearch
baseurl=https://download.postgresql.org/pub/repos/yum/testing/9.6/redhat/rhel-$releasever-$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-96
 
[pgdg96-source-updates-testing]
name=PostgreSQL 9.6 $releasever - $basearch - Source
failovermethod=priority
baseurl=https://download.postgresql.org/pub/repos/yum/srpms/testing/9.6/redhat/rhel-$releasever-$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-96

Now install PostgreSQL with

yum -y groupinstall "PostgreSQL Database Server 9.6 PGDG"

and initialize it with

/usr/pgsql-9.6/bin/postgresql96-setup initdb

Start and enable service with

systemctl start postgresql-9.6.service
systemctl enable postgresql-9.6.service

Switch to the postgres user with

su postgres -

and connect to the server (currently running only on localhost)

psql

Check the installed version with

SELECT version();

You should get something like

...
                                                 version                                                 
---------------------------------------------------------------------------------------------------------
 PostgreSQL 9.6.1 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-4), 64-bit
(1 row)
....

The default PostgreSQL installation listens only on localhost so if you want to connect from the remote host you’ll need to change a few things.

Open /var/lib/pgsql/9.6/data/postgresql.conf and find the line #listen_addresses = ‘localhost’… and replace it with the listen_addresses = ‘*’

Before

#------------------------------------------------------------------------------
# CONNECTIONS AND AUTHENTICATION
#------------------------------------------------------------------------------
 
# - Connection Settings -
 
#listen_addresses = 'localhost'         # what IP address(es) to listen on;
                                        # comma-separated list of addresses;
                                        # defaults to 'localhost'; use '*' for all
                                        # (change requires restart)
#port = 5432                            # (change requires restart)
max_connections = 100                   # (change requires restart)

after

#------------------------------------------------------------------------------
# CONNECTIONS AND AUTHENTICATION
#------------------------------------------------------------------------------
 
# - Connection Settings -
 
#listen_addresses = 'localhost'         # what IP address(es) to listen on;
listen_addresses = '*'
                                        # comma-separated list of addresses;
                                        # defaults to 'localhost'; use '*' for all
                                        # (change requires restart)
#port = 5432                            # (change requires restart)
max_connections = 100                   # (change requires restart)

Now open /var/lib/pgsql/9.6/data/pg_hba.conf and add at the end

host    all             all             YOUR_CLIENT_IP_ADDRESS/32            md5

save the file and restart service with

systemctl restart postgresql-9.6.service

The last step before you test it is to change the password for postgres user with

su postgres -
 
bash-4.2$ psql
psql (9.6.1)
Type "help" for help.
 
postgres=# \password
Enter new password:
Enter it again:
postgres=# \q
exit

Now add new server in pgAdmin and test it

ServerAdminBlog