Archive for January, 2006

Limit display other user’s processes

Wednesday, January 25th, 2006

One of the security enhancements that Solaris 10 provides is the ability to restrict the output of the ps command so that users can only see processes that they own.

So to globally control if users are able to watch processes belonging to other users edit the /etc/security/policy.conf file and add the following entry:

PRIV_DEFAULT=basic,!proc_info

Now users will only be able to see processes that they own. Note however, that this obviously will not affect the root user.

If you are interested in Solaris privileges, you’ll find a good intro from Casper Dik’s Weblog.

DNS cache with DJBDNS for Debian

Sunday, January 8th, 2006

In order to inaugurate this new Debian section here we go with an easy and quick way to setup your own DNS cache. So let’s go!

A DNS caching resolver performs the function of caching answers to previous queries so that there is no need to repeatedly query for the same information. Setting up such a thing with djbdns is a trivial task. Proceed as follows:

NOTE: This instructions assume Debian Sarge but I guess this is not much different with other Debians.

apt-get install daemontools-installer djbdns-installer ucspi-tcp-src

Then build the packages following the instructions provided by APT (build-daemontool, build-djbdns, etc…).

Once installed proceed with the configuration:

dnscache-conf dnscache dnslog /etc/dnscache
ln -s /etc/dnscache /service
sleep 5
svstat /service/dnscache

Now edit your resolver configuration file to look like this:

nameserver 127.0.0.1

I have had some problems with the init script that Debian Sarge installed (note that I’ve created the files in /etc/dnscache), so I modified a couple of lines and now looks like this:

…..
start)
echo -n “Starting djbdns: ”
#for i in `ls -d /var/lib/svscan/dnscache* /var/lib/svscan/tinydns* /var/lib/svscan/axfrdns* 2>/dev/null`; do
for i in `ls -d /service/dnscache* 2>/dev/null`; do
…..
stop)
echo -n “Stopping djbdns: ”
#for i in `ls -d /var/lib/svscan/dnscache* /var/lib/svscan/tinydns* /var/lib/svscan/axfrdns* 2>/dev/null`; do
for i in `ls -d /service/dnscache* 2>/dev/null`; do
…..

That’s all folks!

References: