There was a big security dump on OS X a bit ago, but that got picked up enough I didn't really worry about it. This one is a little odder, Secunia is reporting that mRouter, via iSync, has a buffer overflow:
The vulnerability is caused due to a boundary error in the handling of the "-v" and "-a" command line options. This can be exploited to cause a buffer overflow by supplying an overly long argument (over 4096 bytes). Successful exploitation allows execution of arbitrary code with the privileges of the mRouter application.
Mac OS 10.3.7 and under are affected, but remember that while this isn't good it's a local attack and not remote. I.E., the evildoer would need access to your system in some way. Either by sitting at the keyboard, or through a piece of malware or something else in that vein. This is the type of thing someone exploits to completely own your box once they've gotten onto your system another way.
No patch from Apple (yet) and possibly won't be for older systems, but there is a fix...
posted on January 27, 2005 at 08:37 AMI mentioned some of the growing pains the other 'nixes are going through in terms of SMP support, and it's worth noting that Linux, the BSDs and Windows aren't alone in this. OS X is still just hitting its adolescence in terms of SMP and will hopefully be taking its own little step further into adulthood with 10.4. This might seem a little weird, as everyone has heard that OS X on a dually kicks much more ass over a single CPU.
I was reading through an Oreilly interview on the improved multiprocessing in FreeBSD, and and it sparked the memory of a conversation I had several days ago where I said: "I'm interested in Linux, but I love the BSDs".
The person was curious as to why I'd say that, and I actually had to think about it for a few seconds. I dig Linux in general, and use it. There are a whole bunch of places where I'd pick using Linux over a BSD. There just isn't quite that same... affectionate warm spot in my head.
Ah, and an update- I forgot that Apple changed some of the functionality from 10.1 to 10.2... everything that used to be stored in /usr/share/tcsh/ is now stored in /usr/share/tcsh/examples/ which can throw a few people if they haven't done the below commands. This can be a problem if you're trying to follow some of the things I've written...
Copying and pasting the below commands into a new terminal window will allow OSX to recognize the ~/Library/init/tcsh/ folder as well as some other basic aliases and auto-completion functionality.
If you're really curious about what you'll be getting by doing this, you'll want to read the files under "/usr/share/tcsh/examples".
There are two ways to get back that functionality, so I'll list them both here.
To just set it up for one user (ie, you) use the three commands below.
% echo "source /usr/share/tcsh/examples/rc" > ~/.tcshrc
% echo "source /usr/share/tcsh/examples/login" > ~/.login
% echo "source /usr/share/tcsh/examples/logout" > ~/.logout
If you wanted the new functionality to be system-wide (ie, every user gets it), you would use the below three commands:
% sudo echo "source /usr/share/tcsh/examples/rc" >> /etc/csh.cshrc
% sudo echo "source /usr/share/tcsh/examples/login" >> /etc/csh.login
% sudo echo "source /usr/share/tcsh/examples/logout" >> /etc/csh.logout
You'll want to make sure you don't have any .tcshrc, .login or .logout under your home folder (~) if you've implimented the second one.
I had a call from a frantic user today whose sendmail daemon died hardcore. This user has a habit of playig with things first and then getting into trouble when the whole thing breaks- they aren't technically inept, they can follow instructions... and they'll remain nameless as they know who they are, and they owe me some pie now. :)
...but where I'm more of a "Learn everything about what I'm about to do before I do it" they're more of a "Play with it and when it breaks learn from that" type of person.
They weren't really amused by the problem- with sendmail dead on their box, they not only couldn't send mail from their accounts, none of their scripts (for support, sales leads, etc) were outputting either. To say they wanted it up as fast as possible was an understatement, unfortunately they weren't completely sure of what they did to cause the problem, just that they had been trying to edit the sendmail config files for better use of the 5th element for their PHP scripts, which they'd been reading from some site.
If you are playing around with the guts of any OS (linux, bsd, osx, windows, whatever) you need to have wholesale backups. But since people get told that all the time and they still don't do it, at the very least create local backups of the files you change.
Fixing the problem wasn't that hard, but first I needed to know exactly what they'd done to cause the problem: ie, the affected config files. I did this with the history command. It was pretty easy to figure out what they'd done when I saw:
pico /home/virtual/site/fst/etc/mail/sendmail.mc
and
m4 /etc/mail/sendmail.mc > /etc/sendmail.cf
You can look up what the last command does, but suffice to say it did a big nasty. But by knowing what they'd done I was able to replace the various files that were affected. If this person had followed a few rules, it wouldn't have really been an issue. Since I've already gotten mail from some of you trying the commands I've given and botching them, here are a few more unix 101's:
historywho&last- doing basic backups of a file before you modify it.
The history command
Any unix system will log a users actions into a history file, the name of which is different depending on your shell. You can change how much it remembers, or even have it set to nothing at all. You can either view the file directly, or use the following commands (or variants of).
% history
Will show you all of the commands logged into the history file, chronologically and numbered. This is per-user, ie if you are logged in as root it will show the commands executed by root, if you are logged in as an admin it will show those. What it won't do is show commands executed from within a an application. For example, you might see:
890 pico -w /etc/sendmail.mc
But it won't show you what you did to the file while you were editing it within pico. It's very valuable though, as it can show you what files were touched. Other variants that are helpful are:
% history | tail
...which pipes the history output to the tail application and shows you the last 10 commands executed. You can "% man tail" for more info, but the -n modifier is usually the most useful. Ie:
% history | tail -n 20
...will show you the last 20 commands executed by the user.
% history | more
...will display all of the commands stored, but will pipe them to more to only see one screen at a time.
For bash, history files are usually stored as .bash_history within the user home account, for tcsh they are usually stored in .tcsh_history. You want to know this because if you want to know what a user has done, you might do something like:
% pico -w /home/username/.bash_history
...for bash shell users, or:
% pico -w /Users/username/.tcsh_history
...for tcsh shell users.
Who and Last
Very basic. Whenever someone logs into a unix system, it's logged into a file.
% who
...will display who is logged into the system currently.
% last
...will give you a list of who has logged into the system over time, as well as when.
% last | head
...will give you the last 10 users who have logged into the system, you'll see your current session listed as "still logged in".
Beyond the security implications, these are important because if you know about when something when wrong, the above commands can help you figure out who may have done it. In other words, if a site starts going wonky at 2am, you might do:
% last | head -n 30
Where you see that user drunkenbatman was logged into your system at 1:30am and logged off at 2:30am. Chances are they did something you want to check out, so you would:
% pico -w /Users/drunkenbatman/.tcsh_history | head -n 20
...which would give you the last 20 commands that user executed, and can set you on the trail for figuring out what they did.
Doing basic backups of a file before you modify it
This is extremely basic, but it just doesn't occur to some people. If I was going to modify my ~/.bashrc file in order to add aliases, before you do anything you should first do something like:
% cp ~/.bashrc ~/bashrc.bak
...which does nothing more than create a backup of the file in the same directory. You could call it .backup, or .modified, but whatever you do pick something you will stick with every time you do it. For instance, you might want to know exactly what files you have specifically modified, and if you have been good about using the naming convention .bak you could use the command:
% locate .bak
...and the system would return the name and path to every file located on the system with that extension. If you see something like:
/etc/httpd/httpd.conf.bak
...you'll know you have at some point edited Apache's /etc/httpd/httpd.conf.
You have to do something like this if you are going to be playing with a unix's guts. No matter how careful you are, and or how sure you will be wanting to keep the modified file, you need to do it. Another trick is that if multiple users will be doing the above, they can each use a different suffix for their backups.
The sendmail daemon issue I had to fix today on the users machine could have been fixed in less than 5 minutes if they had done the above, instead of having to copy everything over from a virgin machine.
The basic config for tcsh includes auto-completion using the tab key (like using escape for bash), i.e. if from the terminal you type:
% cd ~/Lib <tab>Don't actually type <tab>, hit the tab key on your keyboard. If you hit the tab key with "Lib" spelled, the shell looks under "~/" for anything starting with "Lib" and sees the "Library" directory and fills it in for you. If there is "Library" and "Librato", hitting the tab key twice will show you all the choices.
But if you typed:
% cd ~/lib <tab>
You wouldn't see anything- as while HFS+ is case-insensitive (yet preserves case) the unix tools that ship with OSX are well, from the unix world and assume if you type "lib" that you want "lib" and not "Lib". This can get annoying straight quick for a whole host of reasons, but luckily you can add a directive to the rc.mine file we setup earlier though to enhance the autocompletion.
Type:
% pico -w ~/Library/init/tcsh/rc.mine
And on the second line (under the set prompt line code) cut and paste the below command:
set complete = enhanceCreate a new shell, and type:
% cd ~/lib
And you'll instead of getting nothing now you will automatically get:
% cd ~/Library/
Pretty nifty, eh?
The default prompt for OSX is fine, by and large, it's just a little wordy (partly due to using rendevous conventions for the host name), and I like a little whitespace between prompts to seperate them better as well as moving the current working path onto its own line to minimize wrapping for commands by giving them as much horizontal space as possible.
Click on the picture to the right to see mine, as it's what the instructions below will get you.
This one is pretty easy, from the terminal type:
% pico -w ~/Library/init/tcsh/rc.mine
You'll be greeted with an empty file, and you want to copy and paste the below into it.
set prompt="\n%B[%n]%b @ %B[%~]%b\n %# "
Be careful, there are some important spaces in there. Hit control-x and save it out, and close your Terminal.app window. Create a new terminal window and you should see your new and improved terminal prompt.
Depending on the background color of your terminal window you may want to go into the color preferences and change the color for bold to be something easy on the eyes (you can see mine to the right here).
If you're curious about customizing it more, do "% man tcsh" and down towards the bottom you'll find all sorts of other variables you can use.
Personally I use a black background with a 10% transparency, and a light blue color set as bold... generally the default colors for "ls" and such assume a black background. Plus, Apple's Aqua interface is just so damn bright that having some black thrown in can feel good.
But a nice alternative can be to set your background to a silver or light gray wit black text, I use that every once in awhile when my eyes need a break from the black.
If at any time you want to return your prompt to the way it was, simply move or rename the rc.mine file.
Using aliases in your shell help spare you from typing out frequently used but long commands such as:
% ls -ohS --color=auto
There are a few ways to customize your aliases in MacOS X, but the right way™ is to create a few custom files under:
~/Library/init/tcsh/
Now, in your finder click the home icon, and go to the Library folder, then look for a directory called "init" within it, and within the "init" folder look for one called "tcsh". You need to be looking in your user library, not the OSX library.
You may not have them- if you don't see them, use the following commands:
% mkdir ~/Library/init/
% mkdir ~/Library/init/tcsh/
You're directories are all there, now all you have to do is create the aliases.mine file which tcsh will read upon login, and load up your aliases for use.
% pico -w ~/Library/init/tcsh/aliases.mine
Since the aliases.mine file doesn't exist, you're creating it by using the above command. Now you'll want to copy and paste the below into it:
alias l 'ls -ohU --color=auto'
alias ls 'ls -ohS --color=auto'
alias . 'cd ..'
alias p 'pico -w'
alias t 'top -d'
The syntax for aliases is a little different from linux, where it would normally look something like alias ls="ls -lAo". These are just a few to get you started, you can basically add anything you want in here... it can make you a lot more efficient, especially in used in conjuction with shell scripts.
Hold down the control key and press the "x" key, type yes when prompted to save, then hit return again when it shows you the filename of aliases.mine.
Close the window, create a new one and type the "l" key (l as lucky). You should now see unordered colored output whenever you hit "l", and will move up a directory when you type "." and "top -d" whould run when you type "t".
If you aren't happy with my default aliases, from the terminal type:
% man ls
Look up the options, and add/remove to the aliases.mine file until it feels like a good fit for how you work.
Aliases are just a godsend- especially if you do things like SSH to login to servers remotely fairly frequently, or constantly type the same commands or go to specific directories all the time. Look up how to generate a private key for your server, which will allow you to login without a password. Create an alias called ssh1 or something with the command, and boom you're in.
To see all of your defined aliases while you're working, simpy type:
% alias
Mac OS 10.2 for an unknown reason ships with a version of ls which doesn't support colored output. This isn't a big deal, but having colored output for ls can make it a lot easier to quickly tell different types of files from each other, or directories from files (click the picture to the right to see mine).
Yeah, I know you've seen colored output in your Terminal.app before, in man pages and the like, but that is just basic bolding of text (which you can set a preference for under the Terminal.app's prefs).
To get actual colored output from the ls command, you have to replace the standard ls Apple ships with OSX with a more "robust" version which will return colored output to the shell when you use the ls command.
You'll need to make sure you have the Developer Tools installed from the CD that came with OSX (there should have been 3 CD's) and you're good to go. Remember, follow these instructions exactly and I'm not responsble for typos (or anything else, for that matter).
Open up your terminal, and type:
% mkdir newLSthen
% cd newLS/Cool beans, you've created your working directory so that you aren't making a mess and have changed your path so that you're inside of it.
Now, using your browser right-click (or control-click) on this link and select "copy this url" or "copy this address".
Now in your terminal window again, type:
% curl -O "(paste address here)"That is -O as in "ohboy", not a zero. Paste the url (using paste from the Terminal's menu, or the apple key plus the v key) you copied from your browser in between the quotes (yes, you need the quotes). Hit return.
Curl will go out, get version 4.1 of the gnu file utilities and write it out to a file within the current directory. You'll be treated to some nice download stats... I prefer curl, but wget works fine too if you know it.
Type these commands in order. Remember, a % symbol means you should be doing it on a new line and seeing a prompt.
% tar -xzf fileutils-4.1.tar.gz
% cd fileutils-4.1/
% ./configure
% make
./configure and make might take a few minutes depending on the speed of your computer and disk, but afterwards you'll have an updated, freshly compiled ls waiting for you. The below commands will backup your old ls, rename it to ls.bak and move your fresh ls to where it needs to be.
% sudo mv /bin/ls /bin/ls.bak
% sudo cp src/ls /bin/ls
% rehashThe "% rehash" command refreshes your shell environment, but you might want to create a new terminal window anyways. Do not close the current terminal window though!
Now, when you type the following command you'll see a nice color-coded display of your files:
% ls -ohS --color=autoSince you've replaced the ls that comes with OSX, you're going to want to replace it's man page as the options (such as color) will be different.
% sudo mv /usr/share/man/man1/ls.1 /usr/share/man/man1/ls.1.bak
% sudo cp man/ls.1 /usr/share/man/man1/ls.1
ls was just one utility you compiled, so you might as well get rid of the rest. Use these commands to clean everything up.
% cd ..
% cd ..
% sudo rm -rf newLS/
All the other utilities are now deleted. Obviously you aren't going to want to type something like that out whenever you type want to use the ls command, which brings us to aliases...
There are a few things you can do to make your Terminal.app run sleeker:
- Turn off transparency
- Turn off anti-aliasing
- Login directly
- A more efficient
top - Turn off security server check
- Auto-enable the sudo command
- Login as root
Turning off transparency
The first thing we'll want to do is speed things up in the terminal... one hard and fast rule is that if you aren't using a machine capable of supporting Quartz Extreme, disable all transparency.
The reason for this is that while Quartz makes things beautiful, it can also slow things way, way down especially if you are doing something that updates often, such as running "% top". To save time, basically Quartz Extreme takes the display layer of Mac OS 10.1 which was all software-based and takes one part of the process (compositing) and pipes it through OpenGL which allows it to be hardware accellerated.
For transparency, this creates a dramatic speedup and lowers the CPU load on the computer. If you don't have a machine capable of Quartz Extreme though, using transparency for your terminal windows, while pretty, means the CPU has to calculate the updates you see and that means that every time "% top" updates the screen the CPU has to figure out everything behind the window.
Try it for yourself- if you have a non-QE machine run top with and without transparency enabled and look at the "window server" process within top and see how much of the CPU it uses.
The option for turning this off/on is a sliding scale located under the Terminal.app's menu at:
Window Settings>Color
Turn off anti-aliasing
For the same reasons as above, using anti-aliasing in your terminal fonts can slow things way down if you don't have a Quartz Extreme machine.
Besides, 9 point fonts with anti-aliasing on just look kind of nasty... in actually if you're using something like Monoco as your font, a different Monoco is used if you are using anti-aliasing which is a little goofy. I don't even use Monoco anymore (more on that later) as I've found a few monospaced fonts which i prefer.
The option for turning off/on is under the Terminal.app's menu at:
Window Settings>Display
Think about it: with anti-aliasing on, and no QE, using anti-aliased fonts in a window that updates every 0.5 seconds is going to churn a lot of CPU cycles that can probably be best used elsewhere.
Login Directly
Whenever you open the Terminal.app or create a new window (shell) you see a message giving you your last login, the date, time, and a "Welcome to Darwin" message". FYI, Darwin is the name of Apple's open-source unix operating system that OSX runs on top of.
Depending on the speed of your computer (including cpu, disks, & subsystem) this message can delay you getting to the shell enough that it gets a little annoying.
To get rid of this simply (without changing any files) you simply want to login directly to "/bin/tcsh"instead of going through the normal "/usr/bin/login" app which then drops you to the shell.
To get an idea of what I'm talking about before you change anything, from the terminal menu select:
>File>New Shell
Now, in the same terminal type:
% tcsh
Depending on your machine, not having to look at the welcome messages (and having the shell generate them) can speed things up quite a bit. To change it, from the Terminal.app's menu select "Preferences" and click the radio button that says "Execute this command (specify complete path)" and type in:
/bin/tcsh
Create a new terminal window and it should now drop you directly into your shell with no messages.
A more efficient top
From the terminal, type:
% top
Look at top's CPU usage, which, if you're coming from a Solaris or Linux or freeBSD background will look insanely high. Ie, if you are on a 500MHz G4 it probably averages at around ~10% of your CPU cycles. You'll also see a bunch of memory information, and other things I won't go into now. Type the "q" key, leave that window there and create a new window for the next part.
The reason for top taking up so much more CPU than it normally does on other OS's is that Apple's OSX, while based on freeBSD, actually sort of slaps freeBSD over top of something called "Mach" which is microkernel (not monolithic, like all of the other unix's mentioned above). Microkernel's were all the rage for awhile, but for a lot of pragmatic reasons (mostly speed) there aren't very many "pure microkernels" out there, like GNU/HURD.
OSX isn't any different, and actually has the BSD layer running in the same address space as Mach for performance reasons. Unfortunately traversing the memory tree to display all that memory-related-goodness is a very expensive task (in terms of CPU time) in Mach.
While in many cases you'll want to know the memory information associated with processes, in many others you're mostly just interested in the processes' PID and CPU usage, so we want to cut out the memory information from top.
Use this command:
% top -d
And top should now be using 1/10th or so of the CPU compared to the straight "% top" command which you can see by comparing it to the other window you have open.
Turn off security server check
In 10.2, Apple changes the behavior of the "% sudo" command a bit- in that it makes a connection to the virtual security server process (not the case in 10.1). That connection unfortunately can take awhile, i.e. around 1 second. If you're using sudo a lot though, waiting on it to show you the password prompt can be pretty annoying.
Turning off this check will make using the sudo command an instant affair. This is a little more involved, but pretty easy. Type these commands exactly, and remember don't type the % character, that is your prompt.
% sudo pico -w /etc/pam.d/sudo
Enter your password, and you're not editing the sudo file as the root user. On the second line you will see:
auth sufficient pam_securityserver.so
Use your arrow keys to move the cursor down and add comment it out by adding a pound sign before it, so that it looks like this:
#auth sufficient pam_securityserver.so
Hold down the control key, and then hit the "x" key. When asked to save the unmodified buffer, type "yes" and hit return. It will show you a file name, leave it alone and hit return again.
w00t! Done.
Create a new terminal window and type:
% sudo top
...and the sudo password prompt should be immediate instead of having to wait for it.
This shouldn't hurt anything that I know of- it can cause sudo not to work if you have completely disabled netinfo on your machine for some reason... but no one really does that and I've never seen an OSX box without netinfo on it.
Auto-enable the sudo command
This speeds this up, as instead of having to type your password when you want to use the sudo command, it negates the check and auto-logs you in. Unfortunately, I'm not going to show you how to do it.
You can find info on the web if you're so inclined, however the security risk involved is just too great and there are very few reasons for needing to do it. It's a bad thing™. If you really need it, you should know how to do it. However, there is a time-saver below.
Login as root
While I'm not going to show you the above, often times you need to do successive commands as the root super-user. In OSX, the root user is disabled by default (which is a good thing™), so you generally use "% sudo" before your command (i.e., "% sudo ls") which runs your command as the root user after you give it your password. Very secure, but it makes you re-authenticate after a specific amount of time, which is also a good thing™.
If you have a bunch of successive commands you'll be doing as root, and are getting annoyed by having to re-authenticate, simply login as a pseudo-root shell instead of going through the hassle of actually enabling the root user.
The command you will want to use is:
% sudo -s
Give it your password, and you have a root shell. Note that this is different from Linux shells, where you would normally use:
$ su -
Bash is the default shell for Linux, instead of tcsh, so you see a $ for a prompt instead of %). When you do this, notice that your prompt changes from a % to a # as a reminder that you're root and to be very careful. Although if you didn't know that and you're doing these, I hope you're being very careful.
To leave the root shell, either close the terminal window or type:
# exit
Pretty basic stuff here, but it might help some new users get their bearings if they're used to traditional applications. When you open up the terminal (under /Applications/Utilities/) in OSX, the first thing you see is "Welcome to Darwin" followed by a prompt. The terminal is just a graphical tool to use Shells... in this case, the terminal automatically logs you into the system as the admin user.
Where you see the "%" sign, type "ls" and you will see a listing of files of the directory the shell has automatically logged you into, most usually the "Home" folder of the user you are logged in as (which is shown as a "~"). It's good to bear in mind that when you type "ls" the Terminal.app isn't following your command and showing you the list of files, but rather you are invoking the ls application located at "/bin/ls".
The ls application launches, looks at the directory you, retrieves the list of files and then displays them to the shell, which the Terminal.app then shows to you. This lets you do uber-cool stuff, such as piping commands together. For instance, assuming you haven't changed directories, type this:
% ls | grep "Pictures"
If you compare that to the output you got by using 'ls' the first time, you'll see that you now only see the directory called "Pictures". What you've done is piped (the "|" key) the output from the first application (ls) to the second application (grep) and told grep to find anything that has "Pictures" within it and display it.
Make sense? You aren't controlling the Terminal.app per se, but rather using the Terminal.app to control unix applications which then deliver their output to the terminal, which then shows you the result. Understand will make it a lot easier to wrap your head around using shells and the Terminal.app in the long run.
I've been asked about 5 times this week how I got color in my terminal, as well as my nifty shell prompt... it isn't that big of a deal, you just have to create a custom rc.mine, an aliases.mine and replacing Apple's "ls" with one that supports color. The last is probably the most difficult for those who aren't used to Linux/Bsd/Solaris/OSX.
All this will work fairly easily, with the prerequisite that you're on 10.2 and have the Developer Tools installed which will give you GCC (a cross-platform compiler) and other goodies. You don't need GCC if you will just be customizing your shell prompt or creating aliases, but it's good to have anyways.
This also assumes you are using the OSX/freeBSD default shell, tcsh. If you are using bash, specifics will differ. Bash is generally what you want to use for scripts, but most people will use the default tcsh.
So, to clarify, you need:
- To be using the default shell, tcsh
- Be using Mac OS 10.2
- Have the Apple Developers Tools installed, which comes with OSX on a seperate CD
For future reference, when you see the "%" sign, that stands for the tcsh prompt... don't actually type it.
...has made me it's bitch.
I swear to god, it's hit and run on my machines. I have an iBook that just won't print no matter what I do, and I've tried everything (yes, every tip and trick you can think of more than once) short of Apple's answer of "reinstall and only patch up to 10.2.4" which is something that just isn't going to happen right now, considering I've had to reinstall 10.2.4 on that machine twice.
The powerbook is running fine, but the iBook just has massive issues with sleep, printing, the whole bit. It randomly attracts kernel panics like no ones business.
Just getting kind of sick of it. Right now my firewalled PC has about three times the stability if not more, with the caveat that I don't use it for email... which with the caveat of outlook could hurt things. Sad.
