What's New in TITAN 3.1

 

Many of you have asked for a "changes document" to see if its worth loading newer versions of Titan . Also so your local diffs can be incorporated better.  Well here it is!

Authors note: If you make local changes to Titan, think about sending them to us for incorporating into the next release!
Titan isn't a commercial product, and we are happy to incorporate changes, as long as you don't want to get paid for the
contributions, except maybe in beer.  -bpowell

3.1

Additions:

Added in a new module: rmmount.sh. This module is not needed if you disable vold, but on desktop systems where vold is allowed to run, this module stops CD's and Floppy Disks from being able to be mounted with suid binaries on them; e.g., if I have physical access to your system and can place  a floppy disk into the disk drive and that floppy contains a copy of some shell mode 4755 owned by "root"; then get vold to mount the disk for me; viola
I'm root on the local system. This new module stops vold from allowing this.

Added in a new C source code "runas.c" This is a simple mechanism that allows you to wrapper daemons to run as a different uid than root.
its the moral equivalent of doing a "su daemon -c /usr/lib/nfs/statd" thus starting the statd as user daemon. The difference is that using "su"
to start a daemon means that "daemon'" must have a valid shell in /etc/passwd. We try to limit system utilities use of the shell because of
rhosts, hosts.equiv, .shosts, as well as suid binaries and buffer overflows. Additionally  "runas" checks that it was executed as root, strips off any
environment settings, changes the uid, and executes the command. We tried to keep things as clean and simple. as possible.

A few assumptions need to be stated for use of runas:
 


    Note- starting daemons such as http in a chrooted environment and under a separate uid is preferable. Do that whenever possible. See Wietse's chrootid.c for details.

Example runas use:

                         Change /etc/rc2.d/S73nfs.client
                                FROM
                                                /usr/lib/nfs/statd > /dev/console 2>&1
                                TO
                                                /sbin/runas 3  100 /usr/lib/nfs/statd > /dev/console 2>&1

This would start up statd as user ID "3" (daemon) and group ID "100"

Fixes in 3.1:

1) Documentation fixes. Replaces grammatical errors
2) Bug fixes: minor clean up in a few scripts so that reporting was consistent.
 

3.0.6 changes: 3.0.6 was mainly a bug fix release, and the scheduled monthly update. Very little functionality changes.
Fixes:
 1) The disable_ip_holes was modified because Sun changed the syntax and added  in a variable "$forwarding" in /etc/rc2.d/S69inet which wasn't a "0" or a  "1" which Titan was expecting; thus it broke the titan script.
        Now Titan uses ndd to check things; this makes it work with all solaris releases and it becomes more generic in nature. It also means we can change the setting without a reboot required.
        2) Some changes to the sample.config scripts were made to make them more readable and to reference the new 3.0.5 modules.
        3) some other minor bug fixes.
 

 
 
 
 
 

3.0.5

        1) Additions :
            New modules Solaris 2.X:

                    aset.sh, bsm.sh, telnet-banner.sh   contributed by <jason.rhoads@sabernet.net>
                    see the standard documentation for details.

                    enhancement - userumask.sh now allows you to set the UMASK variable in a single location
                                                in the script. So you can set whatever umask your local security policy dictates.
 
 
 

    2) Bug Fixes:


            Solaris 2.X:

                                Bug Fix - disable-L1-A.sh.  modified the write/quit in the ed portion of the Fix()
                                                                                Also now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  fix-modes.sh now does a $MODES after doing the "$MODES -f " so that the
                                                    /var/sadm/contents file get written properly

                                Bug Fix - smtpbanner-8.8.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix - snmpdx-2.6.sh. now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix - dmi-2.6.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  disable-core.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  pam-rhosts-2.6.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  smtpbanner-8.8.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  snmpdx-2.6.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  fix-stack.sol2.6.sh now recognized Solaris 7 (actually uname -r calls it 5.7)
 
 
 

            Solaris 4.X:

                Cleaned up the output so that it doesn't report "Check #6" and such.

                Note: There are a lot of Solaris 4.1.X modules that I identified as being needed, but since
                          Solaris 4.1.X isn't going to be Y2K certified, I haven't written them. If there is anyone
                          using Solaris 4.1.X that really wants the changes, I'll incorporate them - bpowell