ja mam to tak
w sekcji GLOBAL

security = user
encrypt passwords = yes
passwd chat = "*New password:*" %n "Re-enter new password:*" %n
"*Password changed.*"
passwd program = /usr/bin/passwd %u

a pozniej

[netlogon]
comment = "Usluga logowania"
path = /home/samba/netlogon
public = no
writable = no
browsable = no

[public]
comment = "Katalog publiczny"
path = /home/samba/public
guest ok = yes
public = yes
writable = yes
create mode = 0777
printable = no

[homes]
comment = "Katalog domowy"
path = /home/users/%u
guest ok = no
read only = no
create mode = 644
writable = yes
browsable = no

"Marcin Miklaszewski" <marm@kki.net.plwrote in message



Problem wygląda tak :
mam 2 udziały - tmp - publiczny, wszyscy mogą kasować i zapisywać
i drugi - strona_www - który to udział ma być widoczny tylko dla danego
usera i ma być jego stroną www.

Przy ustawieniu security = share - 1 działa a na drugie nie można się w
żaden sposób zalogować (w 2000 podaję i nazwę użytkownika i hasło i nic).
security = user - nic nie działa,

Czytam tego manuala i czytam i nic nie mogę wykombinować, klienci to
win95,
98,Me i 2000.
Próbowałem dopisywać user = %u (%U, lista użytkowników), valid users = %u
(%U, lista użytkowników) , w path też %U.
Próbowałem udostępnić wszystkim /home/www - działa, można oglądać pliki,
ale
niczego nie mogę zmienić. Zawsze loguje mi się jako user nobody i koniec.
Próbowałem tworzyć, i zmieniać hasła w smbpasswd i edytować smbusers.
Ustawiałem w windowsie takie samo hasło i użytkownika jak w linuksie,
włączałem i wyłączałem "unix password sync". POMOCY !

Podejrzewam, że sam już do tego nie dojdę - nawet jak to jakaś pierdółka
Marcin

samba-2.0.7, RH6.0 połatany RPMami z 6.2, 7.0, 7.1 kernel 2.2.16
[global]
client code page = 852
character set = ISO8859-2
debug level = 3
workgroup = inet
hosts allow = 192.168.0. localhost
log file = /var/log/samba/log.%m
max log size = 50
security = share
password level = 8
username level = 8
;smb passwd file = /etc/smbpasswd
unix password sync = Yes
os level = 33
domain master = yes
preferred master = yes
wins support = yes
dns proxy = no
preserve case = no
short preserve case = no
case sensitive = no
[tmp]
   comment = Tmp
   path = /tmp/inet
   read only = no
   public = yes
[strona_www]
   comment = Strona WWW
   path = /home/www/%u
   public = no
   writable = yes
   browseable = yes

| samba-2.0.7, RH6.0 połatany RPMami z 6.2, 7.0, 7.1 kernel 2.2.16
| [global]
| client code page = 852
| character set = ISO8859-2
| debug level = 3
| workgroup = inet
| hosts allow = 192.168.0. localhost
| log file = /var/log/samba/log.%m
| max log size = 50
| security = share
| password level = 8
| username level = 8
| ;smb passwd file = /etc/smbpasswd
| unix password sync = Yes
| os level = 33
| domain master = yes
| preferred master = yes
| wins support = yes
| dns proxy = no
| preserve case = no
| short preserve case = no
| case sensitive = no
| [tmp]
|    comment = Tmp
|    path = /tmp/inet
|    read only = no
|    public = yes
| [strona_www]
|    comment = Strona WWW
|    path = /home/www/%u
|    public = no
|    writable = yes
|    browseable = yes

Dostaje w logach smdb:

[2004/03/02 11:31:15, 0] smbd/server.c:main(791)
  smbd version 2.2.8a started.
  Copyright Andrew Tridgell and the Samba Team 1992-2002
[2004/03/02 11:31:15, 0] lib/util_sock.c:open_socket_in(804)
  bind failed on port 139 socket_addr = 10.1.1.1.
  Error = Address already in use

W logach nmdb:

[2004/03/02 10:54:01, 0] lib/pidfile.c:pidfile_create(86)
  ERROR: nmbd is already running. File /var/run/samba/nmbd.pid exists and
process id 6141 is running.
[2004/03/02 10:54:01, 0] nmbd/nmbd.c:main(795)
  Netbios nameserver version 2.2.8a started.
  Copyright Andrew Tridgell and the Samba Team 1994-2002
[2004/03/02 10:54:01, 0] lib/pidfile.c:pidfile_create(86)
  ERROR: nmbd is already running. File /var/run/samba/nmbd.pid exists and
process id 6141 is running.

Zawartosc pliku smb.conf:
# Plik konfiguracyjny Samba
# /etc/samba/smb.conf
# Global Settings :

[global]

    security = SHARE
    server string = My serwer
    interfaces = eth1
    bind interfaces only = Yes
    netbios name = Server
    workgroup = IPMASTERS
    server string = Najwazniejsza rzecz w firmie :) (poza prezesem i pensja)
    announce as = NT
    announce version = 4.2
    client code page = 852
    character set = ISO8859-2
    unix password sync = yes
    name resolve order = bcast lmhosts host wins
    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192  
    os level = 60
    local master = Yes
    guest account = nobody
    create mask = 0640
    hosts deny = ALL
    hosts allow = 10. 127.0.0.1
    hide dot files = Yes
    preserve case = Yes
    interfaces = eth1
    encrypt passwords = yes

[cdrom]
    path = /cdrom

[programy]
    comment = Programy
    path = /home/samba/programy
    hosts allow = 10.
    public = yes
    only guest = yes
    writable = yes
    printable = no

[homes]
    read only = No
    comment = Tajne przez poufne
    writeable = yes
    browseable = yes

inetd przeladowany i netbios-ssn i netbios-ns odhaszowane
/var/run/samba/* wywalone przed odpaleniem samby
firewall wylaczony

Moze ktos kto sie na sambie zna powie mi o co go
Ja w sambie poczatkujacy jestem :(

Pozd wladek

To jest informacja sprzed tygodnia, ale moze niektorych zainteresuje

-----------
IBM Successfully Hacks A Client's Computer Network

TUCSON, Ariz. (March 23, 1998 8:30 p.m.) - International Business
Machines
Corp.'s team of "ethical hackers" successfully broke into an unnamed
company's computer network in a demonstration of a live attack at a
computer industry conference.

IBM's team of ethical hackers, who work at its research division in
Yorktown Heights, N.Y., are paid security professionals called IBM's
Global Security Analysis Lab, who are hired by corporate customers to
detect security flaws.

A "large transportation" company, who would not be identified for
security
reasons, agreed to let IBM try to penetrate its network in a
demonstration
and discussion of hacking at the PC Forum conference.

The IBM researchers, who were working in New York, reported by
telephone
that they successfully penetrated one of the company's file transfer
protocol (FTP) servers through the root directory and had access to
employee telephone numbers, social security numbers, payroll data and
other sensitive information. They broke into three different UNIX
machines
on the network.

"Most people think hacks are random attacks," said Charles Palmer,
head of
IBM Research's Global Security Analysis Lab. "They are very organized
probes." The IBM team started working on this company's network Sunday

evening, he said.

Palmer said IBM charges between $15,000 to $45,000 to perform a hack
of a
company's system, with its permission, to test its security. Palmer
said
because hacking is a felony, its clients sign a contract that he calls
a
"get out of jail free card" specifying what IBM is allowed to do.

The IBM team, which has an 80 percent success rate in electronic
break-ins, is not a team of reformed hackers and Palmer warned the
audience that hiring former hackers can be very dangerous, and not
worth
the risk.

He said IBM has also had a 90 percent success rate with a physical
break-in, where IBM researchers have literally walked out of a
company's
offices carrying computers, while the security guard held the doors
open
for them.

He said that there are currently about 100,000 hackers worldwide, but
that
about 9.99 percent of those hackers are potential professional hired
hackers, who may be involved in corporate espionage, and .01 percent
are
world class cyber criminals. Ninety percent are amateurs who "cyber"
joyride."

"There are about 100 people in the world I would not want touching my
computer," Palmer said, adding that hack attacks are on the rise, with
the
attack on the Pentagon computers by five teenagers being a very recent

example.

IBM then offers a series of services to help a company solve its
security
problems, through IBM's services business, or other companies.

"The first thing that I hope to accomplish is to raise awareness
(about
security problems)," Palmer said.

| Rozumiem polityka ale o zolnierzach tez warto czasem pomyslec.
|  Patrie pewnie poprawia, bedzie plywac ( w koncu transportery plywaja juz
od
| dziesiatkow lat) palic sie pewnie tez nie beda, moze nawet zmieszcza do
| Herkulesa.
Nie Patria, bo to koncern, tylko _AMV_ (transporter). Który pływa i mieści
się do C-130.


jasne zgadzam sie :)

| Jednak powiem stronniczo moglismy kupic Piranhe Mowaga :(.
Tu się zgadzam. Jak stwierdzono na grupie - najlepsza kombinacja
dostawcy i produktu.

| Jesli amerykanie
| planuja aby trzon ich mobilnych byl uzbrojony w Strykera (wersje rozwojowe
| piranhy) to chyba oznacza ne konstrukcja jest solidna.
1. Nie chcą. Strykery to wozy przejściowe - zamówili ich nieco ponad 2000
czyli
mniej niż docelowo WP.


Mimo wszystko zamowili ich sporo i beda sluzyly czesto na pierwszej linii, wiec
to swiadczy o nich niezle
Nb do iraku teraz chba troche posylaja wg Global Security

2. Ślepe wzorowanie się na amerykańskich wzorcach prowadzi do głupot
w rodzaju wymagań na wejście do C-130. Które nie mają sensu w polskich
warunkach.


C 130 stal sie dzieki swojej popularnosci oraz ilosci sprzedanych egzemplazy  
pewnym odnosnikiem, wiele srednich samolotow transportowych przeciez ma podobne
parametry.

Pozatym z zalozenia
| miesci sie w Herkulesach. No moze z wyjatkiem sto-piatki ale ona pewnie
sie tez
| miesci. Pozatym ufam w moce przerobowe Huty Stalowa Wola.
Około setki transporterów miesięcznie. Wg. planu, MON będzie dostawać
niecałą
setkę _rocznie_. HSW dobija stan nieważkości programu Krab.


Na pewno lepiej niz Siemianowice slaskie ktore nawet podczas rozmow ze soimi
kontrachentami nie byly w stanie wydac infomacji po angielsku nie mowiac o tym
ze HSW jednak stoi wyzej technologicznie pozawszystkim siakos nie wierze ze
bedziemy w polsce produkowac cos wiecej niz pozespoly. ewentualnie koncowy
montaz

| Zreszta mysle ze polscy chlopcy czuli by sie pewniej majac nad glowoa
| Buschmastera 20mm w wierzyczce DELCO. nie to zebym mial cos przeciw OTO
Melara
| no ale tak jak mowilem jestem stronniczy....
20 mm ? Chyba 30, 40 ? Zresztą, Finowie dla siebie też Delco wybrali...


Zgodnie z oferta ktora przedstawial jeden z vicedyrektorow GM Defense krakowie
mialo byc:20 mm chaingun bodajze w kanadzie uzywaja takiej wersji

pozdrawiam Kuba

--
Pozdrawiam,
 -< Antey -
http://www.boeing.com/news/releases/2003/q2/nr_030515m.html


--
Wysłano z serwisu OnetNiusy: http://niusy.onet.pl

Wycinam mniej istotne kawalki.
Chetnym rozesle jutro calosc.

28 August 1996 18:00 GMT                       Number: ERS-SVA-E01-1996:005.1
=============================================================================
                             VULNERABILITY  SUMMARY

VULNERABILITY:  When the "WorkMan" compact disc playing program is installed
                set-user-id "root," it can be used to make any file on the
                system world-writable.

PLATFORMS:      Linux, UNIX System V Release 4.0 (and derivatives)

SOLUTION:       Remove the set-user-id bit from the "workman" program.

THREAT:         A non-privileged user can use "WorkMan" to make any file on
                the system world-writable, and then modify that file's
                contents.

=============================================================================
                              DETAILED INFORMATION

NOTE: This advisory is NOT a re-hash of the problem reported on several lists
      earlier this week by a group calling itself "r00t."  The vulnerability
      described by "r00t" is essentially a subset of the problem described in
      this alert.

I. Description

"WorkMan" is a popular program used for playing audio compact disks on local
workstation CD-ROM drives that is widely available from many sites around the
Internet.  Versions of "WorkMan" are also included with some operating system
distributions, such as Linux.

On systems where "WorkMan" was built and installed using the procedures that
are given in "Makefile.linux" or "Makefile.svr4" (in general, this means on
Linux systems and UNIX System V Release 4.0 systems), the "workman" program
is installed set-user-id "root."  This means that when the program is run,
it will execute with super-user permissions.

In order to allow signals to be sent to it, "WorkMan" writes its process-id
to a file called "/tmp/.wm_pid."  The "-p" option to the program allows the
user to specify a different file name in which to record this information.
When a file is specified with "-p", "WorkMan" simply attempts to create and/or
truncate the file, and if this succeeds, "WorkMan" changes the permissions on
the file so that it is world-readable and world-writable.

In the general case, when "WorkMan" is installed without the set-user-id bit
set, the normal file access permissions provided by the operating system will
prevent users from creating or truncating files they are not authorized to
create or truncate.  However, when "WorkMan" is installed set-user-id "root,"
this process breaks down (because "root" is allowed to create/truncate any
file).

II. Impact

A user executing a set-user-id "root" version of "WorkMan" can use the "-p"
option to create a file anywhere in the file system, or to truncate any file
in the file system.  More importantly, the file specified with "-p" will be
world-readable and world-writable when "WorkMan" is finished.  This can enable
the user to create accounts, destroy log files, and perform other unauthorized
actions.

III. Solutions

"WorkMan" does not require the set-user-id bit to work; it is installed this
way only on systems that do not make the CD-ROM device file world-readable
by default.

This vulnerability can be alleviated by:

1) Removing the set-user-id bit from the "WorkMan" program, via a command
   such as

        chmod u-s /usr/local/bin/workman

and

2) Making the CD-ROM device world-readable, via a command such as

        chmod +r /dev/cdrom

Note that on multi-user systems, part (2) of the above procedure will allow
any user to access the contents of the disc installed in the CD-ROM; this
may not be desirable in all environments.

IV. Acknowledgements

IBM-ERS would like to thank the IBM Global Security Analysis Laboratory at the
IBM T. J. Watson Research Center for their discovery of this vulnerability,
bringing it to our attention, providing the steps to fix it, and assistance in
developing this alert.

UNIX is a technology trademark of X/Open Company, Ltd.

FIGHTING IN ABKHAZIA UNDERSCORES RUSSIA'S MULISHNESS. The
fighting, recently staged along and across the
Abkhaz-Georgian demarcation line, has again exposed the
unreliability of Russia's "peacekeeping" operation. As on
past occasions, the operation's command in Sukhumi made
inflammatory anti-Georgian and anti-Western statements,
helped transfer weaponry to Abkhaz forces, and presumably
loaned pilots with the helicopters it transferred. The
Russian airborne forces' base at Gudauta also handed over
weapons from its inventory to the Abkhaz.

Gudauta's existence has been unlawful since July 1 when
Russia was, under international agreements, to have closed it
down. Moscow, however, is trying to retain Gudauta simply by
reassigning it to the Russian "peacekeeping" contingent in
Abkhazia. The Kremlin apparently calculates that Russia will
continue enjoying an internationally tolerated peacekeeping
monopoly in Georgia.

Now in its eighth year, that operation illustrates--with
Moldova/Transdniester a further case study--the specific
character of Russian "peacekeeping" in post-Soviet conflict
areas. The mission is to cement the de facto partition of
states, maintain a controlled level of politically
exploitable tension and support secessionist authorities who
in turn are hosting Russian forces above and beyond the
official "peacekeeping" contingent. Contrary to its label,
the Russian operation is in fact designed not for the pursuit
of peace, but for conserving the conflict indefinitely,
complete with ethnic cleansing in this case. Russia's direct
military intervention made possible the 1993 ethnic cleansing
of Georgians from Abkhazia, the population of which was 44
percent Georgian and only 17 percent Abkhaz.

Contrary to the international understanding of peacekeeping,
the current operation in Abkhazia constitutes an instrument
of Russia's military policy and strategy. In this case,
Moscow plays simultaneously the roles of party to the
conflict, military peacekeeper and political mediator. Over
the years it has rejected Georgia's many proposals for
internationalizing the peacekeeping contingent and has
encouraged the Abkhaz side to insist on a purely Russian
composition of that contingent.

From its inception in 1994 to the present, the Russian
contingent has been using a false label as "CIS collective
forces." The idea was to set a precedent for international
recognition of the CIS as a "regional security organization"
in the post-Soviet space, with "special powers" for Russia as
pacifier. That broader quest has failed. In Abkhazia,
however, the Russian operation has undeniably been
successful, not in terms of genuine peacekeeping, but in
terms of its own mission, as understood and designed by
Moscow in the framework of its strategy in the South
Caucasus.

Georgia is now redoubling efforts toward internationalizing
the peacekeeping operation. President Eduard Shevardnadze's
visit to the United States earlier this month must have
confirmed his understanding that the post-September 11
situation is conducive to a more assertive role for Georgia's
Western friends in global security, invalidating Russian
notions of "near abroad" or "post-Soviet space" understood as
sphere of influence. Following Shevardnadze's return, and
with his encouragement, the Georgian parliament voted across
party lines on October 11 a resolution urging the president
to demand the withdrawal of Russian "peacekeeping" troops
from the Abkhazia-Georgia theater within three months.

The term would begin flowing from the date of the president's
demand to Russia, not the date of parliamentary resolution.
Shevardnadze has not acted on the resolution as yet.
Presumably, he will use it to strengthen his bargaining hand
with Russia. Under the terms of the 1994 agreements that
cover the "peacekeeping" operation, Georgia has the sovereign
right to send the Russian contingent home. Tbilisi has
attempted to use that provision several times in recent
years, but has each time backtracked for fear of being left
face to face with the Abkhaz. The Abkhaz forces are more
heavily armed, and they control the Georgia-Russia border on
the Abkhaz sector, where Russian supplies can and do move
freely into Abkhazia. Moreover, if and when Russian
"peacekeepers" leave, Moscow is likely to insist even more
strongly than it now does on retaining the Gudauta base,
unless international efforts would have persuaded Russia to
respect its own international obligation to close Gudauta.

Russian President Vladimir Putin responded within twenty-four
hours to the Georgian parliament's resolution. In a televised
statement on October 12, Putin went out of his way to sound
conciliatory, speaking even of improvements in Russia-Georgia
relations. He announced that Russia would withdraw the
"peacekeeping" contingent, if Georgia insists on such a move,
but warned that Georgia would bear responsibility for any
ensuing destabilization of the situation. As Tbilisi clearly
realizes, that warning represents the operative part in
Putin's seemingly conciliatory statement.

Just as clearly, Georgia would drop the idea of evicting the
Russian contingent if the operation could be
internationalized. Shevardnadze has since indicated that much
in an interview with national media, in a meeting with
ambassadors from the Organization for Security and
Cooperation in Europe, and in his talks with the visiting
Ukrainian Foreign Affairs Minister Anatoly Zlenko, whose
country is conditionally willing to provide troops for such a
mission. The Georgian side not only accepts, but wants
Russia's participation in a peacekeeping operation, provided
that the Russian troops become one element in an
international contingent under a United Nations mandate, and
which would include Western as well as non-Western elements.

http://www.jamestown.org