[Techtalk] Trojans or not (What to do when disaster strikes)

[Raven, corporate courtesan]

Heya --

Quoth phiber2001 (Wed, Apr 03, 2002 at 02:21:59AM +0600):
> I'm facing a new puzzle. From what I read previously /etc/rc.d has rc3.d 
> for console and rc5.d is for X. But I see a list from rc0.d to rc6.d. What 
> does it mean? Does it mean that I have to check every one of them and turn 
> all the S (services that are running) to K (in not running state)? I made 
> changes through the setup option. But I want to know about this as I see 
> different servers (daemons) running in different rc*.d directories.

	This varies somewhat from *nix to *nix, but in general, that's
the case for Linux.  Runlevel 3 is booting multiuser, with all
networking options enabled.  You can mount drives via NFS, etc., and run
any servers that you've configured to start up with those init scripts.
Runlevel 5 is all that plus Xwindows.  

	Generally if there's something I don't want to start, I either
delete the symlink entirely (under Red Hat, for example, most of the
things like S95httpd are symlinks to the actual scripts in the
/etc/rc.d/init.d directory.  Doing an ls -al in rc3.d should show you
that.) or change it to a small s (s90qmail rather than S90qmail).  But
Hamster's suggestion of chkconfig is easier still.  

	You don't have to kill the service in the init scripts to get it
not to run when the machine is rebooted.  Just don't start it up.  If
it's already running for this boot, just do a ps and kill its process.
Then once you've removed its entry in the startup scripts, it shouldn't
come back on a reboot.  

> Also, in rc5.d I saw httpd running. Does it mean that my Linux will start 
> httpd server and welcoming all incoming requests when I start startx/ kdm 
> or does it mean that this httpd server will only start if I boot thru' 
> init6 (/etc/initab)? I didn't see any httpd running in the console by setup 
> command.

	Things only start from the init scripts when you change to that
runlevel.  So if you have httpd in runlevel 5, it would start if you did
a "telinit 5" or if you booted into runlevel 5.  But it won't start just
because you start up Xwindows.  Running one program is different from
changing runlevels.
 
> I also have one more query, I have seen that booting with LILO floppy you 
> can type in 'linux 1' in the boot console and do necessary changes. But in 
> straight bootup where in doesn't give the boot: colsole and lead you 
> directly to the login: prompt how to solve or have some way thru' the 
> problem to have enable the linux1 mode? that is, without login in and type 
> the init. And without booting from the CD.
 
	The difference is whether there's a prompt keyword in your
/etc/lilo.conf.  But without a floppy or CD, and if you don't want to
log in, there's no way I can think of to mystically change your extant
lilo.conf.  Is there some reason that you can't just log in normally,
edit /etc/lilo.conf, run /sbin/lilo, and then reboot?
 
> ps. Nice quote Raven. Guess we both seen it somewhere else pretty recently 
> :). Have you read the books Applied Cryptography & Secrets & Lies?
 
	I have finished "Secrets and Lies", and am still working my way
through "Applied Cryptography".  Bruce Schneier is one of my heroes; I
greatly admire him for both his technical skill and his geek politics.
(Privacy protection, cryptography, responsible disclosure of
vulnerabilities, holding vendors accountable for the software they
release, and things like that.)  He's one of my shining examples of the
good-hacker sort. 

	He also sends out a monthly newsletter called Crypto-gram via
e-mail -- free, and well worth reading, in my opinion.

http://www.counterpane.com/crypto-gram.html

	But I picked up the "if cryptography is outlawed" quote from one
of my co-workers, not from a book.  I guess geek minds think alike.

Cheers,
Raven 
 
"Argh!  All these clocks are the same!"
  -- RavenBlack, on unexpected and new synchronicity