Everybody Staze...

Nobody leavz...

You are here: Home / Archives for 10.5

Mail.app autoconfig

By

Continuing on from yesterday’s post, today I’ll detail a seemingly little known feature of Apple’s Mail.app in 10.5 and after (pretty sure it doesn’t support 10.4).

Anyone who has set up a gmail account in Mail.app knows that once you put in your email address “[email protected]” and a password, it just magically figures out the mail servers, sets SSL, and you’re good to go. What you may NOT know, is that you can make Mail.app do this for your customers when they put in their email address for your system.

The process is pretty easy. What you need to do is create a file called MailAccounts.plist, in that file, you put something like the following:

[Read more…]

420 Too many open files

By

After years of Plone/Zope running on a 10.5 web server, this last weekend I started seeing the zope logs filling with errors saying “[420] Too many open files”. One, I hadn’t seen this before, and two, I couldn’t figure out why it was happening after years of solid use.

So, looking around online, it appeared that 10.5 just set the max files open per user to an awfully small limit (especially in the server version)… 256 files per user! Since I use a zeo/client setup, and use FileSystemStorage for storing files outside the zodb, I easily had this many files open. Again, why is this just happening after years?

[Read more…]

chroot sftp on 10.5 Server

By

Looking around online, I found several instances of people wanting to chroot sftp on 10.5 server. The purpose being, they want to give access to sftp for users they may not trust, and want to keep them where they belong over sftp.

Unfortunately, there were a couple pieces missing from the instructions. So, thought I would fix that.

First, make a backup of /etc/sshd_config. While it should be easy enough to back out these changes, it’s just good practice to make a backup.

Second, create a directory for the “jail”. In my case, this was in /Volumes/Data/Websites/username.

The key here is that all directories up to and including the username directory must be read only by everyone but root when it comes to POSIX directories. So / would need to be root:group, and something like rwxr-xr-x. That goes for /Volumes, /Volumes/Data and /Volumes/Data/Websites.

The rest is all in the /etc/sshd_config

Comment out (with a #):

Subsystem sftp /usr/libexec/sftp-server

And add:

Subsystem sftp internal-sftp

At the end of the sshd_config, add:

Match User username
ChrootDirectory /Volumes/Data/Websites/username/
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no

Or, if you want to enforce on a group:

Match Group usergroup
ChrootDirectory /Volumes/Data/Websites/
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no

You can add both, and ssh will read from first to last. So, if you want specific users to go to specific folders, you can add them first, then end with a group policy.

Lastly, while testing this, make sure to watch /var/log/secure.log. You’ll see errors there when it doesn’t work. My problem, when working on this, was the write ability for users other than root on the parent directories. I had to systematically remove group and other write before it would work.

Those errors looked like:

fatal: bad ownership or modes for chroot directory component "/"

In the case of the root directory.

Lastly, this will remove SSH capability for the user specified. They will only be able to SFTP, but they’ll be locked into the directory specified. Great for a random student groups, in my case, that need to have a website, but you don’t necessarily want running wild on your system.

Everybody Staze...