Te whakaraerae i roto i te chrony

В tiimona, he whakatinanatanga o te kawa NTP i whakamahia hei tukutahi i te wa tika i roto i nga momo tohatoha Linux, kua tautuhia whakaraeraetanga (CVE-2020-14367), ka taea e koe te tuhirua i tetahi konae kei runga i te punaha me te uru atu ki te chrony kaiwhakamahi kore whai mana. Ko te whakaraeraetanga ka taea anake te whakamahi ma te chrony kaiwhakamahi, e whakaiti ana i te raru. Heoi, ka whakaraerae te take i te taumata wehe i roto i te waa ka taea te whakamahi mena ka kitea tetahi atu whakaraeraetanga i roto i te waehere ka mahia i muri i te tautuhi i nga mana.

Ko te whakaraeraetanga na te hanga kino o te konae pid, i hangaia i te waa kaore ano a chrony ki te tautuhi i nga mana me te whakahaere hei pakiaka. I tenei keehi, ko te whaiaronga /run/chrony, i tuhia ai te konae pid, i hangaia me nga mana 0750 ma te systemd-tmpfiles, i te wa i whakarewahia ai a chronyd me te kaiwhakamahi me te roopu "chrony". Na, ki te whai waahi koe ki te chrony kaiwhakamahi, ka taea te whakakapi i te konae pid /run/chrony/chronyd.pid me te hono tohu. Ka taea e te hono tohu te tohu ki tetahi konae punaha ka tuhiruatia ina whakarewahia a chronyd.

pakiaka # systemctl mutu chronyd.service
pakiaka # sudo -u chrony /bin/bash

chrony$ cd /run/chrony
chrony$ ln -s /etc/shadow chronyd.pid
chrony$ putanga

pakiaka # /usr/sbin/chronyd -n
^C
# hei utu mo nga ihirangi o /etc/shadow ka tiakina te ID tukanga chronyd
pakiaka # cat /etc/shadow
15287

Whakaraerae whakakorea i roto i te take chrony 3.5.1. Kei te waatea nga whakahōutanga mōkihi hei whakatika i te whakaraeraetanga Fedora. I roto i te whakaritenga o te whakahou mo RHEL, Debian и Ubuntu.

SUSE me openSUSE raruraru ehara i te kaupapa, i te mea ko te hononga tohu mo te chrony i hangaia tika i roto i te whaiaronga /run, me te kore e whakamahi i etahi atu raarangi.

Source: opennet.ru

Tāpiri i te kōrero