<strong>Report forwarded</strong> to <code>debian-bugs-dist@lists.debian.org, Martin Schulze &lt;joey@debian.org&gt;</code>:<br>
<code>Bug#24326</code>; Package <code>sysklogd</code>.


debian-bugs-dist@lists.debian.orgMartin Schulze <joey@debian.org>

Subject: Bug#24326: sysklogd: syslogd shouldn't run as root
Reply-To: Topi Miettinen <tom@medialab.sonera.net>, 24326@bugs.debian.org
Resent-From: Topi Miettinen <tom@medialab.sonera.net>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Martin Schulze <joey@debian.org>
Resent-Date: Tue, 07 Jul 1998 21:33:02 GMT
Resent-Message-ID: <handler.24326.B.89984631916459@bugs.debian.org>
Resent-Sender: iwj@debian.org
X-Debian-PR-Message: report 24326
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 
X-Loop: owner@bugs.debian.org
Received: via spool by bugs@bugs.debian.org id=B.89984631916459
          (code B ref -1); Tue, 07 Jul 1998 21:33:02 GMT
Date: Wed, 8 Jul 1998 00:18:29 +0300
Message-Id: <199807072118.AAA25287@pop.medialab.sonera.net>
From: Topi Miettinen <tom@medialab.sonera.net>
To: submit@bugs.debian.org
X-Mailer: bug 3.1.5

Package: sysklogd
Version: 1.3-26
Severity: wishlist

Syslogd does not need superuser privileges except for startup. Klogd needs 
privileges to open /proc/kmsg, but in current kernels (2.0.34, 2.1.107)
non-root reading from the file descriptor fails. That should eventually
be fixed.

This patch implements a new flag, -u user which causes syslogd and klogd
to call setuid(user).

diff -ru ./klogd.c.orig ./klogd.c
--- ./klogd.c.orig	Sun Jun 28 23:22:48 1998
+++ ./klogd.c	Sun Jun 28 23:26:49 1998
@@ -216,6 +216,7 @@
 #include <stdarg.h>
 #include <paths.h>
 #include <stdlib.h>
+#include <pwd.h>
 #include "klogd.h"
 #include "ksyms.h"
 #include "pidfile.h"
@@ -240,7 +241,7 @@
 static char	*PidFile = "/etc/klogd.pid";
 #endif
 
-static int	kmsg,
+static int	kmsg = -1,
 		change_state = 0,
 		terminate = 0,
 		caught_TSTP = 0,
@@ -490,7 +491,7 @@
 		return(kernel);
 	}
 	
-	if ( (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0 )
+	if ( kmsg == -1 && (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0 )
 	{
 		fprintf(stderr, "klogd: Cannot open proc file system, " \
 			"%d - %s.\n", errno, strerror(errno));
@@ -878,10 +879,13 @@
 
 	auto char	*log_level = (char *) 0,
 			*output = (char *) 0;
+	uid_t		uid = 0;
+	gid_t		gid;
+	struct passwd	*pw;
 
 	chdir ("/");
 	/* Parse the command-line. */
-	while ((ch = getopt(argc, argv, "c:df:iIk:nopsvx")) != EOF)
+	while ((ch = getopt(argc, argv, "c:df:iIk:nopsu:vx")) != EOF)
 		switch((char)ch)
 		{
 		    case 'c':		/* Set console message level. */
@@ -915,6 +919,15 @@
 		    case 's':		/* Use syscall interface. */
 			use_syscall = 1;
 			break;
+		    case 'u':
+			pw = getpwnam(optarg);
+			if (!pw) {
+                                printf("Bad user name %s\n", optarg);
+                                break;
+                        }
+                        uid = pw->pw_uid;
+                        gid = pw->pw_gid;
+			break;
 		    case 'v':
 			printf("klogd %s-%s\n", VERSION, PATCHLEVEL);
 			exit (1);
@@ -1044,6 +1057,11 @@
 	if (symbol_lookup) {
 		InitKsyms(symfile);
 		InitMsyms();
+	}
+
+	if (uid > 0) {
+		setgid(gid);
+		setuid(uid);
 	}
 
         /* The main loop. */
diff -ru ./syslogd.c.orig ./syslogd.c
--- ./syslogd.c.orig	Sun Jun 28 23:22:49 1998
+++ ./syslogd.c	Tue Jun 23 15:07:01 1998
@@ -400,6 +400,7 @@
 #include <arpa/nameser.h>
 #include <arpa/inet.h>
 #include <resolv.h>
+#include <pwd.h>
 #include "pidfile.h"
 #include "version.h"
 
@@ -700,9 +701,12 @@
 	char line[MAXLINE +1];
 	extern int optind;
 	extern char *optarg;
+	uid_t uid = 0;
+	gid_t gid;
+	struct passwd *pw;
 
 	chdir ("/");
-	while ((ch = getopt(argc, argv, "dhf:l:m:np:rs:v")) != EOF)
+	while ((ch = getopt(argc, argv, "dhf:l:m:np:rs:u:v")) != EOF)
 		switch((char)ch) {
 		case 'd':		/* debug */
 			Debug = 1;
@@ -741,6 +745,15 @@
 			}
 			StripDomains = crunch_list(optarg);
 			break;
+		case 'u':		/* user */
+			pw = getpwnam(optarg);
+			if (!pw) {
+				printf("Bad user name %s\n", optarg);
+				break;
+			}
+			uid = pw->pw_uid;
+			gid = pw->pw_gid;
+			break;
 		case 'v':
 			printf("syslogd %s-%s\n", VERSION, PATCHLEVEL);
 			exit (0);
@@ -865,6 +878,11 @@
 	{
 		dprintf("Debugging disabled, SIGUSR1 to turn on debugging.\n");
 		debugging_on = 0;
+	}
+
+	if (uid > 0) {
+		setgid(gid);
+		setuid(uid);
 	}
 
 	/* Main loop begins here. */


--- Begin /etc/init.d/sysklogd (modified conffile)
test -f /sbin/klogd || exit 0
test -f /sbin/syslogd || exit 0
SYSLOGD="-u syslogd"
KLOGD="-u syslogd"
case "$1" in
  start)
    echo -n "Starting system log daemon: syslogd"
    start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD
    echo -n " klogd"
    start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
    echo "."
    ;;
  stop)
    echo -n "Stopping system log daemon: klogd"
    start-stop-daemon --stop --quiet --pidfile /var/run/klogd.pid
    echo -n " syslogd"
    start-stop-daemon --stop --quiet --pidfile /var/run/syslogd.pid
    echo "."
    ;;
  reload|force-reload)
    start-stop-daemon --stop --quiet --signal 1 --pidfile /var/run/syslogd.pid
    ;;
  restart)
    echo -n "Stopping system log daemon: klogd"
    start-stop-daemon --stop --quiet --pidfile /var/run/klogd.pid
    echo " syslogd"
    start-stop-daemon --stop --quiet --pidfile /var/run/syslogd.pid
    sleep 1
    echo -n "Starting system log daemon: syslogd"
    start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD
    echo -n " klogd"
    start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
    echo "."
    ;;
  *)
    echo "Usage: /etc/init.d/sysklogd {start|stop|reload|restart|force-reload}"
    exit 1
esac
exit 0

--- End /etc/init.d/sysklogd

--- Begin /etc/cron.daily/sysklogd (modified conffile)
cd /var/log
for LOG in `syslogd-listfiles`
do
   if [ -f $LOG ]; then
      savelog -g adm -m 640 -u syslogd -c 7 $LOG >/dev/null
   fi
done
for LOG in `syslogd-listfiles --auth`
do
   if [ -f $LOG ]; then
      chown syslogd.adm $LOG
      chmod o-rwx $LOG
   fi
done
/etc/init.d/sysklogd reload

--- End /etc/cron.daily/sysklogd

--- Begin /etc/cron.weekly/sysklogd (modified conffile)
cd /var/log
for LOG in `syslogd-listfiles --weekly`
do
   if [ -f $LOG ]; then
      savelog -g adm -m 640 -u syslogd -c 4 $LOG >/dev/null
   fi
done
for LOG in `syslogd-listfiles --auth`
do
   if [ -f $LOG ]; then
      chown syslogd.adm $LOG
      chmod o-rwx $LOG
   fi
done
/etc/init.d/sysklogd reload

--- End /etc/cron.weekly/sysklogd



<strong>Acknowledgement sent</strong> to <code>Topi Miettinen &lt;tom@medialab.sonera.net&gt;</code>:<br>
New bug report received and forwarded.  Copy sent to <code>Martin Schulze &lt;joey@debian.org&gt;</code>.


-t

From: owner@bugs.debian.org (Ian Jackson)
To: Topi Miettinen <tom@medialab.sonera.net>
Subject: Bug#24326: Acknowledgement (sysklogd: syslogd shouldn't run as root)
Message-ID: <handler.24326.B.89984631916459.ack@bugs.debian.org>
In-Reply-To: <199807072118.AAA25287@pop.medialab.sonera.net>
References: <199807072118.AAA25287@pop.medialab.sonera.net>
X-Debian-PR-Message: ack 24326

Thank you for the problem report you have sent regarding Debian.
This is an automatically generated reply, to let you know your message has
been received.  It is being forwarded to the developers' mailing list for
their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 Martin Schulze <joey@debian.org>

If you wish to submit further information on your problem, please send
it to 24326@bugs.debian.org (and *not* to
bugs@bugs.debian.org).

Please do not reply to the address at the top of this message,
unless you wish to report a problem with the bug-tracking system.

Ian Jackson
(administrator, Debian bugs database)



Received: (at submit) by bugs.debian.org; 7 Jul 1998 21:18:39 +0000
Received: (qmail 16456 invoked from network); 7 Jul 1998 21:18:38 -0000
Received: from pop.medialab.sonera.net (195.156.109.69)
  by debian.novare.net with SMTP; 7 Jul 1998 21:18:38 -0000
Received: (from tom@localhost)
	by pop.medialab.sonera.net (8.9.0/8.9.0/Debian/GNU) id AAA25287;
	Wed, 8 Jul 1998 00:18:29 +0300
Date: Wed, 8 Jul 1998 00:18:29 +0300
Message-Id: <199807072118.AAA25287@pop.medialab.sonera.net>
From: Topi Miettinen <tom@medialab.sonera.net>
Subject: sysklogd: syslogd shouldn't run as root
To: submit@bugs.debian.org
X-Mailer: bug 3.1.5

Package: sysklogd
Version: 1.3-26
Severity: wishlist

Syslogd does not need superuser privileges except for startup. Klogd needs 
privileges to open /proc/kmsg, but in current kernels (2.0.34, 2.1.107)
non-root reading from the file descriptor fails. That should eventually
be fixed.

This patch implements a new flag, -u user which causes syslogd and klogd
to call setuid(user).

diff -ru ./klogd.c.orig ./klogd.c
--- ./klogd.c.orig	Sun Jun 28 23:22:48 1998
+++ ./klogd.c	Sun Jun 28 23:26:49 1998
@@ -216,6 +216,7 @@
 #include <stdarg.h>
 #include <paths.h>
 #include <stdlib.h>
+#include <pwd.h>
 #include "klogd.h"
 #include "ksyms.h"
 #include "pidfile.h"
@@ -240,7 +241,7 @@
 static char	*PidFile = "/etc/klogd.pid";
 #endif
 
-static int	kmsg,
+static int	kmsg = -1,
 		change_state = 0,
 		terminate = 0,
 		caught_TSTP = 0,
@@ -490,7 +491,7 @@
 		return(kernel);
 	}
 	
-	if ( (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0 )
+	if ( kmsg == -1 && (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0 )
 	{
 		fprintf(stderr, "klogd: Cannot open proc file system, " \
 			"%d - %s.\n", errno, strerror(errno));
@@ -878,10 +879,13 @@
 
 	auto char	*log_level = (char *) 0,
 			*output = (char *) 0;
+	uid_t		uid = 0;
+	gid_t		gid;
+	struct passwd	*pw;
 
 	chdir ("/");
 	/* Parse the command-line. */
-	while ((ch = getopt(argc, argv, "c:df:iIk:nopsvx")) != EOF)
+	while ((ch = getopt(argc, argv, "c:df:iIk:nopsu:vx")) != EOF)
 		switch((char)ch)
 		{
 		    case 'c':		/* Set console message level. */
@@ -915,6 +919,15 @@
 		    case 's':		/* Use syscall interface. */
 			use_syscall = 1;
 			break;
+		    case 'u':
+			pw = getpwnam(optarg);
+			if (!pw) {
+                                printf("Bad user name %s\n", optarg);
+                                break;
+                        }
+                        uid = pw->pw_uid;
+                        gid = pw->pw_gid;
+			break;
 		    case 'v':
 			printf("klogd %s-%s\n", VERSION, PATCHLEVEL);
 			exit (1);
@@ -1044,6 +1057,11 @@
 	if (symbol_lookup) {
 		InitKsyms(symfile);
 		InitMsyms();
+	}
+
+	if (uid > 0) {
+		setgid(gid);
+		setuid(uid);
 	}
 
         /* The main loop. */
diff -ru ./syslogd.c.orig ./syslogd.c
--- ./syslogd.c.orig	Sun Jun 28 23:22:49 1998
+++ ./syslogd.c	Tue Jun 23 15:07:01 1998
@@ -400,6 +400,7 @@
 #include <arpa/nameser.h>
 #include <arpa/inet.h>
 #include <resolv.h>
+#include <pwd.h>
 #include "pidfile.h"
 #include "version.h"
 
@@ -700,9 +701,12 @@
 	char line[MAXLINE +1];
 	extern int optind;
 	extern char *optarg;
+	uid_t uid = 0;
+	gid_t gid;
+	struct passwd *pw;
 
 	chdir ("/");
-	while ((ch = getopt(argc, argv, "dhf:l:m:np:rs:v")) != EOF)
+	while ((ch = getopt(argc, argv, "dhf:l:m:np:rs:u:v")) != EOF)
 		switch((char)ch) {
 		case 'd':		/* debug */
 			Debug = 1;
@@ -741,6 +745,15 @@
 			}
 			StripDomains = crunch_list(optarg);
 			break;
+		case 'u':		/* user */
+			pw = getpwnam(optarg);
+			if (!pw) {
+				printf("Bad user name %s\n", optarg);
+				break;
+			}
+			uid = pw->pw_uid;
+			gid = pw->pw_gid;
+			break;
 		case 'v':
 			printf("syslogd %s-%s\n", VERSION, PATCHLEVEL);
 			exit (0);
@@ -865,6 +878,11 @@
 	{
 		dprintf("Debugging disabled, SIGUSR1 to turn on debugging.\n");
 		debugging_on = 0;
+	}
+
+	if (uid > 0) {
+		setgid(gid);
+		setuid(uid);
 	}
 
 	/* Main loop begins here. */


--- Begin /etc/init.d/sysklogd (modified conffile)
test -f /sbin/klogd || exit 0
test -f /sbin/syslogd || exit 0
SYSLOGD="-u syslogd"
KLOGD="-u syslogd"
case "$1" in
  start)
    echo -n "Starting system log daemon: syslogd"
    start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD
    echo -n " klogd"
    start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
    echo "."
    ;;
  stop)
    echo -n "Stopping system log daemon: klogd"
    start-stop-daemon --stop --quiet --pidfile /var/run/klogd.pid
    echo -n " syslogd"
    start-stop-daemon --stop --quiet --pidfile /var/run/syslogd.pid
    echo "."
    ;;
  reload|force-reload)
    start-stop-daemon --stop --quiet --signal 1 --pidfile /var/run/syslogd.pid
    ;;
  restart)
    echo -n "Stopping system log daemon: klogd"
    start-stop-daemon --stop --quiet --pidfile /var/run/klogd.pid
    echo " syslogd"
    start-stop-daemon --stop --quiet --pidfile /var/run/syslogd.pid
    sleep 1
    echo -n "Starting system log daemon: syslogd"
    start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD
    echo -n " klogd"
    start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
    echo "."
    ;;
  *)
    echo "Usage: /etc/init.d/sysklogd {start|stop|reload|restart|force-reload}"
    exit 1
esac
exit 0

--- End /etc/init.d/sysklogd

--- Begin /etc/cron.daily/sysklogd (modified conffile)
cd /var/log
for LOG in `syslogd-listfiles`
do
   if [ -f $LOG ]; then
      savelog -g adm -m 640 -u syslogd -c 7 $LOG >/dev/null
   fi
done
for LOG in `syslogd-listfiles --auth`
do
   if [ -f $LOG ]; then
      chown syslogd.adm $LOG
      chmod o-rwx $LOG
   fi
done
/etc/init.d/sysklogd reload

--- End /etc/cron.daily/sysklogd

--- Begin /etc/cron.weekly/sysklogd (modified conffile)
cd /var/log
for LOG in `syslogd-listfiles --weekly`
do
   if [ -f $LOG ]; then
      savelog -g adm -m 640 -u syslogd -c 4 $LOG >/dev/null
   fi
done
for LOG in `syslogd-listfiles --auth`
do
   if [ -f $LOG ]; then
      chown syslogd.adm $LOG
      chmod o-rwx $LOG
   fi
done
/etc/init.d/sysklogd reload

--- End /etc/cron.weekly/sysklogd



<strong>Information forwarded</strong> to <code>debian-bugs-dist@lists.debian.org, Martin Schulze &lt;joey@debian.org&gt;</code>:<br>
<code>Bug#24326</code>; Package <code>sysklogd</code>.


debian-bugs-dist@lists.debian.orgMartin Schulze <joey@debian.org>

Subject: Bug#24326: removing privilege from sysklogd
Reply-To: Richard Kettlewell <rjk@greenend.org.uk>, 24326@bugs.debian.org
Resent-From: Richard Kettlewell <rjk@greenend.org.uk>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Martin Schulze <joey@debian.org>
Resent-Date: Tue, 27 Oct 1998 21:18:48 GMT
Resent-Message-ID: <handler.24326.B24326.90952249813880@bugs.debian.org>
Resent-Sender: iwj@debian.org
X-Debian-PR-Message: report 24326
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 
X-Loop: owner@bugs.debian.org
Received: via spool by 24326-bugs@bugs.debian.org id=B24326.90952249813880
          (code B ref 24326); Tue, 27 Oct 1998 21:18:48 GMT
Message-Id: <Pine.just.say.no.8SdywOhh0@sfere.greenend.org.uk>
Date: Tue, 27 Oct 98 21:16:34 +0000 (GMT)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
From: Richard Kettlewell <rjk@greenend.org.uk>
To: 24326@bugs.debian.org
X-Mailer: VM 6.30 under 20.4 "Emerald" XEmacs  Lucid

Just a quick observation about that patch - you must call initgroups()
before you call setuid(uid).

Otherwise sysklogd will still have all of root's additional groups in
its personality, which could give it privileged access that it ought
not to have.

This would represent a security hole (at least compared to the
intended behaviour - it would still be more secure than running as
root all the time!)

Additionally I notice that you've neglected to do any error checking
on the calls to setgid() and setuid().

ttfn/rjk



<strong>Acknowledgement sent</strong> to <code>Richard Kettlewell &lt;rjk@greenend.org.uk&gt;</code>:<br>
Extra info received and forwarded to list.  Copy sent to <code>Martin Schulze &lt;joey@debian.org&gt;</code>.


-t

From: owner@bugs.debian.org (Debian Bug Tracking System)
To: Richard Kettlewell <rjk@greenend.org.uk>
Subject: Bug#24326: Info received (was removing privilege from sysklogd)
Message-ID: <handler.24326.B24326.90952249813880.ackinfo@bugs.debian.org>
In-Reply-To: <Pine.just.say.no.8SdywOhh0@sfere.greenend.org.uk>
References: <Pine.just.say.no.8SdywOhh0@sfere.greenend.org.uk>
X-Debian-PR-Message: ack-info-maintonly 24326

Thank you for the additional information you have supplied regarding
this problem report.  It has been forwarded to the developer(s) and
to the developers' mailing list to accompany the original report.

Your message has been sent to the package maintainer(s):
 Martin Schulze <joey@debian.org>

If you wish to continue to submit further information on your problem,
please send it to 24326@bugs.debian.org, as before.

Please do not reply to the address at the top of this message,
unless you wish to report a problem with the bug-tracking system.

Ian Jackson
(administrator, Debian bugs database)



Received: (at 24326) by bugs.debian.org; 27 Oct 1998 21:08:18 +0000
Received: (qmail 13862 invoked from network); 27 Oct 1998 21:08:16 -0000
Received: from mercury.elmailer.net (195.224.76.4)
  by master.debian.org with SMTP; 27 Oct 1998 21:08:16 -0000
Received: by mercury.elmailer.net with ESMTP
    from sfere.greenend.org.uk (sfere.greenend.org.uk [195.224.38.1])
    id VAA14593 for <24326@bugs.debian.org> (2.4-8.8.8/3.1.37);
    Tue, 27 Oct 1998 21:08:12 GMT
Received: from richard by sfere.greenend.org.uk with local (Exim 2.02 #1 (Debian))
	id 0zYGTj-0002p2-00; Tue, 27 Oct 1998 21:16:35 +0000
Message-Id: <Pine.just.say.no.8SdywOhh0@sfere.greenend.org.uk>
Date: Tue, 27 Oct 98 21:16:34 +0000 (GMT)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
From: Richard Kettlewell <rjk@greenend.org.uk>
To: 24326@bugs.debian.org
Subject: removing privilege from sysklogd
X-Mailer: VM 6.30 under 20.4 "Emerald" XEmacs  Lucid

Just a quick observation about that patch - you must call initgroups()
before you call setuid(uid).

Otherwise sysklogd will still have all of root's additional groups in
its personality, which could give it privileged access that it ought
not to have.

This would represent a security hole (at least compared to the
intended behaviour - it would still be more secure than running as
root all the time!)

Additionally I notice that you've neglected to do any error checking
on the calls to setgid() and setuid().

ttfn/rjk



<strong>Information forwarded</strong> to <code>debian-bugs-dist@lists.debian.org, Martin Schulze &lt;joey@debian.org&gt;</code>:<br>
<code>Bug#24326</code>; Package <code>sysklogd</code>.


debian-bugs-dist@lists.debian.orgMartin Schulze <joey@debian.org>

Subject: Bug#24326: klogd -u patch update
Reply-To: Topi Miettinen <Topi.Miettinen@medialab.sonera.net>, 24326@bugs.debian.org
Resent-From: Topi Miettinen <Topi.Miettinen@medialab.sonera.net>
Orignal-Sender: tom@medialab.sonera.net
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Martin Schulze <joey@debian.org>
Resent-Date: Sun, 22 Nov 1998 21:48:16 GMT
Resent-Message-ID: <handler.24326.B24326.9117712485598@bugs.debian.org>
Resent-Sender: iwj@debian.org
X-Debian-PR-Message: report 24326
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 
X-Loop: owner@bugs.debian.org
Received: via spool by 24326-bugs@bugs.debian.org id=B24326.9117712485598
          (code B ref 24326); Sun, 22 Nov 1998 21:48:16 GMT
Message-Id: <199811222147.XAA08596@pop.medialab.sonera.net>
X-Mailer: exmh version 2.0.2 2/24/98 (debian) 
X-No-Archive: yes
From: Topi Miettinen <Topi.Miettinen@medialab.sonera.net>
To: 24326@bugs.debian.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 22 Nov 1998 23:47:25 +0200
Sender: tom@medialab.sonera.net

Good spotting. This new patch (for klogd only) calls setgroups, setgid and
setuid to change ids, checking return values.

BTW, at least in 2.1.129 /proc/kmsg should work as required.

syslogd needs more thought. The current patch does not work, as there are
several problems:
-restart (signal): reopening sockets will fail due to insufficient
privileges (may be circumvented with checking if the sockets are already
open, unless a config change requires a new privileged inet socket)
-cleanup at exit: removing unix sockets
-log file ownership

-Topi

diff -ru ./klogd.c.orig ./klogd.c
--- ./klogd.c.orig	Sun Nov 22 22:53:24 1998
+++ ./klogd.c	Sun Nov 22 22:55:48 1998
@@ -223,6 +223,8 @@
 #include <stdarg.h>
 #include <paths.h>
 #include <stdlib.h>
+#include <pwd.h>
+#include <grp.h>
 #include "klogd.h"
 #include "ksyms.h"
 #ifndef TESTING
@@ -251,7 +253,7 @@
 #endif
 #endif
 
-static int	kmsg,
+static int	kmsg = -1,
 		change_state = 0,
 		terminate = 0,
 		caught_TSTP = 0,
@@ -508,7 +510,7 @@
 	}
 
 #ifndef TESTING
-	if ( (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0 )
+	if (kmsg == -1 && (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0)
 	{
 		fprintf(stderr, "klogd: Cannot open proc file system, " \
 			"%d - %s.\n", errno, strerror(errno));
@@ -902,12 +904,15 @@
 
 	auto char	*log_level = (char *) 0,
 			*output = (char *) 0;
-
+	uid_t           uid = 0;
+	gid_t           gid = 0;
+	struct passwd   *pw;
+  
 #ifndef TESTING
 	chdir ("/");
 #endif
 	/* Parse the command-line. */
-	while ((ch = getopt(argc, argv, "c:df:iIk:nopsvx")) != EOF)
+	while ((ch = getopt(argc, argv, "c:df:iIk:nopsu:vx")) != EOF)
 		switch((char)ch)
 		{
 		    case 'c':		/* Set console message level. */
@@ -941,6 +946,15 @@
 		    case 's':		/* Use syscall interface. */
 			use_syscall = 1;
 			break;
+		    case 'u':
+			pw = getpwnam(optarg);
+			if (!pw) {
+                                printf("Bad user name %s\n", optarg);
+                                break;
+                        }
+                        uid = pw->pw_uid;
+                        gid = pw->pw_gid;
+			break;
 		    case 'v':
 			printf("klogd %s-%s\n", VERSION, PATCHLEVEL);
 			exit (1);
@@ -1071,6 +1085,15 @@
 	if (symbol_lookup) {
 		InitKsyms(symfile);
 		InitMsyms();
+	}
+
+	if (uid > 0) {
+		if (setgroups(0, NULL) < 0 ||
+		    setgid(gid) < 0 ||
+		    setuid(uid) < 0) {
+			perror("error changing ids");
+			exit(1);
+		}
 	}
 
         /* The main loop. */






<strong>Acknowledgement sent</strong> to <code>Topi Miettinen &lt;Topi.Miettinen@medialab.sonera.net&gt;</code>:<br>
Extra info received and forwarded to list.  Copy sent to <code>Martin Schulze &lt;joey@debian.org&gt;</code>.


-t

From: owner@bugs.debian.org (Debian Bug Tracking System)
To: Topi Miettinen <Topi.Miettinen@medialab.sonera.net>
Subject: Bug#24326: Info received (was klogd -u patch update)
Message-ID: <handler.24326.B24326.9117712485598.ackinfo@bugs.debian.org>
In-Reply-To: <199811222147.XAA08596@pop.medialab.sonera.net>
References: <199811222147.XAA08596@pop.medialab.sonera.net>
X-Debian-PR-Message: ack-info-maintonly 24326

Thank you for the additional information you have supplied regarding
this problem report.  It has been forwarded to the developer(s) and
to the developers' mailing list to accompany the original report.

Your message has been sent to the package maintainer(s):
 Martin Schulze <joey@debian.org>

If you wish to continue to submit further information on your problem,
please send it to 24326@bugs.debian.org, as before.

Please do not reply to the address at the top of this message,
unless you wish to report a problem with the bug-tracking system.

Ian Jackson
(administrator, Debian bugs database)



Received: (at 24326) by bugs.debian.org; 22 Nov 1998 21:47:28 +0000
Received: (qmail 5594 invoked from network); 22 Nov 1998 21:47:27 -0000
Received: from pop.medialab.sonera.net (195.156.109.69)
  by master.debian.org with SMTP; 22 Nov 1998 21:47:27 -0000
Received: from pop.medialab.sonera.net (localhost [127.0.0.1])
	by pop.medialab.sonera.net (8.9.1a/8.9.1/Debian/GNU) with ESMTP id XAA08596
	for <24326@bugs.debian.org>; Sun, 22 Nov 1998 23:47:25 +0200
Message-Id: <199811222147.XAA08596@pop.medialab.sonera.net>
X-Mailer: exmh version 2.0.2 2/24/98 (debian) 
X-No-Archive: yes
Reply-to: Topi Miettinen <Topi.Miettinen@medialab.sonera.net>
From: Topi Miettinen <Topi.Miettinen@medialab.sonera.net>
To: 24326@bugs.debian.org
Subject: klogd -u patch update
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 22 Nov 1998 23:47:25 +0200
Sender: tom@medialab.sonera.net

Good spotting. This new patch (for klogd only) calls setgroups, setgid and
setuid to change ids, checking return values.

BTW, at least in 2.1.129 /proc/kmsg should work as required.

syslogd needs more thought. The current patch does not work, as there are
several problems:
-restart (signal): reopening sockets will fail due to insufficient
privileges (may be circumvented with checking if the sockets are already
open, unless a config change requires a new privileged inet socket)
-cleanup at exit: removing unix sockets
-log file ownership

-Topi

diff -ru ./klogd.c.orig ./klogd.c
--- ./klogd.c.orig	Sun Nov 22 22:53:24 1998
+++ ./klogd.c	Sun Nov 22 22:55:48 1998
@@ -223,6 +223,8 @@
 #include <stdarg.h>
 #include <paths.h>
 #include <stdlib.h>
+#include <pwd.h>
+#include <grp.h>
 #include "klogd.h"
 #include "ksyms.h"
 #ifndef TESTING
@@ -251,7 +253,7 @@
 #endif
 #endif
 
-static int	kmsg,
+static int	kmsg = -1,
 		change_state = 0,
 		terminate = 0,
 		caught_TSTP = 0,
@@ -508,7 +510,7 @@
 	}
 
 #ifndef TESTING
-	if ( (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0 )
+	if (kmsg == -1 && (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0)
 	{
 		fprintf(stderr, "klogd: Cannot open proc file system, " \
 			"%d - %s.\n", errno, strerror(errno));
@@ -902,12 +904,15 @@
 
 	auto char	*log_level = (char *) 0,
 			*output = (char *) 0;
-
+	uid_t           uid = 0;
+	gid_t           gid = 0;
+	struct passwd   *pw;
+  
 #ifndef TESTING
 	chdir ("/");
 #endif
 	/* Parse the command-line. */
-	while ((ch = getopt(argc, argv, "c:df:iIk:nopsvx")) != EOF)
+	while ((ch = getopt(argc, argv, "c:df:iIk:nopsu:vx")) != EOF)
 		switch((char)ch)
 		{
 		    case 'c':		/* Set console message level. */
@@ -941,6 +946,15 @@
 		    case 's':		/* Use syscall interface. */
 			use_syscall = 1;
 			break;
+		    case 'u':
+			pw = getpwnam(optarg);
+			if (!pw) {
+                                printf("Bad user name %s\n", optarg);
+                                break;
+                        }
+                        uid = pw->pw_uid;
+                        gid = pw->pw_gid;
+			break;
 		    case 'v':
 			printf("klogd %s-%s\n", VERSION, PATCHLEVEL);
 			exit (1);
@@ -1071,6 +1085,15 @@
 	if (symbol_lookup) {
 		InitKsyms(symfile);
 		InitMsyms();
+	}
+
+	if (uid > 0) {
+		if (setgroups(0, NULL) < 0 ||
+		    setgid(gid) < 0 ||
+		    setuid(uid) < 0) {
+			perror("error changing ids");
+			exit(1);
+		}
 	}
 
         /* The main loop. */






<strong>Information forwarded</strong> to <code>debian-bugs-dist@lists.debian.org, Martin Schulze &lt;joey@debian.org&gt;</code>:<br>
<code>Bug#24326</code>; Package <code>sysklogd</code>.


debian-bugs-dist@lists.debian.orgMartin Schulze <joey@debian.org>

Subject: Bug#24326: non-root syslogd
Reply-To: Topi Miettinen <Topi.Miettinen@medialab.sonera.fi>, 24326@bugs.debian.org
Resent-From: Topi Miettinen <Topi.Miettinen@medialab.sonera.fi>
Orignal-Sender: tom@pop.medialab.sonera.fi
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Martin Schulze <joey@debian.org>
Resent-Date: Sun, 04 Apr 1999 21:03:00 GMT
Resent-Message-ID: <handler.24326.B24326.9232592423873@bugs.debian.org>
Resent-Sender: iwj@debian.org
X-Debian-PR-Message: report 24326
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 
X-Loop: owner@bugs.debian.org
Received: via spool by 24326-bugs@bugs.debian.org id=B24326.9232592423873
          (code B ref 24326); Sun, 04 Apr 1999 21:03:00 GMT
X-Mailer: exmh version 2.0.2 2/24/98 (debian) 
X-No-Archive: yes
From: Topi Miettinen <Topi.Miettinen@medialab.sonera.fi>
To: 24326@bugs.debian.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 04 Apr 1999 23:53:36 +0300
Sender: tom@pop.medialab.sonera.fi
Message-Id: <19990404205336.3C3FC6DD86@pop.medialab.sonera.fi>

It's better to start execution unprivileged rather than to switch uids later. 
This patch for syslogd allows changing pid file location, which was in the 
end the only problem with that approach. Restarting daemon and exit 
cleanup are no longer a problem.

This way requires that
- /dev/log is a symlink to a daemon-writable location (/var/run/syslogd/log)
- all current log files are writable by the daemon
- savelog scripts recreate log files with suitable ownership and 
permissions

Attached are the patch, /etc/cron.daily/sysklogd, and /etc/init.d/sysklogd.

Same approach could be attempted with klogd, using a new flag for specifying 
alternate /proc/kmsg file with '-' for stdin. Start with:
su - syslogd "klogd -P -" </proc/kmsg

-Topi

diff -ru ./syslogd.c.orig ./syslogd.c
--- ./syslogd.c.orig	Sat Jan 30 19:03:09 1999
+++ ./syslogd.c	Sun Apr  4 23:33:51 1999
@@ -797,7 +797,7 @@
 		funix[i]  = -1;
 	}
 
-	while ((ch = getopt(argc, argv, "a:dhf:l:m:np:rs:v")) != EOF)
+	while ((ch = getopt(argc, argv, "a:dhf:l:m:np:P:rs:v")) != EOF)
 		switch((char)ch) {
 		case 'a':
 			if (nfunix < MAXFUNIX)
@@ -830,6 +830,9 @@
 			break;
 		case 'p':		/* path to regular log socket */
 			funixn[0] = optarg;
+			break;
+		case 'P':		/* path to pid file*/
+			PidFile = optarg;
 			break;
 		case 'r':		/* accept remote messages */
 			AcceptRemote = 1;

#! /bin/sh

# sysklogd	Cron script to rotate system log files daily.
#
#		If you want to rotate other logfiles daily, edit
#		this script.  An easy way is to add them manually
#		or to add -a to syslogd-listfiles and add some grep
#		stuff
#
#		Written by Martin Schulze <joey@debian.org>.
#		$Id: cron.daily,v 1.2 1998/01/02 03:07:21 joey Exp $

cd /var/log
for LOG in `syslogd-listfiles`
do
   if [ -f $LOG ]; then
      savelog -g bin -m 640 -u bin -c 7 $LOG >/dev/null
   fi
done

for LOG in `syslogd-listfiles --all`
do
   if [ -f $LOG ]; then
      chown syslogd.syslogd $LOG
      chmod o-rwx $LOG
   fi
done

# Restart syslogd
#
/etc/init.d/sysklogd reload

#! /bin/sh
# /etc/init.d/sysklogd: start system and kernel log daemons.

test -f /sbin/klogd || exit 0
test -f /sbin/syslogd || exit 0

# Options for start/restart the daemons
#   For remote UDP logging use SYSLOGD="-r"
#
#SYSLOGD="-u syslogd"
SPID="/home/syslogd/syslogd.pid"
SYSLOGD="-p /home/syslogd/log -P $SPID"

#  Use KLOGD="-k /boot/System.map-$(uname -r)" to specify System.map
#
KLOGD="-u syslogd"
KPID="/var/run/klogd.pid"

case "$1" in
  start)
    echo -n "Starting system log daemon: syslogd"
    su - syslogd -c "/sbin/start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD"
    echo -n " klogd"
    start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
    echo "."
    ;;
  stop)
    echo -n "Stopping system log daemon: klogd"
    start-stop-daemon --stop --quiet --pidfile $KPID
    echo -n " syslogd"
    start-stop-daemon --stop --quiet --pidfile $SPID
    echo "."
    ;;
  reload|force-reload)
    start-stop-daemon --stop --quiet --signal 1 --pidfile $SPID
    ;;
  restart)
    echo -n "Stopping system log daemon: klogd"
    start-stop-daemon --stop --quiet --pidfile $KPID
    echo " syslogd"
    start-stop-daemon --stop --quiet --pidfile $SPID
    sleep 1
    echo -n "Starting system log daemon: syslogd"
    su - syslogd -c "/sbin/start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD"
    echo -n " klogd"
    start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
    echo "."
    ;;
  *)
    echo "Usage: /etc/init.d/sysklogd {start|stop|reload|restart|force-reload}"
    exit 1
esac

exit 0





<strong>Acknowledgement sent</strong> to <code>Topi Miettinen &lt;Topi.Miettinen@medialab.sonera.fi&gt;</code>:<br>
Extra info received and forwarded to list.  Copy sent to <code>Martin Schulze &lt;joey@debian.org&gt;</code>.


-t

From: owner@bugs.debian.org (Debian Bug Tracking System)
To: Topi Miettinen <Topi.Miettinen@medialab.sonera.fi>
Subject: Bug#24326: Info received (was non-root syslogd)
Message-ID: <handler.24326.B24326.9232592423873.ackinfo@bugs.debian.org>
In-Reply-To: <19990404205336.3C3FC6DD86@pop.medialab.sonera.fi>
References: <19990404205336.3C3FC6DD86@pop.medialab.sonera.fi>
X-Debian-PR-Message: ack-info-maintonly 24326

Thank you for the additional information you have supplied regarding
this problem report.  It has been forwarded to the developer(s) and
to the developers' mailing list to accompany the original report.

Your message has been sent to the package maintainer(s):
 Martin Schulze <joey@debian.org>

If you wish to continue to submit further information on your problem,
please send it to 24326@bugs.debian.org, as before.

Please do not reply to the address at the top of this message,
unless you wish to report a problem with the bug-tracking system.

Ian Jackson
(administrator, Debian bugs database)



Received: (at 24326) by bugs.debian.org; 4 Apr 1999 20:54:02 +0000
Received: (qmail 3870 invoked from network); 4 Apr 1999 20:54:02 -0000
Received: from pop.medialab.sonera.fi (195.156.109.69)
  by master.debian.org with SMTP; 4 Apr 1999 20:54:02 -0000
Received: from pop.medialab.sonera.fi (localhost [127.0.0.1])
	by pop.medialab.sonera.fi (Postfix) with ESMTP id 3C3FC6DD86
	for <24326@bugs.debian.org>; Sun,  4 Apr 1999 23:53:36 +0300 (EEST)
X-Mailer: exmh version 2.0.2 2/24/98 (debian) 
X-No-Archive: yes
Reply-To: Topi Miettinen <Topi.Miettinen@medialab.sonera.fi>
From: Topi Miettinen <Topi.Miettinen@medialab.sonera.fi>
To: 24326@bugs.debian.org
Subject: non-root syslogd
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 04 Apr 1999 23:53:36 +0300
Sender: tom@pop.medialab.sonera.fi
Message-Id: <19990404205336.3C3FC6DD86@pop.medialab.sonera.fi>

It's better to start execution unprivileged rather than to switch uids later. 
This patch for syslogd allows changing pid file location, which was in the 
end the only problem with that approach. Restarting daemon and exit 
cleanup are no longer a problem.

This way requires that
- /dev/log is a symlink to a daemon-writable location (/var/run/syslogd/log)
- all current log files are writable by the daemon
- savelog scripts recreate log files with suitable ownership and 
permissions

Attached are the patch, /etc/cron.daily/sysklogd, and /etc/init.d/sysklogd.

Same approach could be attempted with klogd, using a new flag for specifying 
alternate /proc/kmsg file with '-' for stdin. Start with:
su - syslogd "klogd -P -" </proc/kmsg

-Topi

diff -ru ./syslogd.c.orig ./syslogd.c
--- ./syslogd.c.orig	Sat Jan 30 19:03:09 1999
+++ ./syslogd.c	Sun Apr  4 23:33:51 1999
@@ -797,7 +797,7 @@
 		funix[i]  = -1;
 	}
 
-	while ((ch = getopt(argc, argv, "a:dhf:l:m:np:rs:v")) != EOF)
+	while ((ch = getopt(argc, argv, "a:dhf:l:m:np:P:rs:v")) != EOF)
 		switch((char)ch) {
 		case 'a':
 			if (nfunix < MAXFUNIX)
@@ -830,6 +830,9 @@
 			break;
 		case 'p':		/* path to regular log socket */
 			funixn[0] = optarg;
+			break;
+		case 'P':		/* path to pid file*/
+			PidFile = optarg;
 			break;
 		case 'r':		/* accept remote messages */
 			AcceptRemote = 1;

#! /bin/sh

# sysklogd	Cron script to rotate system log files daily.
#
#		If you want to rotate other logfiles daily, edit
#		this script.  An easy way is to add them manually
#		or to add -a to syslogd-listfiles and add some grep
#		stuff
#
#		Written by Martin Schulze <joey@debian.org>.
#		$Id: cron.daily,v 1.2 1998/01/02 03:07:21 joey Exp $

cd /var/log
for LOG in `syslogd-listfiles`
do
   if [ -f $LOG ]; then
      savelog -g bin -m 640 -u bin -c 7 $LOG >/dev/null
   fi
done

for LOG in `syslogd-listfiles --all`
do
   if [ -f $LOG ]; then
      chown syslogd.syslogd $LOG
      chmod o-rwx $LOG
   fi
done

# Restart syslogd
#
/etc/init.d/sysklogd reload

#! /bin/sh
# /etc/init.d/sysklogd: start system and kernel log daemons.

test -f /sbin/klogd || exit 0
test -f /sbin/syslogd || exit 0

# Options for start/restart the daemons
#   For remote UDP logging use SYSLOGD="-r"
#
#SYSLOGD="-u syslogd"
SPID="/home/syslogd/syslogd.pid"
SYSLOGD="-p /home/syslogd/log -P $SPID"

#  Use KLOGD="-k /boot/System.map-$(uname -r)" to specify System.map
#
KLOGD="-u syslogd"
KPID="/var/run/klogd.pid"

case "$1" in
  start)
    echo -n "Starting system log daemon: syslogd"
    su - syslogd -c "/sbin/start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD"
    echo -n " klogd"
    start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
    echo "."
    ;;
  stop)
    echo -n "Stopping system log daemon: klogd"
    start-stop-daemon --stop --quiet --pidfile $KPID
    echo -n " syslogd"
    start-stop-daemon --stop --quiet --pidfile $SPID
    echo "."
    ;;
  reload|force-reload)
    start-stop-daemon --stop --quiet --signal 1 --pidfile $SPID
    ;;
  restart)
    echo -n "Stopping system log daemon: klogd"
    start-stop-daemon --stop --quiet --pidfile $KPID
    echo " syslogd"
    start-stop-daemon --stop --quiet --pidfile $SPID
    sleep 1
    echo -n "Starting system log daemon: syslogd"
    su - syslogd -c "/sbin/start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD"
    echo -n " klogd"
    start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
    echo "."
    ;;
  *)
    echo "Usage: /etc/init.d/sysklogd {start|stop|reload|restart|force-reload}"
    exit 1
esac

exit 0





<strong>Merged 24326 35325.</strong>
Request was from <code>Andreas Barth &lt;aba@not.so.argh.org&gt;</code>
to <code>control@bugs.debian.org</code>. 


Received: (at control) by bugs.debian.org; 28 Jul 2003 11:19:56 +0000
From aba@not.so.argh.org Mon Jul 28 06:19:54 2003
Return-path: <aba@not.so.argh.org>
Received: from svr7.m-online.net [62.245.150.229] 
	by master.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 19h62k-0005Wz-00; Mon, 28 Jul 2003 06:19:54 -0500
Received: from sol.so.argh.org (ppp-62-245-208-15.mnet-online.de [62.245.208.15])
	by svr7.m-online.net (Postfix) with ESMTP id 97EA56CABA
	for <control@bugs.debian.org>; Mon, 28 Jul 2003 13:19:53 +0200 (CEST)
Received: from aba by sol.so.argh.org with local (Exim 4.14 #1 (Debian) [+prerelease])
	id 19h62k-0001yW-MJ
	for <control@bugs.debian.org>; Mon, 28 Jul 2003 13:19:54 +0200
Date: Mon, 28 Jul 2003 13:19:54 +0200
From: Andreas Barth <aba@not.so.argh.org>
To: control@bugs.debian.org
Subject: house-keeping
Message-ID: <20030728111954.GK1900@mails.so.argh.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.3.28i
X-Editor: Vim http://www.vim.org/
Delivered-To: control@bugs.debian.org
X-Spam-Status: No, hits=-3.0 required=4.0
	tests=BAYES_20,USER_AGENT_MUTT
	version=2.53-bugs.debian.org_2003_07_20
X-Spam-Level: 
X-Spam-Checker-Version: SpamAssassin 2.53-bugs.debian.org_2003_07_20 (1.174.2.15-2003-03-30-exp)

retitle 37193 hangs if unable to talke to nameservers

# all about "hangs if can't log"
# perhaps 37193 should also be merged here, but I'm not sure
retitle 45245 syslogd got stuck if writing to one logfile is unavailable
severity 93594 normal
merge 93594 45245

# submitter said in Oct 2000 bug can be closed
close 72953

tags 135485 +patch

# all the same problem with potato to woody upgrade and using old init.d
severity 139621 normal
merge 139621 135818 153673

tags 165472 +patch

# mdz tried this before but failed
retitle 199554 Missing kernel messages
tags 199554 +unreproducible

tags 192841 +patch

# both reports are about running without root priviliges
merge 24326 35325

tags 56595 +patch

tags 104278 +patch

severity 126616 normal
tags 126616 +patch

tags 127620 +patch

tags 162688 +patch

# NMU was not accepted, so set all back
tags 132873 -fixed
severity 164153 normal
merge 132873 164153
-- 
   http://home.arcor.de/andreas-barth/
   PGP 1024/89FB5CE5  DC F1 85 6D A6 45 9C 0F  3B BE F1 D0 C5 D1 D9 0C