Understanding the bin, sbin, usr/bin , usr/sbin split

Rob Landley rob at landley.net
Thu Dec 9 15:45:39 UTC 2010

• Previous message: Applet for detecting the filesystem type.
• Next message: Understanding the bin, sbin, usr/bin , usr/sbin split
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

---

On Tuesday 30 November 2010 15:58:00 David Collier wrote: > I see that busybox spreads it's links over these 4 directories. > > Is there a simple rule which decides which directory each link lives > in..... > > For instance I see kill is in /bin and killall in /usr/bin.... I don't > have a grip on what might be the logic for that.  You know how Ken Thompson and Dennis Ritchie created Unix on a PDP-7 in 1969?   Well around 1971 they upgraded to a PDP-11 with a pair of RK05 disk packs (1.5  megabytes each) for storage.  When the operating system grew too big to fit on the first RK05 disk pack (their  root filesystem) they let it leak into the second one, which is where all the  user home directories lived (which is why the mount was called /usr).  They  replicated all the OS directories under there (/bin, /sbin, /lib, /tmp...) and  wrote files to those new directories because their original disk was out of  space.  When they got a third disk, they mounted it on /home and relocated all  the user directories to there so the OS could consume all the space on both  disks and grow to THREE WHOLE MEGABYTES (ooooh!).  Of course they made rules about "when the system first boots, it has to come up  enough to be able to mount the second disk on /usr, so don't put things like  the mount command /usr/bin or we'll have a chicken and egg problem bringing  the system up."  Fairly straightforward.  Also fairly specific to v6 unix of 35  years ago.  The /bin vs /usr/bin split (and all the others) is an artifact of this, a  1970's implementation detail that got carried forward for decades by  bureaucrats who never question _why_ they're doing things.  It stopped making  any sense before Linux was ever invented, for multiple reasons:  1) Early system bringup is the provice of initrd and initramfs, which deals  with the "this file is needed before that file" issues.  We've already _got_ a  temporary system that boots the main system.  2) shared libraries (introduced by the Berkeley guys) prevent you from  independently upgrading the /lib and /usr/bin parts.  They two partitions have  to _match_ or they won't work.  This wasn't the case in 1974, back then they  had a certain level of independence because everything was statically linked.  3) Cheap retail hard drives passed the 100 megabyte mark around 1990, and  partition resizing software showed up somewhere around there (partition magic  3.0 shipped in 1997).  Of course once the split existed, some people made other rules to justify it.   Root was for the OS stuff you got from upstream and /usr was for your site- local files.  Then / was for the stuff you got from AT&T and /usr was for the  stuff that your distro like IBM AIX or Dec Ultrix or SGI Irix added to it, and  /usr/local was for your specific installation's files.  Then somebody decided  /usr/local wasn't a good place to install new packages, so let's add /opt!   I'm still waiting for /opt/local to show up...  Of course given 30 years to fester, this split made some interesting distro- specific rules show up and go away again, such as "/tmp is cleared between  reboots but /usr/tmp isn't".  (Of course on Ubuntu /usr/tmp doesn't exist and  on Gentoo /usr/tmp is a symlink to /var/tmp which now has the "not cleared  between reboots" rule.  Yes all this predated tmpfs.  It has to do with read- only root filesystems, /usr is always going to be read only in that case and  /var is where your writable space is, / is _mostly_ read only except for bits  of /etc which they tried to move to /var but really symlinking /etc to  /var/etc happens more often than not...)  Standards bureaucracies like the Linux Foundation (which consumed the Free  Standards Group in its' ever-growing accretion disk years ago) happily  document and add to this sort of complexity without ever trying to understand  why it was there in the first place.  'Ken and Dennis leaked their OS into the  equivalent of home because an RK05 disk pack on the PDP-11 was too small" goes  whoosh over their heads.  I'm pretty sure the busybox install just puts binaries wherever other versions  of those binaries have historically gone.  There's no actual REASON for any of  it anymore.  Personally, I symlink /bin /sbin and /lib to their /usr  equivalents on systems I put together.  Embedded guys try to understand and  simplify...  Rob --  GPLv3: as worthy a successor as The Phantom Menace, as timely as Duke Nukem  Forever, and as welcome as New Coke.

via lists.busybox.net

Internet Against SOPA, PIPA | The Onion - America's Finest News Source

January 26, 2012

Internet Against SOPA, PIPA

Last week, several websites, including Google and Wikipedia, raised awareness of the prohibitive measures included in the Stop Online Piracy Act (SOPA) and the Protect IP Act (PIPA). Here are some of the legislation's controversial provisions:

• Music review sites can only allude to a song's title and content in vague terms
• All pirated material available only at the Commerce Department's new site, Torrent.gov
• Government will actively encourage people to download only public-domain music, such as Pipey Lester's "That Cat's a-Mewing!" or Ukulele Ted's "Nickel For Your Hat"
• Denies future generations the ability to watch hilarious scene from Dirty Work where Chris Farley yells at the Asian hooker anytime, free of charge, which is a fundamental right of being an American
• Does absolutely nothing to get rid of goddamn Lolcats
• Makes the MPAA and RIAA feel better, which, if you have any shred of a soul, causes pure rage to swell through your very being
• Any person suspected of Photoshopping bill sponsor Rep. Lamar Smith (R-TX) in an unflattering manner shall be subject to a minimum sentence of two months in prison; sentence will be increased by an additional two months if MS Paint is used
• No longer legal to steal Ryan Gosling's credit card information

• Email
• Print
• Share

  Share

  • Facebook
  • Digg
  • Stumble
  • Reddit

Recent Infographic

• 

  Romney Facing Flak For Turn As Venture Capitalist

  01.19.12 | ISSUE 48•03

• 

  Detroit Ending 24-Hour Police Station Access

  01.12.12 | ISSUE 48•02

• 

  Best Debate Moments

  01.05.12 | ISSUE 48•01

More Infographic

• 

  Kmart's Woes

  03.27.02 | ISSUE 38•11

• 

  American Secrets For Sale

  09.15.11 | ISSUE 47•37

• 

  Exotic Pet Fever

  02.25.98 | ISSUE 33•07

via theonion.com

Security Onion Intrusion Detection System Basic Setup Tutorial « CYBER ARMS – Computer Security

Security Onion is one of my favorite tools. Doug Burks did an amazing job pulling many of the top open source Network Security Monitoring (NSM) and Intrusion Detection System (IDS) programs. You can run Security Onion in Live CD mode, or you can install it and run it off of your hard drive.

It’s based on Xubuntu 10.04 and contains a ton of programs including Snort, Suricata, Sguil, Squert, argus, Xplico, tcpreplay, scapy, hping, and many other security tools. Sounds complicated right? Well, Doug has done the hard work in pulling all these tools together into an easy to use Linux distribution.

Run this on a system that has two network cards and you have a complete NSM/IDS system. One NIC connects to your network or the internet side of your traffic and records and monitors every packet that comes in or goes out of your system. The second NIC connects to your LAN side and can be used to remotely view and monitor intrusion attempts and security threats.

The exceptional basic setup video above was created by Adrian Crenshaw aka “Irongeek”. Adrian has always done an amazing job passing on information on the latest security tools and techniques. Irongeek.com has a ton of videos and security how too’s, check it out!

Share this:

• StumbleUpon
• Digg
• Reddit
• Twitter2

Like this:

Like

One blogger likes this post.

• 

~ by D. Dieterle on January 24, 2012.

Posted in Computer Security
Tags: intrusion attempts, Intrusion Detection, intrusion detection system, intrusion detection system ids, Intrusion Prevention, Linux Security, Network Security Monitoring, scapy, Security Onion, squert

via cyberarms.wordpress.com

Happy New Year! | The Best Article Every day

via bspcn.com

To Infinity and Beyond - Horizon - BBC - YouTube

via youtube.com

everyday_i_show: photos by Robert Doisneau

via everyday-i-show.livejournal.com

Log In

via niemann.blogs.nytimes.com

Genius!

The Making of Blade Runner | Open Culture

via openculture.com

Network Dictionary – powerpointalism — My Etherealmind

Rough term for an event where PowerPoint presentations are occurring in multiple rooms. You might call it a conference, but really it’s a powerpointalism experience. The definition of a conference —a formal meeting for discussion — doesn’t really apply since only the people up the front are talking and everyone else is listening. Generally, you want to be involved.

Note that powerpointalism can also be a noun “I’m experiencing powerpointalism” or more simply, setting one’s status to “powerpointalism” explains your current status.

Note that powerpointalism is how you experience marketecture.

Compare with PowerPoint Waterboarding which tends to occur in much smaller groups that you can’t escape from.

With reference to @aneel during Cisco Live Conference in Las Vegas, 2011.

• Share this:
• Email

-->

via etherealmind.com

LulzSec Went After Qakbot, Mariposa Bots - Dark Reading

Had the now-defunct LulzSec hacking group had its demands met earlier this month for getting botnet intelligence from startup Unveillance, it could have wrested control of a portion of the infamous Qakbot's command-and-control infrastructure that's under the purview of the security firm.

The bots Unveillance had sinkholed are Qakbot-infected machines as well as some Mariposa-infected machines, which could have been a treasure trove of botnet firepower for the hacking group, security experts say. Qakbot is a Trojan that spreads like a worm, and its goal is to steal financial accounts and ultimately help siphon money. The botnet has been spotted on the rise, most recently infecting 1,500 Massachusetts state PCs and possibly exposing personal information of some 250,000 state residents.

Karim Hijazi, CEO and president at Unveillance, which uses sinkhole servers to pose as botnet servers that capture communique from orphaned bots, says his firm controls a large portion of the Qakbot botnet's command-and-control infrastructure via its sinkhole servers. "I believe [LulzSec] wanted it for use for a variety of reasons," Hijazi says. "Fraud, information-stealing, reverse-proxy, [etc.]."

In addition, Unveillance sinkholed some Mariposa bots, which LulzSec was also interested in obtaining. Although law enforcement controls the Mariposa command-and-control servers themselves, there are still plenty of machines worldwide infected with the bot malware. "We still see over 4 million events/communications from infected machines part of Mariposa per hour and over 100,000 unique IP addresses an hour," Hijazi says.

LulzSec wanted Mariposa for DDoS purposes, says Pedro Bustamante, senior research adviser for Panda Security. "It’s important to note that even if LulzSec [was able] to completely hack Unveillance and take over their systems, this will not have an impact on LulzSec getting access to the Mariposa botnet," Bustamante says. "The reason is that the DNS records for the Mariposa command-and-control servers are under the control of law enforcement, and are only being redirected to Unveillance for sinkholing purposes ... we can change the DNS records for the main C&C domains and point them somewhere else as to minimize the impact" of any theft of those existing Mariposa bots, he says.

Clues to LulzSec's botnet intentions began to surface last month, when Unveillance discovered some unusual traffic patterns around its network. On May 25, Hijazi noticed something funny was going on with his email account as well. "An email I saw on my phone was showing as already-read on my computer," even though he had not opened the message yet, he recalls.

Minutes later, he witnessed an email in his inbox go from "unread" to "read" and then back to "unread" again. "That was a really compelling event," he says. Between that and the unusual traffic trying to get past Unveillance's firewalls, something was definitely going amiss: "It was lockdown time," he says.

In the wee hours of the morning, Hijazi received an email with his Infragard password in the subject line, and a message asking if he wanted "to talk," and signed "Love, Friends." He gathered his team at 4:30 a.m., and they began brainstorming and shoring up security.

It wasn't until later in an online chat with the hackers that Hijazi learned what the attackers really wanted: "They ... [were] saying, 'We want your botnet information' or they would 'dox' us," he says. Among their demands was Qakbot information and its sinkholes: "They wanted [me] to convey ownership of the domain for DDoS'ing. They wanted command and control of those DDoS botnets," Hijazi says.

When Hijazi refused, they demanded money, but he replied that his firm was a start-up and didn't have any money. "On Friday, they dumped my emails online, and InfraGard was taken down," he says.

While Anonymous -- from which LulzSec originally spun off -- has been best known for using "crowdsource" distributed denial-of-service (DDoS) attacks using the Low Orbit Ion Cannon (LOIC) tool, the group also has relied on established botnets to take down websites it targets.

Meanwhile, Hijazi says the AntiSec operation headed by Anonymous is hosting a new hacker training school via an IRC chat room for new recruits. "New information about their 'new' AntiSecPro hacker training school shows intent to use the ZeuS source code to train new recruits [bot-herders] how to compile and deploy a ZeuS botnet," Hijazi says.

Aside from the Zeus training and offering source code for Zeus 2.0.8.9, the "#school4lulz" training includes language injection via HTTP, IDS evasion, SQL injection techniques, botnet C&C protocol selection, takeover mitigation, social engineering skills, war-driving, and how to find an individual's personal information online, Unveillance says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

via darkreading.com