Remember Aaron Swartz

I never knew Aaron Swartz personally. However I was well aware of his work as an activist.

I remember how outraged I became when I learned of SOPA/PIPA at the time. Looking back unlike him I was one of many followers, trying to spread the work around. Whether through friends, people that I knew, emails to Congress representatives or boycotting in my own way the despicable companies that supported it, like GoDaddy, who became the poster child of the type of companies people saw as backing up that bill. But what I and many others did, was follow his lead. My actions were the result of his efforts.

The news of his suicide came as a complete shock to me (Link). I won’t lie, I did not follow the trial very closely. Had I, maybe I would have realized how bullied he was by the government/prosecutor.

RHEL 6 - LDAP without TLS

I’m realizing that many (much like myself) were surprised to find how many of Red Hat’s changes to RHEL 6 are simply not properly documented. While being all for security of course, the idea that Red Hat requires you to change something as fundamental as your backend authentication mechanisms when introducing a new system to your network without notifying you beforehand strikes me as odd.

I’ve put together a step by step list of directions that would help you make the necessary changes to allow your RHEL 6 server to use a non-secure LDAP server, providing you with additional time to implement LDAP with TLS network-wide.

Install LDAP client

yum install openldap-client*

Create LDAP client config

vi /etc/openldap/ldap.conf 
BASE dc=domain,dc=com URI ldap://ldap.domain.com:389 
SIZELIMIT 12 
TIMELIMIT 15

Disable TLS

vi /etc/sysconfig/authconfig 
Change FORCELEGACY=no to FORCELEGACY=yes 
authconfig —enableldap —enableldapauth —enablemkhomedir\
—ldapserver=ldap.domain.com —ldapbasedn=”dc=domain,dc=com” —update

Install local LDAP name service daemon

yum install nss-pam-ldapd 
/etc/init.d/nslcd start 
chkconfig nslcd on

Add the neccessary users to sudoers file (permissive setting)

/usr/sbin/visudo  
%groupname ALL=(ALL) ALL 

Disable IPTables and SELinux

service iptables stop 
chkconfig iptables off 
setenforce 0

Automatic home directory creation

vi /etc/pam.d/login session required pam_mkhomedir.so skel=/etc/skel umask=0022
vi /etc/pam.d/sshd session required pam_mkhomedir.so skel=/etc/skel umask=0022

Reboot

reboot

Disclaimer: Using TLS for LDAP authentication is very important, adding a secure layer to a core part of your network.

Unless I am mistaken, we are to fear a man who blows the whistle on war crimes, yet trust the criminals who operate in stealth and secrecy

“No one loves the messenger who brings bad news” this sentiment was expressed in “Antigone” by Sophocles. It then evolved to “Don’t shoot the messenger” by Shakespeare in “Henry IV”.

In the past messengers chosen to carry bad new to the monarch from the war front were essentially sent on a suicide mission. Most of the time they were swiftly executed shortly after relaying the message.

Thankfully these days are long gone. Or are they?

Remember back when the media had the balls to be that bearer of actual news? When journalists were not afraid to poke politicians in the eye with their typewriter. Stab the scum with their pens. Quite often behind these brave journalists are even braver whistleblowers. People with scruples that when faced with corruption choose to act exposing it in the process: Daniel Ellsberg (Deep Throat who’s identity was kept a secret until 2005) that back in 1971 leaked information about United States President Richard Nixon’s involvement in Watergate. The scandal would eventually lead to the resignation of the president, and prison terms for White House Chief of Staff H. R. Haldeman and presidential adviser John Ehrlichman.

Dr. Ramin Pourandarjani the Iranian whistleblower who reported on the state use of torture on political prisoners. He died of poisoning shortly thereafter.

As long as it doesn’t hit close to home these people would be viewed as admirable “Freedom fighters”, believing in breaking the wall of silence surrounding the corrupt totalitarian regime they live in. Inspiring foreign news reporters to write articles depicting them as David fighting Goliath. Cue Pfc. Bradley E. Manning, a man who blew the whistle on US war crimes. Manning is in solitary confinement subjected to brutal torture by a sexual sadist Denise Barnes made to sleep naked nightly. The “free” media abiding by the directives disseminated from the democratically elected, US- government rarely mentioning a thing about it. What would this very government say if this were to take place in let’s say…the despicable regime in Iran?

Such hypocrisy!

Unless you’re a complete idiot (Looking at you Fox News watchers) you would attest to the fact that none of us would have known the meaning of justice, if it weren’t for the messenger, that bearer of bad news.

References:

Wikipedia

The Guardian

The New York Times