SCIENTIFIC-LINUX-USERS Archives

March 2019

SCIENTIFIC-LINUX-USERS@LISTSERV.FNAL.GOV

Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
From:
Stephan Wiesand <[log in to unmask]>
Reply To:
Stephan Wiesand <[log in to unmask]>
Date:
Fri, 29 Mar 2019 16:32:10 +0100
Content-Type:
text/plain
Parts/Attachments:
text/plain (28 lines)
> On 29. Mar 2019, at 16:07, Howard, Chris <[log in to unmask]> wrote:
> 
>  
> Our security guy runs a scanning system called Qualys.
> He gave me an rpm file to install and a couple of commands to run.
>  
> It appears to have installed the agent ok.
>  
> But I see in the log file that it is trying to do a pattern match to determine the OS name and version.
> It is looking for CentOS and RedHat and Oracle Unbreakable Linux… but can’t figure this one out.

Sigh. Been there.

> Might there be some simple thing I can tweak to help?

The best solution is of course to convince the Qualys folks (which I'd consider "white hats" and pretty professional in the security realm) that SL is a viable EL clone too. I guess you're paying for that security scanner, so this shouldn't be all that hard.

Other solutions depend on what exactly the scanner is doing to determine the OS:

If it examines /etc/redhat-release, changing that file to what it looks like on a genuine RHEL System is fairly easy and will do the trick. I'm not aware of any ill side effects, and to the best of my knowledge it doesn't violate Red Hat's trademarks and debranding requirements.

If that's not an option, use strace/ltrace to find out what exactly is checked, and play dirty tricks like

 * prepending $PATH for the scanner to include a folder with a hacked grep executable
 * set $LD_PRELOAD for the scanner to preload a shared lib intercepting the crucial calls

Hope this helps.

ATOM RSS1 RSS2