Messages in this thread | | | Date | Sun, 17 Mar 1996 23:01:18 -0600 (CST) | From | Doug Ledford <> | Subject | System Tuning |
| |
I have received several letters back to the effect of use the bash ulimit or tcsh limit function to solve the memory usage problem. I would like to point out that in the original post I did mention that this was for larger systems running as (in our case) the shell server for our ISP. The fork bomb I wrote about in the previous letter was not a fluke, nor was it experimentation. It was created by a user, signed up with a fraudulent application, who happened to be a local competitior of ours. The solution I'm looking for here is something like what SCO has in their Unix. In other words, ulimit statements in the /etc/profile can be circumvented by a regular user, at least by one who has the experience and knowledge to be a hacker. I want something that isn't so easily circumvented, and the best (only?) place I can think of to put it is in the kernel since it handles all memory allocation anyway.
As a side note, one of the letters mentioned that these types of security measures would make the system "inconveniently secure". For regular desktop machines, I agree. For that reason I would say leave the defaults as they are now. No need to make the default MAX_USER_TASKS = 32 like it is on my system. But, in my case, it is a FAR GREATER inconvenience to get paged at 4:00AM to come in and reboot a system taken down by a fork bomb than it is to modify some defines about maximum user tasks and (hopefully in the future) maximum user memory.
This leads me to my second thought. Since most people wouldn't need to modify these defines and make their system inconveniently secure, then I formally withdraw the suggestion of "make tune". Instead, make the ktune.h file sufficiently commented as to dependencies that a reasonably experienced person can vi the file and make the changes necessary, but new users not aware of what they are doing won't break their system by running make tune and changing things to unreasonable, unuseable values. The only other option would be to put warnings around make tune so that new users are aware that they can render their system unbootable by fiddling with these values, or you would have to check values for problems in the process of changing them and disallow any values out a certain range (such as too few tasks or file handles). This, in turn would greatly increase the complexity of the make tune function I believe.
***************************************************************************** * Doug Ledford * Unix, Novell, Dos, Windows 3.x, * * dledford@dialnet.net 873-DIAL * WfW, Windows 95 & NT Technician * * PPP access $14.95/month ***************************************** * Springfield, MO and surrounding * Usenet news, e-mail and shell account.* * communities. Sign-up online at * Web page creation and hosting, other * * 873-9000 V.34 * services available, call for info. * *****************************************************************************
| |