Security Advancements at the Monastery

“If you have any trouble sounding condescending, find a Unix user to show you how it’s done.” –Scott Adams

Today, I did some hacking. Not as in “hacking into systems,” but as in “hacking to get things to work.” Sometimes in life things do not work as they should and you just have to keep hacking away. Did I say “sometimes”? A good day is when you get the software to work before the sun rises. I still have a few hours to go. As with most die hard hackers, I am eternally optimistic. If we weren’t, we would never attempt anything.

Today, I had to get some software running under Mac OS X. I am old time UNIX person. I am use to pulling down source, configuring, compiling, and installing. Mac OS X can make life a little more challenging. For anyone struggling with installation problems, I figured I would provide one way to get things working. Not my preferred way, but sometimes we have to do what works.

In the end, I had to install MacPorts. MacPorts was formerly DarwinPorts. To catch new users up to speed, let me provide the Wikipedia description:

MacPorts, formerly called DarwinPorts, is a free/open source software project to simplify installation of other free/open source software on the Mac OS X and Darwin operating systems. Similar to Fink and the BSDs’ ports collections, DarwinPorts was started in 2002 as part of the OpenDarwin project, with the involvement of a number of Apple Computer employees including Landon Fuller, Kevin Van Vechten, and Jordan Hubbard.

If you are confused because you thought Mac OS X is just a slight variation on the BSD kernel, please check out Amit Singh book, Mac OS X Internals. The book describes the architecture and design of Apple’s operating system. If you don’t want that much details, go over to IT Conversations and listen to Mr. Singh discuss Mac OS X Internals. Mr. Singh’s personal website is over at kernelthread.com.

Please, do not misunderstand me. MacPorts is a great help to anyone who has to develop on Mac OS X. It is just that I like to keep things as close to the OS as possible. This means, when installing software, I like running configuration commands and compiling the software myself. While I know using packages/RPMs make administration easier, it also makes the person installing the packages less aware of how the packages were configured and installed. Frequently, the packages are installed with the configuration that will work in most environments. Generally, that will not be the most secure way of configuring the package.

In the case of installing a package like MacPorts, you are installing a whole new sets of libraries. If you want to install Perl modules under MacPorts, it will install its own version of Perl. When you install a Perl packages, it pulls down the dependencies and handles everything. Most people installing the packages have no idea what they have put on their system.

I am going to pull the instructions from the MacPorts site, as far as its installation instructions. Then I will add to those instructions.

1. Install Xcode Tools

1. Download the latest verson of Xcode Tools from Apple’s developer site —do not install an older version from the OS X 10.4 install disk or some ports may fail to install.
2. Run the binary installer.

Notes:
Xcode Tools is neither installed nor updated via the Software Update utility. You will want to makre sure you keep it up to date.

2. Install X Windows (X11)

On OS X 10.4, Apple’s X11 is an optional install (MacPorts’ X11 package is not recommended at this time). If the application X11 is not present in /Applications/Utilities:

1. Insert the OS X 10.4 installation DVD and run the package named Additional Software.
2. At the software selection window expand the Applications category and click the checkbox beside X11 (and nothing else).
3. Click Install to install X11.
4. Drag the /Applications/Utilities/X11 icon to your dock —you must open X11 before launching an X11 application.

Notes:

• X Windows (X11) is required for many MacPorts apps and it is highly recommended that you install it even if you don’t plan to run X11 apps immediately.
• The X11SDK is also required to run X11 software, but it is installed by default during the Xcode Tools install above. If you wish to check to see if X11 (X11User) and X11SDK are installed, look in /Library/Receipts for the files X11User.pkg and X11SDK.pkg.

3. Set the shell environment

Setting the Unix shell environment is critical for MacPorts to function.
Requirements for the MacPorts’ shell environment

You will want to make the ~/.profile file adds the MacPorts paths in front of the standard UNIX paths for the default BASH shell. This is done so that if you have utilities or libraries from both MacPorts and OS X’s standard install, the MacPorts libraries will be run instead of the ones provided by Apple. You can change the PATH via the command line with the command:

export PATH=/opt/local/bin:/opt/local/sbin:$PATH

You’ll need to add this variable to your ~/.profile to run X11 applications:

export DISPLAY=:0.0

So a ~/.profile file might look like this:

export PATH=/opt/local/bin:/opt/local/sbin:$PATH
export DISPLAY=:0.0

Note:

• Changes to ~/.profile do not take effect on the current shell session — they take effect on new sessions so open a new shell session and type ‘env’ to see the path and variable changes.
• Other profile files may take precedence over ~/.profile. If you are using one of the following profile files in your home directory, you will need to merge the contents of it into ~./profile, or vice versa because the shell will ignore one of them:
  • ~/.bash_login
  • ~/.bash_profile

Verify the shell environment

To verify that your ~/.profile has set your shell environment:

• Open a new terminal window
• Type the command: env

Check to make sure the reported path begins with the MacPorts’ paths as show above.

Sample output of command env:

TERM_PROGRAM=Apple_Terminal
TERM=xterm-color
SHELL=/bin/bash
PATH=/opt/local/bin:/opt/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin

4. Install MacPorts

Install MacPorts using the binary installer (to /opt/local/ only)

1. Download the latest MacPorts .dmg disk image, currently version 1.4.0.
2. Run the binary installer.
3. Perform the default “easy” install.

Note:

• A MacPorts’ selfupdate (see below) will automatically update to the latest release if the binary .dmg image is behind the latest released tarball.

Install MacPorts from source (to any path except /usr/local/)

1. Download and unzip the latest MacPorts tarball from the MacPorts download area.
2. Perform these commands in a terminal window.

   cd ~/MacPorts-1.4.0/
   ./configure
   make
   sudo make install
   

Note:

• To see why /usr/local is not a viable install location for MacPorts, see the MacPorts FAQ

Note: Developer releases contain untested code and may have bugs. Use at your own risk.

5. Update MacPorts via selfupdate

The ‘port selfupdate’ command must be run after a new MacPorts install, and frequently thereafter. The command updates MacPorts with the latest port revisions, and, if necessary, updates MacPorts to the latest release.

1. Open a terminal window.
2. Execute the MacPorts selfupdate command.

   sudo port selfupdate
   

or for verbose output:

sudo port -d selfupdate

6. Installing Packages

Now you are going to start installing packages under MacPorts. A good place to see what packages have been ported over to MacPorts is to go to the main Darwin Ports Repository. It still has the old name, but it is the MacPorts site. It has a search area where you can enter the package name and find installation instructions.

For example, if you wanted to install the GNU multiple precision arithmetic library (GMP), you would execute the MacPorts install command for GMP.

sudo port install gmp

At this point, you should see the following output:

--->  Fetching gmp
--->  Attempting to fetch gmp-4.2.1.tar.bz2 from http://ftp.gnu.org/gnu/gmp
--->  Verifying checksum(s) for gmp
--->  Extracting gmp
--->  Configuring gmp
--->  Building gmp with target all
--->  Staging gmp into destroot
--->  Running ranlib on static libraries
--->  Installing gmp 4.2.1_4+test
--->  Activating gmp 4.2.1_4+test
--->  Cleaning gmp

I started this post to explain how to install another package, not listed above. It ended up getting hung during the installation of the package. So everything is not sunshine and rainbows even when using MacPorts. I found a solution that did not use MacPorts. Still, the next project I worked on involved an IDS solution using Bro. While I initially installed the packages without MacPorts, I ran into some results I did not trust. The nice thing with MacPorts is that with a change of your PATH, you can include or exclude the libraries and executables. MacPorts can be most useful, even if you do not use it that frequently.