MAJOR hole in 5.0

Gareth Westwood gareth at kibblestone-uk.fsnet.co.uk
Thu Sep 25 16:17:15 PDT 2003


Ian Molton wrote:
> On Thu, 25 Sep 2003 21:35:25 +0200
> Matthias Benkmann <matthias at winterdrache.de> wrote:
> 
> 
>>Could someone please tell me, how a user account called "nobody" with
>>no valid shell and no password that doesn't own any files is a major
>>security risk and a user account called "miller" with a valid shell
>>and password that owns files and has write access to /home/miller is
>>not?
> 
> 
> the problem was 'nobody' in the current book DOES have a shell.
> admittedly not a massive problem but many daemons assume nobody to be an
> unprivelidged user with no files of its own.
> 
> 
also, it is one extra user that (me/ prepares to be flamed) doestn't 
need to be there. Sruely it is better to remove "standard" account 
names, it makes brute force attacks easier (I think).

-- 
Gareth Westwood
LFS reg. 7163
The function of the expert is not to be more right than other people,
but to be wrong for more sophisticated reasons.
			Dr. David Butler, British psephologist




More information about the lfs-security mailing list