From owner-freebsd-security  Tue Jan 23 23: 7:15 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.interactivate.com (unknown [63.141.73.15])
	by hub.freebsd.org (Postfix) with ESMTP
	id 463AB37B69F; Tue, 23 Jan 2001 23:06:48 -0800 (PST)
Received: from interactivate.com (snakcx408168-b.@cx408168-b.escnd1.sdca.home.com [24.20.227.61])
	by mail.interactivate.com (8.11.1/8.11.1) with ESMTP id f0O7T5V61581;
	Tue, 23 Jan 2001 23:29:05 -0800 (PST)
	(envelope-from larry@interactivate.com)
Message-ID: <3A6E7F77.6DFC4A3E@interactivate.com>
Date: Tue, 23 Jan 2001 23:08:39 -0800
From: Lawrence Sica <larry@interactivate.com>
Organization: Interactivate, Inc.
X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.12 i386)
X-Accept-Language: en
MIME-Version: 1.0
To: Guillermo Leandro <guille@galileo.or.cr>
Cc: freebsd-security@FreeBSD.ORG, freebsd-hackers@FreeBSD.ORG
Subject: Re: Default users and the passwords
References: <01012315244000.00612@aristoteles.local.galileo.or.cr>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Guillermo Leandro wrote:

> Hi everybody!
>
> FreeBSD, like almost all Unix OS, has other default users, like uucp,
> operator, etc. Since this users cames with the FreeBSD distribution, where
> can I find their passwords?
>

they don't have any, the  pseudo users and system accounts dont have a login
shell and their passwords should be set to * as well.    Be careful if you
remove them since on a make world certain users are expected, same with
groups.

>
> Another thing, why is there another uid 0 called toor? Isn't it a potential
> security hole?
>

toor is a  big debate for many, its meant to give you another root shell with
a differing shell, like bash,zsh,ksh whatever.  Reason is you dont wan to mess
with root's shell.  Someone compared root to a loaded weapon recently, its a
good analogy since you dont use root unless you mean it and you have to be
careful.

--Larry





To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message