From owner-freebsd-hackers Tue Feb 4 02:11:38 1997 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.5/8.8.5) id CAA06934 for hackers-outgoing; Tue, 4 Feb 1997 02:11:38 -0800 (PST) Received: from gw-nl1.philips.com (gw-nl1.philips.com [192.68.44.33]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id CAA06925 for ; Tue, 4 Feb 1997 02:11:31 -0800 (PST) Received: (from nobody@localhost) by gw-nl1.philips.com (8.6.10/8.6.10-0.994n-08Nov95) id LAA23539 for ; Tue, 4 Feb 1997 11:11:23 +0100 Received: from unknown(130.139.36.3) by gw-nl1.philips.com via smap (V1.3+ESMTP) with ESMTP id sma023349; Tue Feb 4 11:10:42 1997 Received: from giga.lss.cp.philips.com (giga.lss.cp.philips.com [130.144.199.31]) by smtprelay.nl.cis.philips.com (8.6.10/8.6.10-1.2.1m-970131) with SMTP id LAA25598 for ; Tue, 4 Feb 1997 11:10:35 +0100 Received: by giga.lss.cp.philips.com (8.8.5/1.63) id LAA27440; Tue, 4 Feb 1997 11:10:35 +0100 (MET) From: W.Belgers@nl.cis.philips.com (Walter Belgers) Message-Id: <199702041010.LAA27440@giga.lss.cp.philips.com> Subject: NIS/uids To: freebsd-hackers@freebsd.org Date: Tue, 4 Feb 1997 11:10:35 +0100 (MET) Organisation: Origin IT Systems Management /Nederland B.V. X-URL: http://giga.lss.cp.philips.com/cgi-bin/walter.cgi X-Mailer: ELM [version 2.4ME+ PL19 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-hackers@freebsd.org X-Loop: FreeBSD.org Precedence: bulk Hi, I hope this is the right place to tell my story. I run FreeBSD 2.1.5. On my system are a bunch of local users but I also have users from the NIS database on another system (an HP). In my password file the users are defined as follows: +user::::::::/home/john:/usr/local/bin/tcsh So I override the homedir and shell. The problem now is that the security on my system has become dependant on that of the NIS server. If I am root on the NIS server I can change the uid of "user" into any user including root and make use of it on my system. Even if you can only become root using su you can easily first become a user in wheel and then root. The obvious solution is to override the uid in the password file: +user::1234:1234:::::/home/john:/usr/local/bin/tcsh But now I have another problem... the userid is not mapped to the username any more. 1) [~] root@giga> grep user /etc/master.passwd +user::::::::/home/john:/usr/local/bin/tcsh [~] root@giga> ypmatch user passwd user:$1xOC/SMM4ss.:1234:1234:John Doe:/home/john:/usr/local/bin/tcsh [~] root@giga> su - user [~] user@giga> id uid=1234(user) gid=1234 groups=1234 2) [~] root@giga> grep user /etc/master.passwd +user::1234:1234:::::/home/walter:/usr/local/bin/tcsh [~] root@giga> ypmatch user passwd user:$1xOC/SMM4ss.:1234:1234:John Doe:/home/john:/usr/local/bin/tcsh [~] root@giga> su - user [~] user@giga> id uid=1234 gid=1234 groups=1234 The fact that "user" now is only known as uid 1234 and not as user "user" gives rise to a lot of problems. Is this a bug or am I overlooking something? Walter. -- Ir. W.H.B. Belgers, Internet Security Specialist phone: +31 40 2782753 Origin IT Syst.Man. /Nederland bv, Bldg VN-513 email: fax: +31 40 2784697 P.O. Box 218, 5600 MD Eindhoven, Netherlands W.Belgers@nl.cis.philips.com non-business-email: walter@giga.nl -web: http://www.IAEhv.nl/users/gigawalt