Date: Fri, 29 May 2009 01:29:43 -0700 From: perryh@pluto.rain.com To: wojtek@wojtek.tensor.gdynia.pl Cc: freebsd-questions@freebsd.org Subject: Re: Remotely edit user disk quota Message-ID: <4a1f9cf7.UEl7lAiK4FGe5eG7%perryh@pluto.rain.com> In-Reply-To: <alpine.BSF.2.00.0905282129560.61809@wojtek.tensor.gdynia.pl> References: <200905281030.n4SAUXdA046386@banyan.cs.ait.ac.th> <200905280847.12966.kirk@strauser.com> <alpine.BSF.2.00.0905281553001.60364@wojtek.tensor.gdynia.pl> <200905280904.44025.kirk@strauser.com> <20090528183801.82b36bbb.freebsd@edvax.de> <alpine.BSF.2.00.0905282129560.61809@wojtek.tensor.gdynia.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
Wojciech Puchar <wojtek@wojtek.tensor.gdynia.pl> wrote: > Even 15 seconds of thinking is enough to understand that logging > to other user and then su - gives completely no extra security. I don't buy this, given that root's login name is well known :) If a system accepts remote root logins, an attacker need only guess or intercept one thing -- the root password -- to log in with root privileges. If it does not accept remote root logins, that attacker must guess or intercept three things: the login name of a user in the wheel group, that user's password, and also the root password.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4a1f9cf7.UEl7lAiK4FGe5eG7%perryh>