Date: Wed, 26 Jul 2000 15:32:24 +0200 (CEST) From: Bart van Leeuwen <bart@ixori.demon.nl> To: "Crist J. Clark" <cristjc@earthlink.net> Cc: James Wyatt <jwyatt@rwsystems.net>, Jean-Claude STAQUET <jcs@polyflow.be>, freebsd-security@freebsd.org Subject: Re: allow access of root user Message-ID: <Pine.BSF.4.21.0007261524590.23687-100000@isengard.ixori.demon.nl> In-Reply-To: <20000725233208.A307@pool0460.cvx20-bradley.dialup.e>
next in thread | previous in thread | raw e-mail | index | archive | help
Of course audit trails etc are much nicer when people su to root, and in general being better able to see whats going on is a good reason to use su. My comment is not that using su is pointless, but that the disallowing interacive root logons like the default configuration does is pointless because that same default configuration provides easy ways around it (for example with rsh, which is also enabled by default, and yes, I know that one should be turned off, just as you should disable 'secure' on console etc to prevent direct root logons there ;-) So, the reason why I think it is pointless is because it is only done for the first 10% or so and leaves the rest to the user... well, in that case the annoyance it causes is bigger then the trouble it saves imho. Bart van Leeuwen ----------------------------------------------------------- mailto:bart@ixori.demon.nl - http://www.ixori.demon.nl/ ----------------------------------------------------------- On Tue, 25 Jul 2000, Crist J. Clark wrote: > On Tue, Jul 25, 2000 at 04:41:03PM +0200, Bart van Leeuwen wrote: > > Uhm, telnetting in as a user and suing to root has exactly the same > > danger, your password goes over the net in plaintext. > > > > If you want to prevent that consider using ssh instead. > > Also note that when using rsh you prevent root from logging in for > > interactive access, but an rsh -l root <machine> <command> will still > > work. > > > > To be honest, I never really saw the point of disallowing this except for > > the simple good habit of never using the root account at all, and only > > becomming superuser when you really really have to. > > Two words: Audit trail. > > Since so many academic and business machines have multiple > administrators, i.e. multiple people who own root, knowing _who_ is > actually root is vital for a number of reasons. Direct console logins > by root should be discouraged on such machines as well. (When I hear > about people leaving root logged in at a console with a GUI waiting to > be exploited. "But I locked the screensaver!" Ahhh!) > -- > Crist J. Clark cjclark@alum.mit.edu > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0007261524590.23687-100000>