From owner-cvs-all Wed Dec 2 18:44:34 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id SAA14030 for cvs-all-outgoing; Wed, 2 Dec 1998 18:44:34 -0800 (PST) (envelope-from owner-cvs-all@FreeBSD.ORG) Received: from apollo.backplane.com (apollo.backplane.com [209.157.86.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id SAA14025; Wed, 2 Dec 1998 18:44:33 -0800 (PST) (envelope-from dillon@apollo.backplane.com) Received: (from dillon@localhost) by apollo.backplane.com (8.9.1/8.9.1) id SAA20794; Wed, 2 Dec 1998 18:44:17 -0800 (PST) (envelope-from dillon) Date: Wed, 2 Dec 1998 18:44:17 -0800 (PST) From: Matthew Dillon Message-Id: <199812030244.SAA20794@apollo.backplane.com> To: "Andrey A. Chernov" Cc: Dima Ruban , guido@gvr.org, cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG Subject: Re: cvs commit: src/etc master.passwd References: <199812022135.NAA02023@burka.rdy.com> <199812022155.NAA19166@apollo.backplane.com> <19981203021907.A79875@nagual.pp.ru> Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk :On Wed, Dec 02, 1998 at 01:55:34PM -0800, Matthew Dillon wrote: :> I suppose, theoretically, if some hacker were able to create a file or :> directories in /, they would be able to break into the account. But anyone :> capable of that can probably break root directly. If we were totally : :About creating nonexisten directories: some hackers prefer to live on :machine using some stealing techniques to mimic valid user. It is too easy :to mimic valid user under operator just by creating new directory even :without touching passwd (which can be detected by daily script). I don't see how '*'d-out accounts can possibly have a major effect on security. If your machine gets broken into and you aren't checking your entire hierarchy, you've got a problem anyway. Making the operator account less easily subverted when it already defaults to a '*'d-out password is not going to improve security in any measureable way. The hacker could just as easily add innocuous rhosts, ssh (, etc...) entries to other system entries or even inactive user accounts. -Matt :-- :Andrey A. Chernov Matthew Dillon Engineering, HiWay Technologies, Inc. & BEST Internet Communications & God knows what else. (Please include original email in any response) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message