From owner-freebsd-security Fri Sep 17 15:17: 5 1999 Delivered-To: freebsd-security@freebsd.org Received: from shell.futuresouth.com (shell.futuresouth.com [198.78.58.28]) by hub.freebsd.org (Postfix) with ESMTP id E747914D3B for ; Fri, 17 Sep 1999 15:17:01 -0700 (PDT) (envelope-from fullermd@futuresouth.com) Received: (from fullermd@localhost) by shell.futuresouth.com (8.9.3/8.9.3) id RAA18736; Fri, 17 Sep 1999 17:16:56 -0500 (CDT) Date: Fri, 17 Sep 1999 17:16:56 -0500 From: "Matthew D. Fuller" To: Brett Glass Cc: security@FreeBSD.ORG Subject: Re: Securing a system that's been rooted remotely (Was: BPF on in 3.3-RC GENERIC kernel) Message-ID: <19990917171656.H4975@futuresouth.com> References: <4.2.0.58.19990916232349.047c27a0@localhost> <4.2.0.58.19990916185341.00aaf100@localhost> <19990917134343.P16305@futuresouth.com> <4.2.0.58.19990917155850.047bd680@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.3i In-Reply-To: <4.2.0.58.19990917155850.047bd680@localhost>; from Brett Glass on Fri, Sep 17, 1999 at 04:00:14PM -0600 X-OS: FreeBSD Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, Sep 17, 1999 at 04:00:14PM -0600, a little birdie told me that Brett Glass remarked > > If securelevel isn't set high, a hacker can switch you BACK to the generic > kernel with a few keystrokes. You missed my main thrust. Why would you go to all the trouble to enable securelevels (usefully. read; flagging everyone and their mother), and still be running GENERIC? If you're not running GENERIC, you're running a custom kernel. If you're running a custom kernel, you're customizing stuff anyway, so you can take out/put in bpf or whatever you want. Where's the problem? -- Matthew Fuller (MF4839) | fullermd@over-yonder.net Unix Systems Administrator | fullermd@futuresouth.com Specializing in FreeBSD | http://www.over-yonder.net/ FutureSouth Communications | ISPHelp ISP Consulting "The only reason I'm burning my candle at both ends, is because I haven't figured out how to light the middle yet" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message