Date: Thu, 11 Aug 2016 15:17:51 +0200 From: Mathieu Arnold <mat@FreeBSD.org> To: "O. Hartmann" <ohartman@zedat.fu-berlin.de>, freebsd-current <freebsd-current@freebsd.org>, freebsd-ports <freebsd-ports@freebsd.org> Subject: Re: Passwordless accounts vi ports! Message-ID: <9567532A811EA9735990943A@ogg.in.absolight.net> In-Reply-To: <660CDD44B902B2A0C050ACDD@atuin.in.mat.cc> References: <20160811070505.2c1a1466@freyja.zeit4.iv.bundesimmobilien.de> <660CDD44B902B2A0C050ACDD@atuin.in.mat.cc>
next in thread | previous in thread | raw e-mail | index | archive | help
--==========87B141FE2C7FC6DD5925========== Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline +--On 11 ao=C3=BBt 2016 11:26:58 +0200 Mathieu Arnold <mat@FreeBSD.org> = wrote: |=20 |=20 | +--On 11 ao=C3=BBt 2016 07:05:05 +0200 "O. Hartmann" | <ohartman@zedat.fu-berlin.de> wrote: || I just checked the security scanning outputs of FreeBSD and found this || surprising result: ||=20 || [...] || Checking for passwordless accounts: || polkitd::565:565::0:0:Polkit Daemon User:/var/empty:/usr/sbin/nologin || pulse::563:563::0:0:PulseAudio System = User:/nonexistent:/usr/sbin/nologin || saned::194:194::0:0:SANE Scanner Daemon:/nonexistent:/bin/sh || clamav::106:106::0:0:Clamav Antivirus:/nonexistent:/usr/sbin/nologin || bacula::910:910::0:0:Bacula Daemon:/var/db/bacula:/usr/sbin/nologin || [...] ||=20 || Obviously, some ports install accounts but do not secure them as there = is || an empty password. ||=20 || I consider this not a feature, but a bug. |=20 | Mmmm, I rewrote the user/group creation thingie a few months back, a bug | may have crept in, I'll have a look at it today. I've tested things on 9, 10 and 11, I can't reproduce that. --=20 Mathieu Arnold --==========87B141FE2C7FC6DD5925========== Content-Type: application/pgp-signature Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQJ8BAEBCgBmBQJXrHr/XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQzQUI2OTc4OUQyRUQxMjEwNjQ0MEJBNUIz QTQ1MTZGMzUxODNDRTQ4AAoJEDpFFvNRg85IWqUP/RAqCSehseLB5WjTiyMu0TMe l1QJXn5KZDEgvZacLPV3wjDF/N7uFMT5ntNPY9z4/8keJRV7s4RJdEmGDc5IdHkY AVmOHW61V1yIdbFJobHaH0GEKOIAuYnMjxG5WvJ0ILw5d8bzkZ95c9z2jJ+Kq0B0 ku60M0j85ZrgZ2NA81iXK0B2XOZYBMeYMkQthY68xXGdnbelGZ1dc6pkz2q65RtU +V/aDZZS8pumazulwiTF2oWCFVJvakEU0uy2qobpJb1gr8aH7/j48ryfUd+onJJY dZSnvyXH8+I4dRKfE28rzb22HHtphmRT4rJEx+H2d6EJpkodw3AmMfQKE5wuktyS iXI8CSJXi8bi9KNF3XOSB0VWzhdanrtAMvGjm5MojWyqxq8DoeulXP8oQIoEkgkR Pn8S6iIZvayX28OPHG7dHct/0oFeDL3m+ymbRGw4voG4FJZ+Fff6p6bLKlnJzy/t 7GmRxUqOuac77x0dS+YVv4RNOE/53Dre1q+1/LvzKaUtyR5rL9beDN2g+zbgPatn QGVOhW08aIHYHPwne6CCSwfHJtNVRN5BLU+NOY9bXVKACs6OHR68zJdif6beCwSu eHRHmDdyx+l/m1E7+/tMRxjoABOyv/ORgfrs9WBUnFdbXX3guKdOlVtQXxBGlJat 97pxVCO3wx1+nyElkdNg =evw4 -----END PGP SIGNATURE----- --==========87B141FE2C7FC6DD5925==========--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?9567532A811EA9735990943A>