Date: Tue, 11 Jun 1996 16:53:18 +0800 From: Peter Wemm <peter@spinner.DIALix.COM> To: guido@gvr.win.tue.nl (Guido van Rooij) Cc: taob@io.org (Brian Tao), freebsd-security@freebsd.org Subject: Re: Root rlogins despite /etc/ttys Message-ID: <199606110853.QAA06691@spinner.DIALix.COM> In-Reply-To: Your message of "Mon, 10 Jun 1996 11:25:39 %2B0200." <199606100925.LAA10677@gvr.win.tue.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
>Brian Tao wrote: >> Could someone confirm this for me? I noticed that I can rlogin as >> root into a 2.2-960501-SNAP server providing that the .rhosts is setup >> correctly. The tty assigned to the login session is not marked as >> secure in /etc/ttys. Previously, the password prompt would appear >> regardless, and root logins denied. > >I think this is caused by this commit: >revision 1.6 >date: 1995/11/20 23:25:35; author: peter; state: Exp; lines: +2 -3 >Stop rlogind from bogusly ignoring an explicit .rhosts file for root. >It still correctly ignores hosts.equiv. This is now consistant with rshd. > >I'll include the author in the Cc: and let him comment about this. >I agree that at least the tty needs to be checked on its secuirty in >the ttys file. > >-Guido Well, previously, if there was a .rhosts file, you could: rsh -l root hostname sh -i and get a stealth login that was not even on a terminal or logged in utmp/wtmp. 'secure' is pretty meaningless on network logins, especially if you bypass it by *explicitly* setting a root .rhosts entry. The only thing the 'secure' flag seems useful for these days over the network is to discourage the root password being typed in plaintext at the start of a network connection that can be so easily sniffed. ie: disallow telnet w/ plain text password, disallow rlogin with plain text password. But allow normal user to telnet/rlogin in, and at a significant amount of network traffic later, type the password. I don't think you can disallow root .rhosts for rsh, because people will be after your blood if they can no longer do remote backups the way they've been doing it for the last 10 years etc. And denying rlogin when rsh is allowed gives only a false sense of security since it's trivial to bypass. Personally, I think the real solution is something like ssh that uses real authentication (which incidently, completely ignores the 'secure' flag). Cheers, -Peter
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199606110853.QAA06691>