Date: Wed, 23 Jun 1999 13:14:55 +1000 From: Greg Black <gjb@acm.org> To: Andrew McNaughton <andrew@scoop.co.nz> Cc: Dag-Erling Smorgrav <des@flood.ping.uio.no>, Michael Richards <026809r@dragon.acadiau.ca>, freebsd-security@FreeBSD.ORG Subject: Re: Allowing non root users to bind low ports Message-ID: <19990623031456.24560.qmail@alice.gba.oz.au> In-Reply-To: <199906221758.FAA07268@aniwa.sky> of Wed, 23 Jun 1999 05:58:36 %2B1200 References: <199906221758.FAA07268@aniwa.sky>
next in thread | previous in thread | raw e-mail | index | archive | help
> > > I was giving this concept a little thought. If I'm not root and I can bind > > > a low port, let's say the telnet port. I could write myself a fake telnet > > > daemon and run it. Sooner or later, someone is going to try using it... > > > This whole thing about non-root users binding to low ports would only be > > > useful if there are no shell accounts on a machine IMO. > > > > Well, duh. That's why we want to turn this off before going multiuser > > (but after starting stuff like sendmail etc.) > > That approach is of limited use unless you're prepared to reboot your machine > every time you want to change your sendmail configuration. If you're serious about security, then this is the sort of trade-off you have to make. > Sounds too much like Windows for my liking. Nothing short of reconfiguring > the kernel or a make world should require a reboot. A normal production box probably won't change configuration in between OS upgrades anyway, so this is not such a hardship as it might seem. Boxes where experimental configurations are being changed all the time will not run with elevated secure levels and won't be inconvenienced. -- Greg Black -- <gjb@acm.org> or <gjb@computer.org> Fight censorship in Australia: <http://www.efa.org.au>; To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19990623031456.24560.qmail>