From owner-freebsd-questions@FreeBSD.ORG Thu Jul 3 15:04:54 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C4A2E37B401 for ; Thu, 3 Jul 2003 15:04:54 -0700 (PDT) Received: from wopr.caltech.edu (wopr.caltech.edu [131.215.103.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1BBC44400F for ; Thu, 3 Jul 2003 15:04:54 -0700 (PDT) (envelope-from mph@wopr.caltech.edu) Received: from wopr.caltech.edu (localhost.caltech.edu [127.0.0.1]) by wopr.caltech.edu (8.12.9/8.12.8) with ESMTP id h63M4qb9025183; Thu, 3 Jul 2003 15:04:52 -0700 (PDT) (envelope-from mph@wopr.caltech.edu) Received: (from mph@localhost) by wopr.caltech.edu (8.12.9/8.12.3/Submit) id h63M4qO4025182; Thu, 3 Jul 2003 15:04:52 -0700 (PDT) Date: Thu, 3 Jul 2003 15:04:52 -0700 From: Matthew Hunt To: K Anderson Message-ID: <20030703220452.GA25156@wopr.caltech.edu> References: <3F049A3D.3040104@comcast.net> <20030703215110.GA24901@wopr.caltech.edu> <3F04A7EE.5070701@comcast.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3F04A7EE.5070701@comcast.net> User-Agent: Mutt/1.5.1i cc: Nucking Futs cc: freebsd-questions@freebsd.org Subject: Re: Disable PING command X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Jul 2003 22:04:55 -0000 On Thu, Jul 03, 2003 at 03:02:22PM -0700, K Anderson wrote: > Well, all I have to do then as a user who can't run ping is get it from > someplace else and just do ./ping in my home directory. Correct? Or even > use a perl script to do it. If that's possible. No. Normal users can't create the raw sockets that ping needs to work. A ping executable, no matter where it came from, is not going to work unless it's suid root (or run by root). Normal users obviously cannot mark an executable suid root. > The above example then becomes pointless and the poster did ask to > disable it or get rid of it all together. Just shutting down the > /sbin/ping isn't enough. That's all I am saying. :) You're wrong. You would be right if we were talking about lots of other programs, but not ping. -- Matthew Hunt * Science rules. http://www.pobox.com/~mph/ *