Date: Sun, 7 Sep 1997 22:59:53 -0600 (MDT) From: Wes Peters <softweyr@xmission.com> To: "Rodney W. Grimes" <rgrimes@GndRsh.aac.dev.com> Cc: stable@freebsd.org, brian@awfulhak.org Subject: Re: Don Croyle: make world failing at ppp install (again) Message-ID: <199709080459.WAA21139@obie.softweyr.ml.org> In-Reply-To: <199709080103.SAA15997@GndRsh.aac.dev.com> References: <199709072350.RAA20657@obie.softweyr.ml.org> <199709080103.SAA15997@GndRsh.aac.dev.com>
next in thread | previous in thread | raw e-mail | index | archive | help
I recently said:
% Requiring every user who wants to use FreeBSD PPP as a simple
% single-user workstation with a dial-up ISP account, or even as a simple
% router, to understand routing protocols and gated will guarantee that
% many will just go elsewhere.
Rodney W. Grimes writes:
> A person using FreeBSD as a simple single user workstation has root
> access, and does not have the problem that is attempted to being
> fixed. Duplicating the equiv of /sbin/route in ppp IMHO,
> is just silly, adds yet another place that has to be mucked with
> when the kernel/user land routing interface changes, etc.
>
> What I am more concerned about is server side ppp and the security
> whole that has just been bandaided over via group network instead
> of totally eliminated by removal of route calls.
>
> There is no how no way I want _any_ user other than root in _any_ group
> munging around with routing tables on a ppp server!
Obviously you are not the target user Brian had in mind when developing
this feature. We see once again the beauty of FreeBSD: you have the
source, you can modify ppp at will to do as you please. I suspect,
however, that no amount of pleading, cursing, or other public bandiage
will change the fact that Brian is developing ppp towards an "average"
user that is very different from you.
You have the option of creating patches that will disallow the routing
interface, making ppp somewhat more secure for ISPs and other remote
access servers, and contributing it to the project. You could either
just contribute the diffs to make this happen, or diffs to make this a
compile-time option. Brian seems to be very interested in developing
and upgrading ppp, and may want to add this feature into his next
release.
--
"Where am I, and what am I doing in this handbasket?"
Wes Peters Softweyr LLC
http://www.xmission.com/~softweyr softweyr@xmission.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199709080459.WAA21139>