Date: Thu, 22 Jun 1995 08:15:14 +0200 (MET DST) From: J Wunsch <j@uriah.heep.sax.de> To: freebsd-hackers@freebsd.org (FreeBSD hackers) Cc: brian@beru.wustl.edu Subject: Re: PPP password security Message-ID: <199506220615.IAA24196@uriah.heep.sax.de> In-Reply-To: <199506212159.RAA22871@magic.winnet.net> from "Piero Serini" at Jun 21, 95 05:59:23 pm
next in thread | previous in thread | raw e-mail | index | archive | help
As Piero Serini wrote: > > > ... If you cannot > > trust root, forget about Unix security. > > So if I crack root on a single machine of yours, do I also get > all the routers' passwords in your network, and a nice set of > .rhosts all around your machines? You will certainly get all the passwords of machines where i need to log in automatically. You won't get any other password, of course, since i've got the habit of neither writing passwords down anywhere nor storing them anywhere in a computer. :-) The original poster clarified meanwhile that he actually intented to enter the encryption key manually each time (but hmm, why doesn't he enter the password manually then eacht time? :), but anything you wanna have done automatically suffers from the above problem. And yes: the root user ID is the strongest vulnerability of any Unix system. -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ Never trust an operating system you don't have sources for. ;-)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199506220615.IAA24196>