Date: Mon, 23 Feb 2004 15:53:34 -0500 From: John Baldwin <jhb@FreeBSD.org> To: kientzle@acm.org Cc: Colin Percival <colin.percival@wadham.ox.ac.uk> Subject: Re: What to do about nologin(8)? Message-ID: <200402231553.34677.jhb@FreeBSD.org> In-Reply-To: <403A64E7.4020607@kientzle.com> References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca> <200402231516.16586.jhb@FreeBSD.org> <403A64E7.4020607@kientzle.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Monday 23 February 2004 03:39 pm, Tim Kientzle wrote:
> John Baldwin wrote:
> > On Monday 23 February 2004 02:58 pm, Doug Rabson wrote:
> >>On Mon, 2004-02-23 at 17:45, Colin Percival wrote:
> >>> For security reasons, nologin(8) must be statically linked;
> >>>as a result, adding logging has increased the binary size ...
> >>
> >>How about:
> >>
> >>7: Use 'system("logger ...") to log the failed login?
> >
> > Wouldn't that be subject to the same LD_LIBRARY_PATH concerns since
> > logger is dynamically linked and you could trojan it's libc?
>
> Not if nologin clears the environment first.
>
> Related to this, I think I've found a solution to
> the underlying problem: ignore login's "-p"
> option if the user shell isn't in /etc/shells.
>
> This blocks environment-poisoning attacks against
> nologin via /usr/bin/login.
>
> With this change, it might even be possible to go
> back to the shell script version of nologin.
My point (sigh) is that doing system("logger") has the same problem set as
making nologin dynamic, so it's not a solution to the original problem.
Also, personally, I would rather have nologin be static than fix the one
known case of login -p and just hope no other cases pop up in the future.
Call me paranoid. :)
--
John Baldwin <jhb@FreeBSD.org> <>< http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve" = http://www.FreeBSD.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200402231553.34677.jhb>