From owner-freebsd-hackers Sun Dec 15 15:32:16 1996 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.4/8.8.4) id PAA14861 for hackers-outgoing; Sun, 15 Dec 1996 15:32:16 -0800 (PST) Received: from garrison.inetcan.net (dreamer@garrison.inetcan.net [206.186.215.2]) by freefall.freebsd.org (8.8.4/8.8.4) with ESMTP id PAA14840; Sun, 15 Dec 1996 15:32:11 -0800 (PST) Received: (from dreamer@localhost) by garrison.inetcan.net (8.8.4/8.8.4) id RAA11139; Sun, 15 Dec 1996 17:36:12 -0700 Date: Sun, 15 Dec 1996 17:36:12 -0700 (MST) From: Digital Dreamer To: Terry Lambert cc: terry@lambert.org, rb@gid.co.uk, proff@iq.org, security@FreeBSD.ORG, hackers@FreeBSD.ORG Subject: Re: vulnerability in new pw suite In-Reply-To: <199612152325.QAA00303@phaeton.artisoft.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-hackers@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk On Sun, 15 Dec 1996, Terry Lambert wrote: > > For example, let's say someone breaks root on your machine. Ok, you're > > in a lot of trouble. But let's attempt to minimize the damage by not > > giving them 6e12 accounts to log on as in the future when/if they're > > discovered by handing over the passwords for them on a silver plate. It > > takes a lot longer to get all your users to change passwords than it > > takes to fix a backdoored /bin/login. > > A backdoored /bin/login can be nothing more than a program that mails > account/password pairs. Really? In a lot of places, /bin/login is suid. It's a common trick to have a backdoored login that will let you in as any user if you supply the correct backdoor password, and even better, it neglects to put your login in utmp so a 'w' won't show you. > Be that as it may, by logical extension, we should act as if we didn't > have passwords, and therefore not rely on them. In fact, it seems to be that is a rather good idea for places where security is imperative. Secure your system from the inside as well, so if someone does break in to your machine, they can't get root. Secure it from the inside, even if you don't (think you have) any holes allowing those from the outside to get in. > from so their guns don't go off when the person who did the bribing > comes to break in to the 10M drive on your PC-XT. It's 2MB, and the ST-506 controller went last week. dreamer