Re: Allowing password-less connexions

--===============1931792201==
Content-Type: multipart/alternative; boundary="0-1134279887-1210035787=:44240"
Content-Transfer-Encoding: 7bit

--0-1134279887-1210035787=:44240
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

I am a new reader, so I apologize for any really obvious idiocy upon my p=
art.  Is this feature supposed to make it possible to log in as a regular=
 user and do password-free sudo commands? or is it intended to make a bas=
ic user a defacto root-user (which would do away with the sudoers log ent=
ry for whatever the user might do).  I can see some point to the former b=
ut wouldn't they both be security holes waiting for exploit?  Personally,=
 I see the effortless admin access of Windows to be one of the major flaw=
s of the windows model.  Yes, I can see that this is a voluntary change a=
nd everybody should be allowed to endanger their home pc as much as they =
like, but why would one wish to encourage linux-based bot-nets?

Wolf Halton
Computer Security and Penetration Testing (2007)

Milan Bouchet-Valat  wrote:=20
Date: Sun, 04 May 2008 18:19:48 +0200
From: Milan Bouchet-Valat=20
Subject: [system-tools] Allowing password-less connexions
To: [email protected]
Cc: gdm-list=20
Message-ID: <1209917988.6148.23.camel@milan>
Content-Type: text/plain; charset=3DUTF-8

Hi! I was discussing on GDM's list of implementing a graphical way to
allow users to login through GDM and gnome-screensaver without entering
their password. ?I'd like to code it and it may well be that users-admin
is the place it should go into. This is a much wanted feature that is
preserving security for remote login and administrative tasks.

It is easy to set up using PAM: you need to modify /etc/pam.d/gdm.conf
so that it contains this:
"auth sufficient pam_listfile.so sense=3Dallow file=3D/etc/gdm/nopassword
item=3Duser"

What we only need is a GUI to select which users will be listed in this
file. First I thought gdm-setup would be the place to do that, but now I
believe it would be nice to put it in users-admin. See my post to the
GDM list. I'd liek to get your comments about this.


Cheers


-------- Transferred message --------
De: Milan Bouchet-Valat=20
?: Maarten de Boer=20
Cc: [email protected]
Sujet: Re: [gdm-list] Allowing password-less connexions
Date: Sun, 04 May 2008 18:07:32 +0200

I've just read the answer Martin got last time he raised this issue.
Obviously distro-specific PAM will be a problem - but what would be nice
is that a distribution wanting to enable this feature can do this
easily. For this we would need mostly a GUI, since PAM files are anyway
written by the distros.

After thinking a little more, I though that maybe it would be more
logical and easier to add a checkbox in the users profiles in
users-admin (from gnome-system-tools) allowing to skip password check in
GDM/gnome-screensaver. This option would just write the username to a
file (/etc/gdm-nopasswd.list, /etc/nopasswd.list or so...).
Distributions would have to choose between updating pam.d conf files
accordingly so that this is working, or disabling/hiding this feature
(via a GConf key for example).

Adding this in GDM would require more work and an extended interface,
and moreover the per-user approach may be more friendly than configuring
the login screen (system-wide).

Any comments/criticisms? I'm contacting the g-s-t team to hear what they
think of it, and I CC the gdm-list.



------------------------------

_______________________________________________
system-tools-list mailing list
[email protected]
http://mail.gnome.org/mailman/listinfo/system-tools-list


End of system-tools-list Digest, Vol 38, Issue 1
************************************************



--
Click on WolfHalton.info and Speak Your Mind!
=20
Of all things, good sense is the most fairly distributed: everyone thinks=
 he is so well supplied with it that even those who are the hardest to sa=
tisfy in every other respect never desire more of it than they already ha=
ve. -- Ren=E9 Descartes - Discours de la M=E9thode


      =20
---------------------------------
Be a better friend, newshound, and know-it-all with Yahoo! Mobile.  Try i=
t now.
--0-1134279887-1210035787=:44240
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

I am a new reader, so I apologize for any really obvious idiocy upon my p=
art.&nbsp; Is this feature supposed to make it possible to log in as a re=
gular user and do password-free sudo commands? or is it intended to make =
a basic user a defacto root-user (which would do away with the sudoers lo=
g entry for whatever the user might do).&nbsp; I can see some point to th=
e former but wouldn't they both be security holes waiting for exploit?&nb=
sp; Personally, I see the effortless admin access of Windows to be one of=
 the major flaws of the windows model.&nbsp; Yes, I can see that this is =
a voluntary change and everybody should be allowed to endanger their home=
 pc as much as they like, but why would one wish to encourage linux-based=
 bot-nets?<br><br>Wolf Halton<br>Computer Security and Penetration Testin=
g (2007)<br><br><span style=3D"font-weight: bold; font-style: italic;">Mi=
lan Bouchet-Valat&nbsp; wrote:</span><blockquote class=3D"replbq" style=3D=
"border-left: 2px solid rgb(16, 16, 255);
 margin-left: 5px; padding-left: 5px;"> <br>Date: Sun, 04 May 2008 18:19:=
48 +0200<br>From: Milan Bouchet-Valat <[email protected]><br>Subject: [sy=
stem-tools] Allowing password-less connexions<br>To: system-tools-list@gn=
ome.org<br>Cc: gdm-list <[email protected]><br>Message-ID: &lt;120991798=
8.6148.23.camel@milan&gt;<br>Content-Type: text/plain; charset=3DUTF-8<br=
><br>Hi! I was discussing on GDM's list of implementing a graphical way t=
o<br>allow users to login through GDM and gnome-screensaver without enter=
ing<br>their password. ?I'd like to code it and it may well be that users=
-admin<br>is the place it should go into. This is a much wanted feature t=
hat is<br>preserving security for remote login and administrative tasks.<=
br><br>It is easy to set up using PAM: you need to modify /etc/pam.d/gdm.=
conf<br>so that it contains this:<br>"auth sufficient pam_listfile.so sen=
se=3Dallow file=3D/etc/gdm/nopassword<br>item=3Duser"<br><br>What we only=
 need is a GUI to select which users will be
 listed in this<br>file. First I thought gdm-setup would be the place to =
do that, but now I<br>believe it would be nice to put it in users-admin. =
See my post to the<br>GDM list. I'd liek to get your comments about this.=
<br><br><br>Cheers<br><br><br>-------- Transferred message --------<br>De=
: Milan Bouchet-Valat <[email protected]><br>?: Maarten de Boer <mdeboer@=
iua.upf.edu><br>Cc: [email protected]<br>Sujet: Re: [gdm-list] Allowing =
password-less connexions<br>Date: Sun, 04 May 2008 18:07:32 +0200<br><br>=
I've just read the answer Martin got last time he raised this issue.<br>O=
bviously distro-specific PAM will be a problem - but what would be nice<b=
r>is that a distribution wanting to enable this feature can do this<br>ea=
sily. For this we would need mostly a GUI, since PAM files are anyway<br>=
written by the distros.<br><br>After thinking a little more, I though tha=
t maybe it would be more<br>logical and easier to add a checkbox in the u=
sers profiles in<br>users-admin (from
 gnome-system-tools) allowing to skip password check in<br>GDM/gnome-scre=
ensaver. This option would just write the username to a<br>file (/etc/gdm=
-nopasswd.list, /etc/nopasswd.list or so...).<br>Distributions would have=
 to choose between updating pam.d conf files<br>accordingly so that this =
is working, or disabling/hiding this feature<br>(via a GConf key for exam=
ple).<br><br>Adding this in GDM would require more work and an extended i=
nterface,<br>and moreover the per-user approach may be more friendly than=
 configuring<br>the login screen (system-wide).<br><br>Any comments/criti=
cisms? I'm contacting the g-s-t team to hear what they<br>think of it, an=
d I CC the gdm-list.<br><br><br><br>------------------------------<br><br=
>_______________________________________________<br>system-tools-list mai=
ling list<br>[email protected]<br>http://mail.gnome.org/mailman=
/listinfo/system-tools-list<br><br><br>End of system-tools-list Digest, V=
ol 38, Issue
 1<br>************************************************<br></[email protected]=
pf.edu></[email protected]></[email protected]></[email protected]></blo=
ckquote><br><BR><BR><div>--</div><div style=3D"text-align: center;"><span=
 style=3D"font-weight: bold; color: rgb(127, 63, 0);"></span>Click on&nbs=
p;<a style=3D"font-weight: bold;" href=3D"http://www.wolfhalton.info">Wol=
fHalton.info</a> <span style=3D"font-weight: bold; font-style: italic;">a=
nd Speak Your Mind!</span><br> <b><br></b><span style=3D"font-style: ital=
ic; font-weight: bold; color: rgb(191, 0, 191);">Of all things, good sens=
e is the most fairly distributed: everyone thinks he is so well supplied =
with it that even those who are the hardest to satisfy in every other res=
pect never desire more of it than they already have. -- Ren=E9 Descartes =
- Discours de la M=E9thode</span><b><br></b></div><p>&#32;

      <hr size=3D1>Be a better friend, newshound, and=20
know-it-all with Yahoo! Mobile. <a href=3D"http://us.rd.yahoo.com/evt=3D5=
1733/*http://mobile.yahoo.com/;_ylt=3DAhu06i62sR8HDtDypao8Wcj9tAcJ "> Try=
 it now.</a>
--0-1134279887-1210035787=:44240--

--===============1931792201==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
system-tools-list mailing list
[email protected]
http://mail.gnome.org/mailman/listinfo/system-tools-list

--===============1931792201==--