Re: .exrc file security risks

Rex Monty di Bona <[email protected]> Sun, 04 May 2003 21:32:45 +1000

Newsgroups	gmane.comp.security.sun
Message-ID	<[email protected]>

Sigh! and here I was with the modified shell that trapped any command 
starting with /bin/su (or just su) and gobbled up the passwords.

I think it should be a rule that you never enter the superuser password 
at a public access terminal, let alone a user's shell spawned program (I 
can do an X session spy on my self etc, etc, etc.)

					Rex.

Darren J Moffat wrote:
> Also remember to do /bin/su -
> rather than just /bin/su (so that $EXINIT isn't passed alone).