Re: Hearing the truth??

Hi Brennan,

> All:
> 
> I've got an interesting situation at the office I could use some advice
> on.  I'm being asked from a security perspective whether the following
> statement (made by our Unix admins) could be considered true:
> 
> "The only way you can delete a user account on a unix environment is to
> write a series of scripts to eliminate file associations."

This depends upon what you mean by deleting a user account. If 
removing login access to the system is all you're looking to achieve, 
then it can be a fairly simple matter - deleting the entries 
in /etc/passwd and /etc/shadow (or the corresponding tables in 
NIS/NIS+ domains) is enough to remove the accounts.

If you mean make sure that they have no further access, then this 
needs to be extended to look for things like .rhosts, .shosts, 
SSH-RSA authentication, /etc/hosts.equiv (!!?) and/or other 
sorts of trust relationships.

If you mean removing all resource consumption, then you need 
to look for any/all files owned by the user and delete/archive 
them in addition to the above.

So, from an immediate security perspective you're probably 
looking at:

1) Locking or removing the account from authentication DBs (passwd/shadow)
2) Removing any "trust files" hosts.equiv, .rhosts, .shosts, etc
3) Remove any crontabs or at jobs
4) Make sure they have no running processes on the system (no 
   back doors left open).

There are probably others that I'm sure I'll be reminded of :-)

userdel (1M) - can take care of chunks of this (removing account 
and deleting home directory), but the others require admin 
intervention. 

I'm not sure whether there are commercial tools that address 
all of those issues.

Best,

---Steve