Re: MAJOR hole in 5.0
Gareth Westwood <[email protected]>
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Organization | Linux From Scratch |
| Message-ID | <[email protected]> |
Ian Molton wrote: > On Thu, 25 Sep 2003 21:35:25 +0200 > Matthias Benkmann <[email protected]> wrote: > > >>Could someone please tell me, how a user account called "nobody" with >>no valid shell and no password that doesn't own any files is a major >>security risk and a user account called "miller" with a valid shell >>and password that owns files and has write access to /home/miller is >>not? > > > the problem was 'nobody' in the current book DOES have a shell. > admittedly not a massive problem but many daemons assume nobody to be an > unprivelidged user with no files of its own. > > also, it is one extra user that (me/ prepares to be flamed) doestn't need to be there. Sruely it is better to remove "standard" account names, it makes brute force attacks easier (I think). -- Gareth Westwood LFS reg. 7163 The function of the expert is not to be more right than other people, but to be wrong for more sophisticated reasons. Dr. David Butler, British psephologist -- http://linuxfromscratch.org/mailman/listinfo/lfs-security FAQ: http://www.linuxfromscratch.org/faq/ Unsubscribe: See the above information page