[1169] in linux-security and linux-alert archive
Re: [linux-security] Finger Doubt
daemon@ATHENA.MIT.EDU (Ron Hensley)
Fri Sep 20 01:35:29 1996
Date: Wed, 18 Sep 1996 19:13:39 -0400 (EDT)
From: Ron Hensley <ron@dmv.com>
To: Administrador da Rede <admrede@opensite.com.br>
cc: linux-security@tarsier.cv.nrao.edu
In-Reply-To: <199609172012.RAA19978@seaduck.opensite.com.br>
>
> Somedays ago, a certain person sent to our ISP a finger list;like
> a warning (See? I-can-see-your-finger-and-theres-nothing-you-can-do type stuff)
> I use the newest version of cfinger, setted to not allow general finger, just
> specific ones. Does anyone knows how this person did that ? I hope I can
> find out, otherwise, bye bye finger service.
Not familliar with cfinger, but a lot of fingers are prone to indirection.
For instance you tcwrapper finger on host B. Only people right there on
Host B can do fingerl ocally, and people on Host A, as you trust Host A.
But Host A isnt locked down:
finger @host_A@host_B
As Host A isnt locked, finger works, as B Trusts A, it works.
Dont forget things like terminal servers etc that could be used as the
indirection machine
*******************************************************************
* Ron Hensley ron@dmv.com *
* Junior Systems Administrator http://www.dmv.com/~ron *
* PGP Key at WWW Page *
* DelMarVa OnLine 749-7898 Ext. 403 *
*******************************************************************
