[1144] in netbsd-help mailing list archive
security stuff and ftp instructions
daemon@ATHENA.MIT.EDU (Daniel P Kamalic)
Sun Jul 6 00:45:43 1997
From: Daniel P Kamalic <pocky@MIT.EDU>
To: netbsd-help@MIT.EDU
Cc: mkhusid@MIT.EDU (Michael Khusid )
In-Reply-To: Your message of "Sat, 05 Jul 1997 22:57:17 EDT."
<199707060257.WAA00502@pockyfiend.MIT.EDU>
Date: Sun, 06 Jul 1997 00:45:23 EDT
Michael,
I got sufficiently flamed for suggesting something that
compromised security without being sure that you were aware of the
dangers, so I ought to clarify:
Whenever you log in unencrypted, you send your password over the
clear. FTP is unencrypted, so as Greg said, people can intercept them.
This goes for any length of time, even an instant. Sending root
passwords over the clear, even for an instant before you change the root
password, is a serious security compromise. You should write to
accounts and get a srvtab (even though sending that over AFS is a
compromise in itself) and use kerberized telnet and rcp. So if you
telnet as toor, whether you change your password or not, you're assuming
the risk that someone might sniff your password.
To make an "ftp" local account, run vipw (as root) and make an
entry like
ftp::32768:32::0:0:FTP Account:/:/bin/csh
Then log in as ftp and run passwd to change your password from
nothing to something.
Now anyone can do anonymous ftp to your machine but only you can
log in as ftp. Someone who ftp's to your machine gets this:
athena% ftp pockyfiend
Connected to pockyfiend.MIT.EDU.
220 pockyfiend FTP server (Version 6.00) ready.
Name (pockyfiend:pocky): ftp
331 Guest login ok, type your name as password.
Password:
230- NetBSD 1.2 (ATHENAATAPI) #0: Thu Jun 26 12:12:00 EDT 1997
230-
230- Welcome to NetBSD!
230-
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
And from there, they can ftp anything public that they want.
If you don't want anonymous ftp to happen, and you want ftp
users to have to enter the (albeit unencrypted) password, run vipw and
make the same kind of entry except make the name something other than ftp, like
ftpforme::32769:33::0:0:My FTP Account:/:/bin/csh
And then of course log in and run passwd to change that.
I hope that clears things up a little,
-Dan
