[5370] in RedHat Linux List
Re: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Elliot Lee)
Wed Nov 20 23:11:27 1996
Date: Wed, 20 Nov 1996 23:09:19 -0500 (EST)
From: Elliot Lee <sopwith@cuc.edu>
To: redhat-list@redhat.com
In-Reply-To: <Pine.LNX.3.91.961121023253.660B-100000@ferret.lmh.ox.ac.uk>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
On Thu, 21 Nov 1996, Chris Evans wrote:
> On my redhat4.0 system, a "find / -perm 4000" lists an awful lot of suid
> programs. Some sound highly dubious. How many of these have been scrutinised
> for security holes?
I think you mean "find / -perm -4000" ?
The programs are installed suid for good reasons - if you have questions
on why, ask on redhat-devel-list perhaps.
> On other security issues, I'm far from impressed by the (default)
> permissions on log files. Are we in a situation where it could be
> logged publicly readable, if somone gets a failed login due to mixing
> password with username? Many of the somewhat more security-oriented
> config files could do with a permissions rethink too. I don't want normal
> users browsing my setup. Look at it another way: there's no _valid need_
> for them to be able to read them.
At the same time, you don't want to make things so complicated for Joe
User that he can't figure out how to read files. Make a script to change
modes on files that you think need to be changed, and send it in :)
> Finally, there was an alert to do with the wu-ftpd shipped with redhat, a
> little time ago. Something to do with the realpath exploit, as well as
> problems with the tar --rsh-command option, if supported by the ftp tar
> binary...
Those are both old ones, and were fixed sometime around Rembrandt
(rsh-command) or way before (realpath).
-- Elliot
http://www.redhat.com/
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
