[5578] in RedHat Linux List
Re: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Otto Hammersmith)
Fri Nov 22 14:24:04 1996
From: Otto Hammersmith <ohammers@cu-online.com>
To: redhat-list@redhat.com
Date: Fri, 22 Nov 1996 13:22:17 -0600 (CST)
In-Reply-To: <3295FB4A.508C4BDB@my_signature.below> from "Borg" at Nov 22, 96 11:13:14 am
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
Borg wrote:
> Trond Eivind Glomsr=F8d wrote:
>
> > Borg <please_see@my_signature.below> writes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ did you just start doing this?
> > > This one should go I think:
> > >
> > > -rwsr-xr-x 1 root root 138420 Sep 10 08:10 /usr/X11R6/bin/nxt=
> erm
> > =
>
> > Definitely not. Xterms need to be suid to update wtmp.
>
> But is there any sense in it?? A person who's starting
> an xterm has already logged through a tty and had been
> registered in wtmp. Please point me to any usefulness
> of the fact that I see myself logged 5 times (I normally
> run 4 xterms) instead of one? Is making it suid just to
> update wtmp and utmp worth the risk of someone exploiting
> it?
I'm not sure that this is true anymore, with the PAM stuff. In
theory, login now handles all the wtmp stuff. (is this still the case
with an xterm -ls?)
In any case, I think Erik pointed out that xterm needs to chmod files
in /dev.. to make you the owner of your tty. I think xterm without
the -ls will avoid this... so removing the suid bit takes away the -ls
option to xterm.. which I find quite nice. You be surprised at the
number of times that a machine has been rebooted while someone else
was using it, but they only had an xterm running without -ls so they
didn't show up in wtmp.
--
-Otto
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
