Great Circle Associates Firewalls
(April 1994)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Bastion Host configuration.
From: long-morrow @ CS . YALE . EDU (H Morrow Long)
Date: Mon, 25 Apr 94 14:06:08 -0400
To: Icarus Sparry <ccsis @ ss1 . bath . ac . uk>
Cc: "Mark R. Ludwig" <Mark-Ludwig @ uai . com>, firewalls @ GreatCircle . COM
In-reply-to: Your message of Mon, 25 Apr 94 18:05:07 BST.

In message <9404251805 .
 aa23741 @
 uk .
 ac .
 bath .
 ss1> you write:
>>From: "Mark R. Ludwig" <Mark-Ludwig @
 com .
 uai>
>>Don't remove setUID on /bin/login, for example.  
>
>The only reason for keeping the setUID bit on /bin/login is to
>enable people to say 'login fred', instead of 'exit' followed by
>logging in as fred.
>
>A very silly idea IM(NS)HO! It means extra code in /bin/sh, /bin/csh
>etc to make login a builtin command which will exec /bin/login,
>rather than fork and exec it as it would any other command.
>
>Real Unix (i.e. 10th Edition) has abandoned the setUID bit on this
>command. We (Bath University) have run without the setUID bit on
>/bin/login for a number of years.
>
>I suggest that you remove the setUID bit, and update your manual
>pages to remove the reference to 'login' as being a builtin command.

Doesn't /bin/login write entries (records of logins) into the
/etc/utmp and /var/adm/wtmp files?

If you remove the setuid bit from /bin/login, this means that you
will have to make the utmp and wtmp files writable by all -
if you want to records who logs in - right?

Having /etc/utmp and /var/adm/wtmp writable by the world introduces
its own set of security concerns.

					- Morrow


Follow-Ups:
Indexed By Date Previous: Re: Bastion Host configuration.
From: vt @ morgan . com (W.Vaughan Turner III)
Next: Re: Bastion Host configuration.
From: Icarus Sparry <ccsis @ ss1 . bath . ac . uk>
Indexed By Thread Previous: Re: Bastion Host configuration.
From: vt @ morgan . com (W.Vaughan Turner III)
Next: Re: Bastion Host configuration.
From: Icarus Sparry <ccsis @ ss1 . bath . ac . uk>

Google
 
Search Internet Search www.greatcircle.com