Re: Small Bug

[Gregory Ade <gkade@bigbrother.net>]

On Wed, 15 Mar 2000, Marcus Brinkmann wrote:

> How do you compromise a box with a username but no password? I challenge
> you:
> 
> brinkmds@mailhost.ruhr-uni-bochum.de
> brinkmd@master.debian.org
> brinkmd@va.debian.org
> finnegan@users.sourceforge.net
> marcus@gnu.org
> 
> Those are four user names on wholly different systems.

Okay, you have a point, and a very good one, I might add.  Perhaps it's my
habit of including forged e-mail and spam under the heading of attack. I
will admit, now, that having usernames alone is not enough to compromise a
system.

> To put the main argument in a single sentence: "What do you think is
> the password mechanism worth when knowing the username is likely to
> insecure the box?"

Perhaps, then, I should move from my naive statements about user accounts
into software installed on the machine.  Is is possible, then, that a
stranger, looking around with 'cat' and 'ls' and 'cd', could find out
enough about a system and it's installed software packages to form an
attack?

Granted, now we're getting into the realm of "don't run services with
known exploits in them"...

What stops someone playing around a the login prompt from sending a mail
message, or spooling every file on the filesystem that he can read to the
printer, or filling up /tmp, or running a find large enough to crash the
filesystem (did that with a typo myself the other day).

I guess what I'm asking is, what *can* someone malicious do from the login
prompt, assuming a "properly" set up system? (i.e., normal users have no
write access except in /home/<user>, /tmp, and whatever other
directories/filesystems might be set up for the users' use, and typical
read permissions that one would find on various sections of the Hurd's
filesystem).

Thanks, and yes, I'm learnign from this. =)

-- 
Gregory Ade <gkade@bigbrother.net>
Find PGP public key at http://www.pgp.com (Key ID 0x63B57600)
#include <standard/disclaim.h>
procmail(1) is your friend.