Date: Wed, 30 May 2001 15:16:17 -0400 From: Garance A Drosihn <drosih@rpi.edu> To: Nik Clayton <nik@FreeBSD.ORG>, Matt Dillon <dillon@earth.backplane.com> Cc: Mike Smith <msmith@FreeBSD.ORG>, stable@FreeBSD.ORG Subject: Re: adding "noschg" to ssh and friends Message-ID: <p05100e00b73af455aff2@[128.113.24.47]> In-Reply-To: <20010530183526.A94961@catkin.nothing-going-on.org> References: <200105292336.f4TNaRT01704@mass.dis.org> <200105292334.f4TNYKg31968@earth.backplane.com> <20010530183526.A94961@catkin.nothing-going-on.org>
next in thread | previous in thread | raw e-mail | index | archive | help
At 6:35 PM +0100 5/30/01, Nik Clayton wrote: >You missed a bit. > > "Cracker is unable to modify binary. A trojan ssh is not > installed, ... so the hacker instead installs something which will install that trojan via some other means, at some other time. > meaning that your passwords are not quietly stolen. In > a fit of frustration, cracker runs rm -rf. If all freebsd systems came with noschg, then the root-kits will quickly be upgraded to deal with that improvement. It would take a hacker with a pretty short attention span to completely give up on hacking a machine due to one little binary being unmodifiable. Yes, that will save you for an extra week or two, until a hacker with a longer attention span gets on some such system, and writes an improved root kit for the kiddies who have short attention spans. While I'm sure this debate can and will continue, I tend to agree with the position of Matt Dillon and others. If the default FreeBSD install turns on noschg for ssh, such that ALL freebsd installations will have it on, then the net improvement to security will be zero. Zero. Not "a very small improvement", but absolute zero. If some freebsd administrators want to turn it on for the few machines they run, then it probably will be a slight security improvement for those few, but only because it will be a rare event for the average hacker to run into. Just MO. And no, I have not missed the points you are trying to make. I just live in an environment with inquisitive hackers who can have very long attention spans, particularly when you don't want them to. I am pretty confident that this kind of change wouldn't slow them down for long -- assuming they managed to break root in the first place. -- Garance Alistair Drosehn = gad@eclipse.acs.rpi.edu Senior Systems Programmer or gad@freebsd.org Rensselaer Polytechnic Institute or drosih@rpi.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?p05100e00b73af455aff2>