Date: Tue, 12 Oct 1999 12:15:50 -0500 (CDT) From: James Wyatt <jwyatt@rwsystems.net> To: Brian Reichert <reichert@numachi.com> Cc: "Ryan Thompson [FreeBSD]" <freebsd@sasknow.com>, freebsd-isp@FreeBSD.ORG Subject: Re: Chroot and ~/bin, ~/etc. Better way? Message-ID: <Pine.BSF.4.10.9910121115330.87599-100000@bsdie.rwsystems.net> In-Reply-To: <19991011234206.A24645@numachi.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 11 Oct 1999, Brian Reichert wrote: > On Mon, Oct 11, 1999 at 07:53:06PM -0600, Ryan Thompson [FreeBSD] wrote: > > Someone lost my attribution for: > > > We considered having all the ftpgroup users share ~/bin and ~/etc dirs > > > with linked copys of the files, but figured that if anyone of them could > > > somehow find a way to update their /bin/ls or something, they could trojan > > > it for the others. They could also try cracking the other accounts if they > > > knew of them in the shared password file - though they wouldn't have the > > > crypted passwords. Obviously symlinks wouldn't work in a chroot()ed env. > > If you've properly created the chroot'ed account as per suggestions > in ftpd(8), then you will be probably as safe as you can get. If > someone can write to a root-owned file (irrepsective of a chroot'ed > environment), then they can trojan whatever they want, anyway. Depends on what 'they want' and if you hard-link everyone's ~/bin/ls... (bad example, internal ls is fix for this.) If they are not linked, so what? They trojan only that user (might not be them of the account is cracked). If the ~/bin/ls (or another shared binary) is hard-linked to everyone else's, they can get do a lot more. > > > We also couldn't think of anything better to support users changing their > > > own passwords than having /bin/passwd as their shell. EDI users usually > > > don't change their passwords often anyway... > > I would have thought that if you are chroot'ed, then you simply > could not affect your system-wide password. Am I missing something > here? I've worked in environments where we put together a secure > (as in 'https') web server/CGI solution for people to 'log in', as > to affect some (but not all!) fields of their password entry. If they are chroot()ed and the local ~/etc/passwd files have more account names than just theirs, they have more names to try cracking, that's all. They do not contain crypted passwords, of course, and you would never link them to the system /etc/passwd file anyway. Is there anything *wrong* with using /bin/passwd as a shell, since it shouldn't process .*rc or .login or .profile files? I like the ssh/cgi solution, btw, Got Source(tm)? - Jy@ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.10.9910121115330.87599-100000>