From owner-freebsd-security Sat Jul 11 19:46:33 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id TAA12139 for freebsd-security-outgoing; Sat, 11 Jul 1998 19:46:33 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from soccer.ksg.com (ftw-tsa5-18.cyberramp.net [207.158.119.18]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id TAA12050 for ; Sat, 11 Jul 1998 19:46:08 -0700 (PDT) (envelope-from kgor@soccer.ksg.com) Received: (from kgor@localhost) by soccer.ksg.com (8.8.8/8.8.8) id TAA10008; Sat, 11 Jul 1998 19:35:38 -0500 (CDT) (envelope-from kgor) Date: Sat, 11 Jul 1998 19:35:38 -0500 (CDT) Message-Id: <199807120035.TAA10008@soccer.ksg.com> From: "Kent S. Gordon" To: jehamby@manta.jpl.nasa.gov CC: 026809r@dragon.acadiau.ca, security@FreeBSD.ORG In-reply-to: (message from Jake Hamby on Fri, 10 Jul 1998 16:53:44 -0700 (PDT)) Subject: Re: RootRunner (admin GUI w/o security holes?) Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >>>>> "jehamby" == Jake Hamby writes: > On Fri, 10 Jul 1998, Michael Richards wrote: >> Why not just use ssh to forward your root x connections via an >> encrypted connection. All of your problems go away. You are >> even secure from network sniffers because the entire data >> stream is encrypted. > Well, I definitely want to support ssh to allow secure remote > administration (where it would replace su or sudo in the scheme > I described), but I'm really loath to run any part of the GUI as > uid 0, if it's at all possible to avoid. While it's probably > not a security hole, per se, my biggest problem is the one I > already mentioned of how to start the program from the "start > menu" of your favorite windowmanager, without having to pop up > an ugly xterm window to ask for the root password. You could always create an no password entry in sudo for these cases or a special suid binary that invokes the program. I have used no password entry in sudo for this in the past. > -Jake > To Unsubscribe: send mail to majordomo@FreeBSD.org with > "unsubscribe security" in the body of the message -- Kent S. Gordon KSG -- Unix, Network, Database Consulting Postal: 76 Corral Drive North, Keller, Texas 76248 e-mail: kgor@ksg.com Phone:(817)431-8775 Resume: http://www.ksg.com/resume.html To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message