From owner-freebsd-questions@FreeBSD.ORG Thu Aug 26 09:47:17 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id ABE8716A4CE for ; Thu, 26 Aug 2004 09:47:17 +0000 (GMT) Received: from smtp.infracaninophile.co.uk (smtp.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7064843D5E for ; Thu, 26 Aug 2004 09:47:16 +0000 (GMT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost.infracaninophile.co.uk [IPv6:::1])i7Q9lB8r028578 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 26 Aug 2004 10:47:11 +0100 (BST) (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost)id i7Q9l9Xd028577; Thu, 26 Aug 2004 10:47:09 +0100 (BST) (envelope-from matthew) Date: Thu, 26 Aug 2004 10:47:09 +0100 From: Matthew Seaman To: Tim Aslat Message-ID: <20040826094709.GD87719@happy-idiot-talk.infracaninophile.co.uk> Mail-Followup-To: Matthew Seaman , Tim Aslat , freebsd-questions@freebsd.org References: <20040825225051.7730643D58@mx1.FreeBSD.org> <62E23207-F6EB-11D8-8247-003065ABFD92@mac.com> <20040826084906.5ef2b1ad@bofh.spyderweb.com.au> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="yudcn1FV7Hsu/q59" Content-Disposition: inline In-Reply-To: <20040826084906.5ef2b1ad@bofh.spyderweb.com.au> User-Agent: Mutt/1.5.6i X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-1.5.6 (smtp.infracaninophile.co.uk [IPv6:::1]); Thu, 26 Aug 2004 10:47:11 +0100 (BST) X-Virus-Scanned: clamd / ClamAV version devel-20040705, clamav-milter version 0.74a on smtp.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on happy-idiot-talk.infracaninophile.co.uk cc: freebsd-questions@freebsd.org Subject: Re: Change root user name? possible? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Aug 2004 09:47:17 -0000 --yudcn1FV7Hsu/q59 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Aug 26, 2004 at 08:49:06AM +0930, Tim Aslat wrote: > In the immortal words of Charles Swiger ... > > Whether this gains you much security is another question entirely, and > > you risk breaking single-user mode and various low-level pieces of=20 > > software which expect root to exist, but it can be done. >=20 > I know it can be done, a couple of typos in vipw and I lost the root > account, very disconcerting, but single use mode still seemed to work, > probably because the toor account was still intact even though it has a > password of *. Actually, single user mode doesn't consult the password file at all -- or anything much in /etc except for /etc/fstab, and even that you can avoid. It gives you a superuser login session simply by setting the UID to 0, which is all that really counts to the lower leves of the system. If you think about it, that's a really useful design feature. It means you can recover the system even if your /etc directory gets completely scrambled. A good measure of the strength of your unix-fu is how badly trashed a system you can recover without having to re-install. You'ld be amazed at what some people have managed to resurrect. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --yudcn1FV7Hsu/q59 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (FreeBSD) iD8DBQFBLbGdiD657aJF7eIRAhPqAJ9/k9XVoIhDr4rG6T1DJAOgY2MDwgCghpLG Q5GR+z9TKQMQbLZaNQVxsEU= =sTgY -----END PGP SIGNATURE----- --yudcn1FV7Hsu/q59--