From owner-freebsd-security Sun Aug 3 11:13:02 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.5/8.8.5) id LAA06030 for security-outgoing; Sun, 3 Aug 1997 11:13:02 -0700 (PDT) Received: from netrail.net (netrail.net [205.215.10.3]) by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id LAA06021 for ; Sun, 3 Aug 1997 11:13:00 -0700 (PDT) Received: from localhost (jonz@localhost) by netrail.net (8.8.6/8.8.6) with SMTP id OAA16795; Sun, 3 Aug 1997 14:12:00 GMT Date: Sun, 3 Aug 1997 14:12:00 +0000 (GMT) From: "Jonathan A. Zdziarski" To: Vladimir Litovka cc: freebsd-security@FreeBSD.ORG Subject: Re: setuid shutdown? In-Reply-To: <5s28mu$pev$1@grunt.vl.kharkov.ua> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk Yah that's enough, I was concerned b/c mine was executable by everybody. ------------------------------------------------------------------------- Jonathan A. Zdziarski NetRail Incorporated Server Engineering Manager 230 Peachtree St. Suite 500 jonz@netrail.net Atlanta, GA 30303 http://www.netrail.net (888) - NETRAIL ------------------------------------------------------------------------- On 3 Aug 1997, Vladimir Litovka wrote: :Hello! : :Jonathan A. Zdziarski wrote: : :> I just realized that my version of freebsd 2.2.2 installs with a :> set-uid-root shutdown command allowing anybody who wants to to shutdown or :> reboot the server. : :Why anybody? /sbin/shutdown installed as: : -r-sr-x--- root operator shutdown : :So only users, that is in 'operator' group allowed to start this program. :This is enought security, I think. : :Sinc, Doka : :~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ : ~NewsGate~ (c) Vladimir Litovka :