From owner-freebsd-questions Fri Dec 4 13:25:32 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id NAA22462 for freebsd-questions-outgoing; Fri, 4 Dec 1998 13:25:32 -0800 (PST) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from dqc.org (dqc.org [12.7.119.10]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA22457 for ; Fri, 4 Dec 1998 13:25:31 -0800 (PST) (envelope-from mkultra@dqc.org) Received: from localhost (mkultra@localhost) by dqc.org (8.9.1a/dqc/OpenBSD) with ESMTP id NAA03778; Fri, 4 Dec 1998 13:28:03 -0800 (PST) Date: Fri, 4 Dec 1998 13:28:02 -0800 (PST) From: Keyser Soze To: mike grommet cc: freebsd-questions@FreeBSD.ORG Subject: Re: Advice on sendmail / execution of programs through .forward In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG you can block access to port 6000 out (if you have a firewall). This will prevent the xterm from writing to XServers outside your firewall. On Fri, 4 Dec 1998, mike grommet wrote: > Hi guys, I need some advice... > > I block off shell access to my primary server... > however one of my users pulled a sneaky one. > > He executed a xterm shell from his .forward and had it connect to his X > server on his personal PC... pretty slick actually, I have to give him that. > I never even considered it. > > Well, naturally I am a bit concerned about this... > this particular user is quite benevolent, but what about next time? > > I mean, it seems quite possible for a user to upload some sort of exploit > and an appropriate .forward via ftp, send mail to himself and WHAM. Life > gets real bad. > > Now, its quite convenient to be able to run programs from .forward, procmail > comes to mind immediately... > > So what do you guys suggest to fix this problem the right way? > > Mike Grommet > Unix Systems Adminstrator > Internet Solutions, Inc. > mgrommet@insolwwb.net > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message