Date: Fri, 20 Feb 2004 17:06:22 +0000 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: meimi <meimi_1@hotmail.com> Cc: freebsd-questions@freebsd.org Subject: Re: Removing system user Message-ID: <20040220170622.GD4997@happy-idiot-talk.infracaninophile.co.uk> In-Reply-To: <LAW11-OE45jMKtWNymW0000323c@hotmail.com> References: <LAW11-OE45jMKtWNymW0000323c@hotmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--N1GIdlSm9i+YlY4t
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Fri, Feb 20, 2004 at 11:51:03PM +0800, meimi wrote:
> I have read some document about server hardening. It suggests me removi=
ng
> the following users:
> operator, games, news, uucp
> and following groups:
> operator, staff
> I can guess that games is used for playing and news is used for reading
> news in news group. How about the other? Their descriptions in passwd are
> not clear.
> Am I safe to remove them in normal server environment (web, mail, ftp,
> DNS, SSH)?
You can certainly remove those users and groups, but it's unlikely to
gain you very much and quite likely to cause you some problems. It
will certainly make it harder for you to do routine updates on your
system, possibly including some security patches.
So long as you don't alter the entries in the master.passwd and group
files for those entities, you're pretty safe. Those IDs exist mostly
to be the owners of various files: note that the shell has been set to
/sbin/nologin and the password for those accounts has been locked and
that they have no special privileges despite the low UID and GID
numbers -- as such they are rather less dangerous than the account you
use to log in via.
All in all, I wouldn't bother touching those accounts.
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
--N1GIdlSm9i+YlY4t
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)
iD8DBQFANj6OdtESqEQa7a0RAjgdAJwJCxds6MgWyLbVgEPFz4IvPPU9AgCfQIAP
tLamn2Y1hQCIKfGbhFi451c=
=dPKl
-----END PGP SIGNATURE-----
--N1GIdlSm9i+YlY4t--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040220170622.GD4997>