From owner-freebsd-security Thu Mar 25 13:35:58 1999 Delivered-To: freebsd-security@freebsd.org Received: from trooper.velocet.ca (host-034.canadiantire.ca [209.146.201.34]) by hub.freebsd.org (Postfix) with ESMTP id 614F31558A for ; Thu, 25 Mar 1999 13:35:57 -0800 (PST) (envelope-from dgilbert@trooper.velocet.ca) Received: (from dgilbert@localhost) by trooper.velocet.ca (8.8.7/8.8.7) id QAA06503; Thu, 25 Mar 1999 16:35:35 -0500 (EST) From: David Gilbert MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <14074.44071.183931.902457@trooper.velocet.ca> Date: Thu, 25 Mar 1999 16:35:35 -0500 (EST) To: Matthew Dillon Cc: bmah@CA.Sandia.GOV (Bruce A. Mah), freebsd-security@FreeBSD.ORG Subject: Re: sudo (was Re: Kerberos vs SSH) In-Reply-To: <199903252044.MAA02527@apollo.backplane.com> References: <199903252032.MAA25377@stennis.ca.sandia.gov> <199903252044.MAA02527@apollo.backplane.com> X-Mailer: VM 6.62 under Emacs 19.34.2 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >>>>> "Matthew" == Matthew Dillon writes: Matthew> Simple: Because the program is designed to poke holes Matthew> through root and run specified programs. It's fairly easy to Matthew> misconfigure it, and there is no guarentee that the programs Matthew> it runs are themselves secure. sudo opens up a whole can of Matthew> potential security problems. Well... in that respect, sudo is simply pointing out how stupid the UN*X security model is once you get beyond one or two sysadmins working on a group of machines. Security itself isn't easy to configure. Dave. -- ============================================================================ |David Gilbert, Velocet Communications. | Two things can only be | |Mail: dgilbert@velocet.net | equal if and only if they | |http://www.velocet.net/~dgilbert | are precisely opposite. | =========================================================GLO================ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message