From owner-freebsd-security Sun Apr 19 10:26:38 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id KAA23220 for freebsd-security-outgoing; Sun, 19 Apr 1998 10:26:38 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from fledge.watson.org (root@FLEDGE.RES.CMU.EDU [128.2.91.116]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id RAA23079 for ; Sun, 19 Apr 1998 17:26:13 GMT (envelope-from robert@cyrus.watson.org) Received: from trojanhorse.pr.watson.org (trojanhorse.pr.watson.org [192.0.2.10]) by fledge.watson.org (8.8.8/8.8.8) with SMTP id NAA14521; Sun, 19 Apr 1998 13:26:04 -0400 (EDT) Date: Sun, 19 Apr 1998 13:25:50 -0400 (EDT) From: Robert Watson X-Sender: robert@trojanhorse.pr.watson.org Reply-To: Robert Watson To: fpscha@schapachnik.com.ar cc: freebsd-security@FreeBSD.ORG Subject: Re: suid/sgid programs In-Reply-To: <199804190326.AAA00487@localhost.schapachnik.com.ar> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by hub.freebsd.org id RAA23080 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk On Sun, 19 Apr 1998, Fernando P. Schapachnik wrote: > En un mensaje anterior Robert Watson escribi˘: > [...] > > We note also that a fairly large chunk of suid/sgid programs are UUCP > > programs -- something that a majority of FreeBSD users (I would guess?) do > > not use. In terms of reducing risk, disabling suid/sgid on these programs > > Don't be so sure. FreeBSD boxes are an excellent choice for UUCP servers. > Actually I have a few running (and planning to install more). I had more in mind a toggle on our Hardening interface that essentially allowed the user to "turn off" categories of suid programs in the base installation. FreeBSD would still ship with the suid flags turned on for UUCP, but there would be a central administrative toggle for it. Don't get me wrong -- I used UUCP to ship mail and news for a number of years, and am fully appreciative of the service it offers in a weakly connected environment. However, I suspect that the majority of users who would be interested in the hardening project (i.e., web servers, firewall machines, large multi-user setups) are probably not using UUCP and can only benefit from any easy way to disable any potential security problems involved, Robert N Watson ---- Carnegie Mellon University http://www.cmu.edu/ Trusted Information Systems http://www.tis.com/ SafePort Network Services http://www.safeport.com/ robert@fledge.watson.org http://www.watson.org/~robert/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message