From owner-freebsd-questions@FreeBSD.ORG Thu Apr 17 16:42:30 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B318B37B401 for ; Thu, 17 Apr 2003 16:42:30 -0700 (PDT) Received: from smtp-send.myrealbox.com (smtp-send.myrealbox.com [192.108.102.143]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0642343F3F for ; Thu, 17 Apr 2003 16:42:30 -0700 (PDT) (envelope-from jimit@myrealbox.com) Received: from [10.10.10.2] jimit@smtp-send.myrealbox.com [4.60.255.9] $ on Novell NetWare; Thu, 17 Apr 2003 16:42:23 -0700 Mime-Version: 1.0 X-Sender: jimit@pop3.myrealbox.com Message-Id: In-Reply-To: <73AF04A0-7111-11D7-B269-000393460DB2@soupnazi.org> References: <73AF04A0-7111-11D7-B269-000393460DB2@soupnazi.org> Date: Thu, 17 Apr 2003 18:37:39 -0500 To: Jim Mock , Brent Bailey From: Jimi Thompson Content-Type: text/plain; charset="us-ascii" ; format="flowed" cc: freebsd-questions@FreeBSD.ORG Subject: Re: user toor ??? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Apr 2003 23:42:31 -0000 "toor" is no more and no less of a risk that "root". Secure it as you would root. Oh, and given sufficient opportunity, I can crack ANY password that uses characters from the ASCII set. It's just not that difficult. If you are going to expose this system the internet, I STRONGLY recommend that you use two-factor authentication and DO NOT RELY on passwords alone. At 1:16 PM -0700 4/17/03, Jim Mock wrote: >On Thursday, April 17, 2003, at 12:45 PM, Brent Bailey wrote: >>Can anyone tell me what function does the user "toor" that is put >>in by default by FBSD install do? > >It's a backup root user. > >>im told its a security risk ...but unsure what it does ?? > >I'm told a lot of things too, but that doesn't mean I believe all of >them :-) If you're excessively paranoid, you can remove the user, >but if someone can get into your machine and crack root/toor's >password, you've got bigger issues to worry about. > >- jim > >-- >- jim mock mij@{soupnazi|opendarwin}.org jim@{bsdnews|FreeBSD}.org - >- editor in chief, BSD News: http://bsdnews.org http://soupnazi.org - > >_______________________________________________ >freebsd-questions@freebsd.org mailing list >http://lists.freebsd.org/mailman/listinfo/freebsd-questions >To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" -- Thanks, Ms. Jimi Thompson, CISSP, Rev. "I'm a great believer in luck, and I find the harder I work, the more I have of it." -- Thomas Jefferson