From owner-cvs-lib  Sun Aug 31 06:11:25 1997
Return-Path: <owner-cvs-lib>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id GAA04083
          for cvs-lib-outgoing; Sun, 31 Aug 1997 06:11:25 -0700 (PDT)
Received: from awfulhak.demon.co.uk (awfulhak.demon.co.uk [158.152.17.1])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id GAA04074;
          Sun, 31 Aug 1997 06:11:09 -0700 (PDT)
Received: from gate.lan.awfulhak.org (localhost [127.0.0.1])
	by awfulhak.demon.co.uk (8.8.5/8.8.5) with ESMTP id OAA03515;
	Sun, 31 Aug 1997 14:05:01 +0100 (BST)
Message-Id: <199708311305.OAA03515@awfulhak.demon.co.uk>
X-Mailer: exmh version 2.0zeta 7/24/97
To: Eivind Eklund <perhaps@yes.no>
cc: Brian Somers <brian@awfulhak.org>, guido@gvr.org, brian@FreeBSD.ORG,
        cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG, cvs-lib@FreeBSD.ORG
Subject: Re: cvs commit: src/lib/libutil login_progok.3 login_progok.c Makefile libutil.h login.conf.5 
In-reply-to: Your message of "Sun, 31 Aug 1997 13:09:19 +0200."
             <199708311109.NAA14292@bitbox.follo.net> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 31 Aug 1997 14:05:01 +0100
From: Brian Somers <brian@awfulhak.org>
Sender: owner-cvs-lib@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

> > Hmm, making a ppp group would address the problem..... I don't really 
> > have an excuse for not doing it that way (temporary insanity?).
> > 
> > Perhaps I should take this stuff back out.  Does anyone see any 
> > reasons why it should stay ?  If someone wants to restrict use of a 
> > program they can:
> > 
> > $ ls -l /usr/sbin/ppp
> > -r-sr-x---  1 root  ppp  118784 Aug 28 01:03 /usr/sbin/ppp
> > 
> > So if you're not in the ``ppp'' group, you don't get to run it ;-)
> 
> Set this as the default, please.  Having PPP available to "joe user"
> break some security paradigms - there is a lot of havoc you can do by
> being able to modify the routing table...

Agreed.  I'll bet we get hammered with questions from everyone that 
upgrades and doesn't have a ``ppp'' group though !

Are there any rules about what gid to pick ?  Would 69 be appropriate 
- being next to ``dialer'' ?  I'll use that given no objections.

I also think that this should go into 2.2.  Anyone with a shell can 
pretty much bring the machine to its knees at the least.  At worst, 
they can be smart in routing everything from an important machine to 
their own by adjusting the default route.  After that..... gulp !

> Eivind.

-- 
Brian <brian@awfulhak.org>, <brian@freebsd.org>
      <http://www.awfulhak.org>
Don't _EVER_ lose your sense of humour....