Date: Fri, 25 Jul 1997 23:51:20 -0400 (EDT) From: Bradley Dunn <bradley@dunn.org> To: freebsd-isp@freebsd.org Subject: Re: FTP Problem Solved! Message-ID: <Pine.BSF.3.96.970725233935.16455A-100000@ns2.harborcom.net> In-Reply-To: <2.2.32.19970723004250.00908ac8@mail.morelr.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 22 Jul 1997, Rick Morel wrote: > Assuming I'm not a dufus, get into the ISP business for a year or so and I > absolutely guarantee you'll know. You'll find things like your Majordomo > config files, complete with passwords posted on some web page and/or someone > else adminstering your lists. Anything that can be seen and read can be used > by some folks. It's a shame, it's not the "old 'net", but it is a fact. Well a lot of ISPs also offer shell accounts. It is significantly more difficult to make chrooted sandboxes for users to play in than it is to setup chrooted FTP. There has been some research into virtual machines and such...I seem to remember a web page at the Univeristy of Utah or somewhere. Setting up a shell server requires some thought, but it can be done securely. The short answer is: don't have your majordomo config. files on the same server that your users log into. Setup a box that does shell accounts and little to nothing else (certainly nothing mission critical). Setup your network in such a way that even if root were to be compromised on the shell machine no critical services would be affected. P.S. - Let's not get into whether offering shell accounts is 'good' or not. There is a market for that service. Some people provide it, some don't. It's a business decision. pbd -- Going to church does not make a person religious, nor does going to school make a person educated, any more than going to a garage makes a person a car.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.96.970725233935.16455A-100000>