Date: Tue, 25 Feb 1997 08:44:29 +0100 From: j@uriah.heep.sax.de (J Wunsch) To: adrian@cougar.aceonline.com.au (Adrian Chadd) Cc: marcs@znep.com (Marc Slemko), hackers@freebsd.org, auditors@freebsd.org Subject: Re: disallow setuid root shells? Message-ID: <Mutt.19970225084429.j@uriah.heep.sax.de> In-Reply-To: <Pine.LNX.3.93.970225093341.22261A-100000@cougar.aceonline.com.au>; from Adrian Chadd on Feb 25, 1997 09:38:09 %2B0800 References: <Pine.BSF.3.95.970224171452.14441E-100000@alive.znep.com> <Pine.LNX.3.93.970225093341.22261A-100000@cougar.aceonline.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
As Adrian Chadd wrote: > Ahh ok I'll take a look at that when I get home. I however like the idea > of logging all setuid programs when they are run, and at the kernel level > as well. The only problem I can see is with the size of the logs, but if > people think its a worthwhile thing I might have a look at implementing > something, again when I get home. If you do this: . make it configurable via sysctl, . don't turn it on by default. I presume you're gonna log it at auth.info, but i for sure don't wanna see each suid program with the same notification as each login. In an environment where you can basically trust your users, it's pointless to log them, all you have to care is to not get breakins from outside. -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Mutt.19970225084429.j>