From owner-freebsd-current Mon Apr 29 00:21:41 1996 Return-Path: owner-current Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id AAA27620 for current-outgoing; Mon, 29 Apr 1996 00:21:41 -0700 (PDT) Received: from irz401.inf.tu-dresden.de (irz401.inf.tu-dresden.de [141.76.1.12]) by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id AAA27600 for ; Mon, 29 Apr 1996 00:21:33 -0700 (PDT) Received: from sax.sax.de by irz401.inf.tu-dresden.de (8.6.12/8.6.12-s1) with ESMTP id JAA07485 for ; Mon, 29 Apr 1996 09:19:55 +0200 Received: by sax.sax.de (8.6.11/8.6.12-s1) with UUCP id JAA03760 for freebsd-current@FreeBSD.org; Mon, 29 Apr 1996 09:21:08 +0200 Received: (from j@localhost) by uriah.heep.sax.de (8.7.5/8.6.9) id JAA01368 for freebsd-current@FreeBSD.org; Mon, 29 Apr 1996 09:14:06 +0200 (MET DST) From: J Wunsch Message-Id: <199604290714.JAA01368@uriah.heep.sax.de> Subject: Re: cvs commit: src/lib/libskey skeylogin.c To: freebsd-current@FreeBSD.org (FreeBSD-current users) Date: Mon, 29 Apr 1996 09:14:05 +0200 (MET DST) Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch) In-Reply-To: <199604262133.OAA05910@freefall.freebsd.org> from Joerg Wunsch at "Apr 26, 96 02:33:22 pm" X-Phone: +49-351-2012 669 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E X-Mailer: ELM [version 2.4ME+ PL15 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-current@FreeBSD.org X-Loop: FreeBSD.org Precedence: bulk As Joerg Wunsch wrote: > joerg 96/04/26 14:33:21 > > Modified: lib/libskey skeylogin.c > Log: > /etc/skeykeys was basically suffering from the same vulnerability > as any non-shadowed /etc/passwd. Ironically, all programs using S/Key > have already been setuid root except keyinfo(1). > > This modification creates /etc/skeykeys with mode 0600 to prevent it > from being examined by ordinary users. NB: you ought to manually chmod 0600 /etc/skeykeys if you are already using it and chose the more secure way. The above works only for newly created files. -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)