From owner-freebsd-hackers Sat May 20 12: 1: 7 2000 Delivered-To: freebsd-hackers@freebsd.org Received: from acl.lanl.gov (acl.lanl.gov [128.165.147.1]) by hub.freebsd.org (Postfix) with ESMTP id 2704937B67F for ; Sat, 20 May 2000 12:01:05 -0700 (PDT) (envelope-from rminnich@lanl.gov) Received: from localhost (rminnich@localhost) by acl.lanl.gov (8.8.8/8.8.5) with ESMTP id NAA290434; Sat, 20 May 2000 13:00:59 -0600 (MDT) X-Authentication-Warning: acl.lanl.gov: rminnich owned process doing -bs Date: Sat, 20 May 2000 13:00:59 -0600 From: Ronald G Minnich To: Nick Sayer Cc: hackers@FreeBSD.ORG Subject: Re: rexec as root In-Reply-To: <391C12B5.E5A2DCD3@quack.kfu.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Fri, 12 May 2000, Nick Sayer wrote: > I would like to gather some opinions in regards to _very slightly_ > backing off > on rexec's security. > > rexec makes the following checks, and refuses to allow usage if any are > true: > > uid == 0 I turned off this check at sarnoff six years ago. rexec allows you to quickly run lots of commands across a cluster, given the right tool (see http:/www.acl.lanl.gov/~rminnich and look at vex). Using rexec I could run commands across a 128-node cluster in less than a second. Nothing I have ever seen is nearly as fast. A secure low-overhead remote exec is the right thing; rexec with uid == 0 disabled is the next-best thing. ron To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message