From owner-freebsd-security@FreeBSD.ORG Fri Jul 9 19:18:57 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BA61D16A4CE for ; Fri, 9 Jul 2004 19:18:57 +0000 (GMT) Received: from sccrmhc11.comcast.net (sccrmhc11.comcast.net [204.127.202.55]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3A28643D5A for ; Fri, 9 Jul 2004 19:18:57 +0000 (GMT) (envelope-from piechota@argolis.org) Received: from acropolis.argolis.org ([68.84.142.193]) by comcast.net (sccrmhc11) with ESMTP id <20040709191855011009kaove>; Fri, 9 Jul 2004 19:18:56 +0000 Received: from acropolis.argolis.org (localhost [127.0.0.1]) i69JIo47013312; Fri, 9 Jul 2004 15:18:55 -0400 (EDT) (envelope-from piechota@argolis.org) Received: from localhost (piechota@localhost)i69JInYQ013309; Fri, 9 Jul 2004 15:18:49 -0400 (EDT) (envelope-from piechota@argolis.org) X-Authentication-Warning: acropolis.argolis.org: piechota owned process doing -bs Date: Fri, 9 Jul 2004 15:18:49 -0400 (EDT) From: Matt Piechota To: Roger Marquis In-Reply-To: <20040709165540.2799D2C1CC@mx5.roble.com> Message-ID: <20040709150227.P3496@acropolis.argolis.org> References: <20040709120136.22FD216A4D1@hub.freebsd.org> <20040709165540.2799D2C1CC@mx5.roble.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed cc: freebsd-security@freebsd.org Subject: Re: Root users shell == no existant shell /bin/bash X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Jul 2004 19:18:57 -0000 On Fri, 9 Jul 2004, Roger Marquis wrote: > Where do people come up with these folk "rules"? I spend all day > working in various root shells as part of my job. Couldn't do it > otherwise. It depends on what type of work you're doing, I suppose. The idea is you should only use root for things that are absolutely necessary. In theory, you should read man pages, investigate everything, and pull up a second shell as root just it issue commands with it. The reasoning is if there's a bug in a program (like man, or lynx, netscape) you could hose the whole system up if you're root (or get it infected). On the less paranoid side, a mistype as root could have rather bad consequences. -- Matt Piechota