From owner-freebsd-isp@FreeBSD.ORG  Mon Jun  2 09:44:25 2003
Return-Path: <owner-freebsd-isp@FreeBSD.ORG>
Delivered-To: freebsd-isp@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id BDBC337B401; Mon,  2 Jun 2003 09:44:25 -0700 (PDT)
Received: from mail.lambertfam.org (www.lambertfam.org [216.223.208.55])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 0D5B543F93; Mon,  2 Jun 2003 09:44:25 -0700 (PDT)
	(envelope-from lambert@lambertfam.org)
Received: from laptop.lambertfam.org (laptop.int.lambertfam.org [10.1.0.2])
	by mail.lambertfam.org (Postfix) with ESMTP
	id 3F75034D28; Mon,  2 Jun 2003 12:44:23 -0400 (EDT)
Received: by laptop.lambertfam.org (Postfix, from userid 1000)
	id 813BD89DD; Mon,  2 Jun 2003 12:43:52 -0400 (EDT)
Date: Mon, 2 Jun 2003 12:43:52 -0400
From: Scott Lambert <lambert@lambertfam.org>
To: isp@freebsd.org, security@freebsd.org
Message-ID: <20030602164352.GA80586@laptop.lambertfam.org>
Mail-Followup-To: isp@freebsd.org, security@freebsd.org
References: <001b01c3291e$80b3ca90$23fbab3f@psknet.com>
	<AJENJFOLCLAHHIIGCCHNAEAGGMAA.admin-lists@wolfpaw.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AJENJFOLCLAHHIIGCCHNAEAGGMAA.admin-lists@wolfpaw.net>
User-Agent: Mutt/1.4.1i
Subject: Re: quick poppassd question
X-BeenThere: freebsd-isp@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Internet Services Providers <freebsd-isp.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-isp>
List-Post: <mailto:freebsd-isp@freebsd.org>
List-Help: <mailto:freebsd-isp-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Jun 2003 16:44:26 -0000

On Mon, Jun 02, 2003 at 10:50:38AM -0600, Wolfpaw - Dale Corse wrote:
> > Perhaps someone can shed more light on the subject, but it's my
> > impression that most system process run with a UID/GID
> > under 100.  So a
> > uid < 100 should deny the change request.
> 
> Perhaps, though the trend is running most things as non-priv
> users, because it minimizes the damage to the server if a
> process is compromised. Generally "non-system" accounts seem
> to start at 1000 (BSD, and most Linux), or 500 (notably Redhat)
> so.. you may want to use 500 as the magic number for portability
> reasons.

Make it configurable!!!  Set a default but don't make hard coded
assumptions about someone else's systems.  On FreeBSD, the default
should probably be 1000.

make NON_SYSTEM_ACCT_START=4321