From owner-freebsd-questions@FreeBSD.ORG Sun Feb 6 01:49:00 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B0C7B16A4CE for ; Sun, 6 Feb 2005 01:49:00 +0000 (GMT) Received: from smtp11.wanadoo.fr (smtp11.wanadoo.fr [193.252.22.31]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4C7B743D54 for ; Sun, 6 Feb 2005 01:49:00 +0000 (GMT) (envelope-from atkielski.anthony@wanadoo.fr) Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf1101.wanadoo.fr (SMTP Server) with ESMTP id 7A1241C0008B for ; Sun, 6 Feb 2005 02:48:59 +0100 (CET) Received: from pix.atkielski.com (ASt-Lambert-111-2-1-3.w81-50.abo.wanadoo.fr [81.50.80.3]) by mwinf1101.wanadoo.fr (SMTP Server) with ESMTP id 58A3A1C00089 for ; Sun, 6 Feb 2005 02:48:59 +0100 (CET) X-ME-UUID: 20050206014859363.58A3A1C00089@mwinf1101.wanadoo.fr Date: Sun, 6 Feb 2005 02:48:59 +0100 From: Anthony Atkielski X-Priority: 3 (Normal) Message-ID: <77133904.20050206024859@wanadoo.fr> To: freebsd-questions@freebsd.org In-Reply-To: <20050205172451.A49675@starfire.mn.org> References: <51563600.20050205125343@wanadoo.fr> <20050205100125.C47038@starfire.mn.org> <971531375.20050206000007@wanadoo.fr> <20050205172451.A49675@starfire.mn.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: Running top without a shell -- more questions X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: freebsd-questions@freebsd.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Feb 2005 01:49:00 -0000 John writes: J> No, there are HUGE security concerns. The big problem is that J> many things have shell escapes. Top, as far as I know, does not. But it's shell escapes that generally create the security concerns, no? Except for things like buffer overflows, but of course all FreeBSD software was written by seasoned programmers who know much better than to not check for buffer overflows. J> No, no! I am not suggesting changing the standard software! I'm J> not saying to change getty or login, just the usual configuration J> file that controls where the system runs gettys (or xdm, or what J> have you). This is no more changing "standard software" than J> making entries in rc.conf. Hmm ... okay. But I try to avoid changing stuff like that, too. It always seems to get lost in the shuffle if I have to update the OS. J> Look - if this makes you more comfortable - just turn off logins J> ENTIRELY on one ttyv. Then use the program I wrote to just run J> top on the ttyv on which logins are no-longer allowed. You could J> start it with cron or /etc/rc.d something instead of /etc/ttys. J> It doesn't matter how it gets started - the point is, NO LOGIN AT J> ALL is allowed on that terminal - how is that a security risk? J> J> You don't have to log in as top or root or anything - no logins - J> top just runs as the user YOU specify.... Okay, I'll consider it. Thanks. -- Anthony