Date: Tue, 7 Mar 2000 18:58:21 -0800 (PST) From: Kris Kennaway <kris@hub.freebsd.org> To: Matthew Dillon <dillon@apollo.backplane.com> Cc: Igor Roshchin <igor@physics.uiuc.edu>, security@FreeBSD.ORG Subject: Re: named started by any user will be running until killed... Message-ID: <Pine.BSF.4.21.0003071857430.8920-100000@hub.freebsd.org> In-Reply-To: <200003070438.UAA50858@apollo.backplane.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 6 Mar 2000, Matthew Dillon wrote:
> Trying to do something more complex, like using jail or messing with
> program owner/group/permissions is going to mostly be a waste of time.
> If you are truely concerned you can chmod 750 and group-restrict
> the directories (/sbin, /usr/sbin, /usr/local/sbin). Personally I
> don't think it's worth the effort.... remember that every change you
> make to the base system is a change you have to remember to redo when
> you upgrade.
And it still doesn't prevent them downloading or compiling their own
binary. Doing *that* is harder again.
Kris
----
In God we Trust -- all others must submit an X.509 certificate.
-- Charles Forsythe <forsythe@alum.mit.edu>
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0003071857430.8920-100000>