From owner-freebsd-security  Sat Aug 25 11:15:56 2001
Delivered-To: freebsd-security@freebsd.org
Received: from webs1.accretive-networks.net (webs1.accretive-networks.net [207.246.154.13])
	by hub.freebsd.org (Postfix) with ESMTP id 938C937B40A
	for <Freebsd-security@FreeBSD.ORG>; Sat, 25 Aug 2001 11:15:52 -0700 (PDT)
	(envelope-from davidk@accretivetg.com)
Received: from localhost (davidk@localhost)
	by webs1.accretive-networks.net (8.11.1/8.11.3) with ESMTP id f7PHB2U76112;
	Sat, 25 Aug 2001 10:11:08 -0700 (PDT)
Date: Sat, 25 Aug 2001 10:11:02 -0700 (PDT)
From: David Kirchner <davidk@accretivetg.com>
X-X-Sender:  <davidk@localhost>
To: Kristen Doyle <colk@tampabay.rr.com>
Cc: Mike <wacky@blinx.net>,
	Moo Moo Moo <Freebsd-security@FreeBSD.ORG>
Subject: Re: Question
In-Reply-To: <000b01c12d8a$350d85e0$f0f2a118@tampabay.rr.com>
Message-ID: <20010825095954.I38221-100000@localhost>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

I'm not aware of any exploits for the shutdown command. If shutdown was
used, you'll see it in the 'last' output and in /var/log/messages.

On all of my FreeBSD systems, shutdown is setuid-root and is also owned by
the operator group, so anyone in operator can reboot the box through
shutdown.

Without more information, I would guess that your server was rebooted
through a different exploit, or perhaps it rebooted because it panic'd and
you have DDB and DDB_UNATTENDED(IIRC) configured in the kernel.

On Sat, 25 Aug 2001, Kristen Doyle wrote:

> As i thought I belive someone exploited that to reboot the box ( its a shell server with about 20 users on it so I only want shutdown really working from su or with a password
>   ----- Original Message -----
>   From: Mike
>   To: Kristen Doyle
>   Sent: Saturday, August 25, 2001 12:29 PM
>   Subject: Re: Question
>
>
>   No shutdown does not need to be suid but if you do set it -s then I would chmod 700 it.
>   -Mike
>     ----- Original Message -----
>     From: Kristen Doyle
>     To: Moo Moo Moo
>     Sent: Saturday, August 25, 2001 12:25 PM
>     Subject: Question
>
>
>     Does anyone know if shutdown should be setuid to work or if it dosent need it
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message