From owner-freebsd-current@FreeBSD.ORG Tue Feb 24 07:26:38 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E4E1B16A4CE for ; Tue, 24 Feb 2004 07:26:38 -0800 (PST) Received: from mail4.speakeasy.net (mail4.speakeasy.net [216.254.0.204]) by mx1.FreeBSD.org (Postfix) with ESMTP id C48A043D1D for ; Tue, 24 Feb 2004 07:26:38 -0800 (PST) (envelope-from jhb@FreeBSD.org) Received: (qmail 4704 invoked from network); 24 Feb 2004 15:26:38 -0000 Received: from dsl027-160-063.atl1.dsl.speakeasy.net (HELO server.baldwin.cx) ([216.27.160.63]) (envelope-sender ) encrypted SMTP for ; 24 Feb 2004 15:26:38 -0000 Received: from 10.50.40.205 (gw1.twc.weather.com [216.133.140.1]) by server.baldwin.cx (8.12.10/8.12.10) with ESMTP id i1OFQY28037249; Tue, 24 Feb 2004 10:26:34 -0500 (EST) (envelope-from jhb@FreeBSD.org) From: John Baldwin To: kientzle@acm.org Date: Tue, 24 Feb 2004 10:27:58 -0500 User-Agent: KMail/1.6 References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca> <200402231553.34677.jhb@FreeBSD.org> <403A7DD0.2090802@kientzle.com> In-Reply-To: <403A7DD0.2090802@kientzle.com> MIME-Version: 1.0 Content-Disposition: inline Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <200402241027.58978.jhb@FreeBSD.org> X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on server.baldwin.cx cc: current@FreeBSD.org cc: Colin Percival Subject: Re: What to do about nologin(8)? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Feb 2004 15:26:39 -0000 On Monday 23 February 2004 05:25 pm, Tim Kientzle wrote: > John Baldwin wrote: > > My point (sigh) is that doing system("logger") has the same problem set > > as making nologin dynamic ... > > No, it doesn't. Not if you make nologin static and > have it create a fresh environment before running > any external programs. This would also be considerably > more compact than statically linking in the logging functions. Fair enough. > > Also, personally, I would rather have nologin be static than fix the one > > known case of login -p and just hope no other cases pop up in the future. > > Call me paranoid. :) > > Armoring nologin(8) is insufficient. > > In particular, as David Schultz pointed out, there are a lot > of home-grown nologin scripts out there that are potentially > vulnerable regardless of what we do with the "official" > nologin program. Then do both. :) -- John Baldwin <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve" = http://www.FreeBSD.org