From owner-freebsd-bugs@FreeBSD.ORG  Thu Mar 11 23:40:16 2004
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B22B316A4D0
	for <freebsd-bugs@hub.freebsd.org>;
	Thu, 11 Mar 2004 23:40:16 -0800 (PST)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 9F4D943D58
	for <freebsd-bugs@hub.freebsd.org>;
	Thu, 11 Mar 2004 23:40:16 -0800 (PST)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	i2C7eGbv015568	for <freebsd-bugs@freefall.freebsd.org>;
	Thu, 11 Mar 2004 23:40:16 -0800 (PST)
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.12.10/8.12.10/Submit) id i2C7eGC2015567;
	Thu, 11 Mar 2004 23:40:16 -0800 (PST)
	(envelope-from gnats)
Date: Thu, 11 Mar 2004 23:40:16 -0800 (PST)
Message-Id: <200403120740.i2C7eGC2015567@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: Sergey Akifyev <asa@gascom.ru>
Subject: Re: misc/64143: Security issue : fstab item missing causes
	automatic login as root without password when machine restarted.
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Sergey Akifyev <asa@gascom.ru>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 12 Mar 2004 07:40:16 -0000

The following reply was made to PR misc/64143; it has been noted by GNATS.

From: Sergey Akifyev <asa@gascom.ru>
To: Gerd Wachs <gerd.wachs@telia.com>
Cc: freebsd-gnats-submit@FreeBSD.org
Subject: Re: misc/64143: Security issue : fstab item missing causes
	automatic login as root without password when machine restarted.
Date: Fri, 12 Mar 2004 10:30:38 +0300

 --=-5zBcF27GX3rrWtorDLMA
 Content-Type: text/plain
 Content-Transfer-Encoding: quoted-printable
 
 On Fri, 2004-03-12 at 10:05, Gerd Wachs wrote:
 [...ripped by viruses...]
 > An error stating invalid device in the fstab.
 > You are asked for your shell with a default [bash\sh] for the root user.
 > You press enter, and you are into the system with root privileges
 > without having typed a password.
 
 This is not a security issue. This is what you system is configured to
 do. If you type:
 	# cat /etc/ttys |grep ^console
 it should say:
 	console none                            unknown off secure
 
 The 'secure' keyword here means, that single user mode can be entered
 without password. If you change this to 'insecure', FreeBSD will ask you
 root password before logging you into single user mode.
 
 This is documented in default /etc/ttys.
 IMHO, this PR can be closed.
 --=20
 regards,
 Sergey Akifyev <asa@gascom.ru>
 JSC Gascom <http://www.gascom.ru>
 PGP key available from:
 ftp://ftp.gascom.ru/pub/PGP-keys/asa.txt
 
 --=-5zBcF27GX3rrWtorDLMA
 Content-Type: application/pgp-signature; name=signature.asc
 Content-Description: This is a digitally signed message part
 
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.2.4 (FreeBSD)
 
 iD8DBQBAUWcdbu06QwmNwNsRAg1wAKCQRferM1JPI6xpz3T3MlHNHtfcZwCfeUIW
 /brU2HpXp4exqSFZdGB8JXw=
 =A2uk
 -----END PGP SIGNATURE-----
 
 --=-5zBcF27GX3rrWtorDLMA--