From owner-freebsd-security@FreeBSD.ORG Thu Aug 12 04:06:06 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E2B0216A4CE for ; Thu, 12 Aug 2004 04:06:05 +0000 (GMT) Received: from mail.freebsd.org.cn (dns3.freebsd.org.cn [61.129.66.75]) by mx1.FreeBSD.org (Postfix) with SMTP id 1D6CB43D41 for ; Thu, 12 Aug 2004 04:06:05 +0000 (GMT) (envelope-from delphij@frontfree.net) Received: (qmail 971 invoked by uid 0); 12 Aug 2004 04:03:29 -0000 Received: from unknown (HELO beastie.frontfree.net) (219.239.98.7) by mail.freebsd.org.cn with SMTP; 12 Aug 2004 04:03:29 -0000 Received: from localhost (localhost.frontfree.net [127.0.0.1]) by beastie.frontfree.net (Postfix) with ESMTP id C97AF11F64; Thu, 12 Aug 2004 12:06:02 +0800 (CST) Received: from beastie.frontfree.net ([127.0.0.1]) by localhost (beastie.frontfree.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 00631-10; Thu, 12 Aug 2004 12:05:57 +0800 (CST) Received: by beastie.frontfree.net (Postfix, from userid 1001) id D4B7F11F5E; Thu, 12 Aug 2004 12:05:56 +0800 (CST) Date: Thu, 12 Aug 2004 12:05:56 +0800 From: Xin LI To: Thomas Quinot Message-ID: <20040812040556.GC305@frontfree.net> References: <20040810161305.GA161@frontfree.net> <20040810095953.H1984@qbhto.arg> <20040811132930.GA3936@melusine.cuivre.fr.eu.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="hYooF8G/hrfVAmum" Content-Disposition: inline In-Reply-To: <20040811132930.GA3936@melusine.cuivre.fr.eu.org> User-Agent: Mutt/1.4.2.1i X-GPG-key-ID/Fingerprint: 0xCAEEB8C0 / 43B8 B703 B8DD 0231 B333 DC28 39FB 93A0 CAEE B8C0 X-GPG-Public-Key: http://www.delphij.net/delphij.asc X-Operating-System: FreeBSD beastie.frontfree.net 5.2-delphij FreeBSD 5.2-delphij #3: Fri Jul 30 20:01:43 CST 2004 delphij@beastie.frontfree.net:/usr/obj/usr/src/sys/BEASTIE i386 X-URL: http://www.delphij.net X-By: delphij@beastie.frontfree.net X-Location: Beijing, China X-Virus-Scanned: by amavisd-new at frontfree.net cc: "freebsd-security@FreeBSD.org" cc: Doug Barton Subject: Re: [PATCH] Tighten /etc/crontab permissions X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Aug 2004 04:06:06 -0000 --hYooF8G/hrfVAmum Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Aug 11, 2004 at 03:29:30PM +0200, Thomas Quinot wrote: > * Doug Barton, 2004-08-10 : >=20 > > Do you have a reason for wanting to do this other than, "OpenBSD does i= t=20 > > this way?" I personally see no problems, and some benefit for users=20 > > being able to see the system crontab. If the superuser needs to run=20 > > "secret" cron jobs, then there is root's crontab that can be used for= =20 > > this purpose. >=20 > Seconded. I would find it a nuisance to have to chmod a+r /etc/crontab > on all systems I set up. People who need tightened security against > hostile local users can use tools such as security/lockdown that will, > among many other things, remove world-read permissions from a bunch of > systemwide configuration files, including /etc/crontab. I think I would want to compromise at this point ;) In addition of this, personally I suggest the following changes to be made: - Provide an option in sysinstall so users will be instructed to choose whether to ``lockdown'' their systems as soon as the configuration is completed. Also, include this utility in the installation disc. - Add a new security audit script which will tell admins that the permission of "watched" configurations was altered. This might be turned off by default, or even a depency port of lockdown, to provide a mechanism to detect potential break-ins earlier, and to notice users when something like mergemaster or manual etc/ upgrades has reverted the permissions. What do you think about this? Actually the FreeBSD Simplified Chinese project is recently coordinating an effort of making an Internationalized FreeBSD Installer, I think we will try to implement these things if they looks better. Cheers, --=20 Xin LI http://www.delphij.net/ See complete headers for GPG key and other information. --hYooF8G/hrfVAmum Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (FreeBSD) iD8DBQFBGuykOfuToMruuMARAm5tAJ437PcJgS+ducDSxcUY3KyARjIZlQCfXe3f i9Xw2EJxrbJ2jJec37c6Mwc= =NNky -----END PGP SIGNATURE----- --hYooF8G/hrfVAmum--