Date: Tue, 2 Apr 2002 00:05:03 -0800 (PST) From: Jason Stone <jason@shalott.net> To: Jesper Wallin <z3l3zt@phucking.kicks-ass.org> Cc: <security@freebsd.org> Subject: Re: Stop usage of "who"? Message-ID: <20020401210722.S94832-100000@walter> In-Reply-To: <1501.213.112.58.125.1017722696.squirrel@phucking.kicks-ass.org>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Now I want to stop usage of commands like w, who and users.. I guess > it must be able to change somewhere in the proc dir instead of > changing the permissons on all the executables.. Most daemons/programs that log you in write a record into utmp/wtmp when they do so, and who(1) _et al_ just read utmp and print out whatever is in it. So to make this machanism fail, it is sufficient to either stop the writing to utmp/etc, or to stop the reading of utmp/etc. The files in question are (from /usr/include/utmp.h): #define _PATH_UTMP "/var/run/utmp" #define _PATH_WTMP "/var/log/wtmp" #define _PATH_LASTLOG "/var/log/lastlog" Making all these files mode 600 would allow who(1) to be run normally by root but fail for normal users. Also remember to change newsyslog.conf so that the restrictive permissions will get preservers when the files get rotated. Note that users will still be able to see some information about other users. netstat(1), for example, will show users all open network connections, vmstat(8) will allow users to see if someone is working at the physical console, etc. > Another thing I want to do (if it's possible) is to add a default > quota.. like, all new users who's being added will have about 500Mb of > disk space.. quotas are discussed in detail in section 12.5 of the handbook - check that out and then mail freebsd-questions if you have specific questions. If you're wondering strictly about setting the default when you create users, well then it depends on how you're creating the users, and there are many approaches you can take depending on your needs. wrapping pw(8) with a shell or perl script and running another script from cron to check that all users have a quota is the approach I'd take. -Jason ----------------------------------------------------------------------- I worry about my child and the Internet all the time, even though she's too young to have logged on yet. Here's what I worry about. I worry that 10 or 15 years from now, she will come to me and say "Daddy, where were you when they took freedom of the press away from the Internet?" -- Mike Godwin -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: See https://private.idealab.com/public/jason/jason.gpg iD8DBQE8qWYzswXMWWtptckRAtsaAKC4K3omxAaymOrfSakae1dbL0XDwACgtACu ig/YFCB7SkvzPjoP7x4ziHg= =cgJ2 -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020401210722.S94832-100000>