Date: Wed, 29 Nov 1995 15:04:01 -0700 (MST) From: Terry Lambert <terry@lambert.org> To: jgreco@brasil.moneng.mei.com (Joe Greco) Cc: jkh@time.cdrom.com, terry@lambert.org, joerg_wunsch@uriah.heep.sax.de, freebsd-current@FreeBSD.ORG Subject: Re: schg flag on make world in -CURRENT Message-ID: <199511292204.PAA28746@phaeton.artisoft.com> In-Reply-To: <199511290247.UAA13600@brasil.moneng.mei.com> from "Joe Greco" at Nov 28, 95 08:47:56 pm
next in thread | previous in thread | raw e-mail | index | archive | help
> Terry, I don't think su is broken. Think about su in an environment where > you: (1) are in an xterm (2) telnetted in via encrypted telnet (3) etc. I buy the encrypted telnet. I don't buy the xterm, unless it's local. What you want is a flag on the pty (settable only by root) to tell it the client is from a local or secure connection. An encrypted telnetd would set it. A regular telnetd would not. A local xterm or screen, etc., would set it. A remotely displayed xterm would not. The "secure" really wants to be an attribute of the tty or slave pty (as set by an suid program on the master), etc. > Wheel users should be intelligent enough to decide on their own if their > channel is sufficiently secure. Forcing people to mark their pty's as > "secure" would be making the system less secure. The marking is really a useless activity. They should never be marked secure -- su and login need to decide whether or not to relax security based on administrative fiat. Having a "secure" marking in the /etc/ttys is a kludge dating back to the serial console. It really has nothing to do with networking connections, except that pty's are used for network based logins. And that's just coincidental -- it based on how the network access happens to be implemented in this particular case. Most modern systems push an ldterm on the stream head and directly hook the slave instead of using a pty at all. Terry Lambert terry@lambert.org --- Any opinions in this posting are my own and not those of my present or previous employers.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199511292204.PAA28746>