Date: Sun, 3 Aug 1997 10:35:02 -0400 (EDT) From: Bill Pechter <pechter@lakewood.com> To: jonz@netrail.net (Jonathan A. Zdziarski) Cc: freebsd-security@freebsd.org Subject: Re: setuid shutdown? Message-ID: <199708031435.KAA02364@i4got.lakewood.com> In-Reply-To: <Pine.BSF.3.95q.970803100305.4197B-100000@netrail.net> from "Jonathan A. Zdziarski" at "Aug 3, 97 10:05:45 am"
next in thread | previous in thread | raw e-mail | index | archive | help
> I just realized that my version of freebsd 2.2.2 installs with a > set-uid-root shutdown command allowing anybody who wants to to shutdown or > reboot the server. Obviously I removed the bits, and got rid of the > problem, but you might all want to check that. I currently have sudo > installed, and am able to unsuid quite a few other programs and run them > under sudo (which logs nicely what my employees are doing too). > -r-sr-x--- 1 root operator 151552 Jun 10 13:59 /sbin/shutdown According to the permissions only root and members of the operator group can do shutdown with this version of shutdown (2.2.2-RELEASE) Bill ------------------------------------------------------------------------------ Bill Pechter | 17 Meredith Drive Tinton Falls, NJ 07724 | 908-389-3592 pechter@lakewood.com | Save computing history, give an old geek old hardware. This msg brought to you by the letters PDP and the number 11.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199708031435.KAA02364>