Date: Tue, 31 Mar 2015 06:44:02 +0300 From: Slawa Olhovchenkov <slw@zxy.spb.ru> To: freebsd-security@freebsd.org Subject: Re: ftpd don't record login in utmpx Message-ID: <20150331034402.GE74532@zxy.spb.ru> In-Reply-To: <44y4me9gfi.fsf@lowell-desk.lan> References: <20150330142543.GD74532@zxy.spb.ru> <44y4me9gfi.fsf@lowell-desk.lan>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Mar 30, 2015 at 08:08:49PM -0400, Lowell Gilbert wrote: > Slawa Olhovchenkov <slw@zxy.spb.ru> writes: > > > ftpd from FreeBSD-10 and up don't record ftp logins to utmpx database > > (for case of chrooted login). > > This is lack security information. > > I found this is done by r202209 and r202604. > > I can't understand reason of this. > > Can somebody explain? > > Having a jail log into the base system is a security issue in the > making. Can't you do this in a safer way by doing remote logging to the > base system rather than having the jail hold on to a file handle that > belongs outside the jail? Jail? Why I you talk about jail? > It's certainly possible to maintain these kinds of capabilities, but > you would have to convince code reviewers that the same results can't be > achieved some other way that's easier to secure. Can you explain some more? A im lost point.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150331034402.GE74532>