Re: nfs mounts / su / yp

From: Erik Trulsson (ertr1013@student.uu.se)
Date: 05/14/01 

Date: Mon, 14 May 2001 20:42:59 +0200
From: Erik Trulsson <ertr1013@student.uu.se>
To: Forrest Houston <fhouston@east.isi.edu>

On Mon, May 14, 2001 at 02:18:16PM -0400, Forrest Houston wrote:
> The problem is further complicated though when you want the user to have
> root access. We have some people around here who need/want total access
> to their machine. However there is still the concern of the NFS
> mounts. What do you do in these circumstances?
>

If those people have their own, personal, machines then you solve it by not
letting any other machines trust the 'compromised' machines.
Only export that persons homedirectory via NFS to that machine. Do not allow
any other directories to be mounted. Be careful with accepting
logins/connections from it. Basically treat it as if it was some unknown
machine out on the Big Bad Internet.

And make sure that the root password for those machines is different from
that on other machines.

It is usually a bad idea to give users root access if you don't trust them.
If you still have to give them root access then isolate their machines so
that they cannot access other machines.

> Thanks
> Forrest
>
> On Mon, 14 May 2001, Erik Trulsson wrote:
>
> >
> > If a user can login as root or su to root then they can (almost by
> > definition) do whatever they want. The solution is therefore to prevent
> > users getting root access in the first place since once they get it it is
> > too late to do anything about it.
> > First of, all make sure that only people you trust are in the wheel group and
> > know the root password. This will prevent other people from doing an su to root.
> >
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message 

-- 
<Insert your favourite quote here.>
Erik Trulsson
ertr1013@student.uu.se
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: nfs mounts / su / yp
    ... I think the problem is that a local root should mean only local ... root access, and su should not allow you to su to non-local users (ie, ... have users that WILL get root on their desktop machines, ...
    (FreeBSD-Security)
  • Re: r command security
    ... > system administrators didn't buy into this because they have to use these ... > features to work on different AIX machines and request me to further ... webserver and is only ever logged into by root for mounting disks with ... If a trust relationship is ...
    (comp.security.unix)
  • Re: Public disclosure of discovered vulnerabilities
    ... > On today's machines, they are all critical. ... the wall between root and non-root processes is a sieve. ... > buffer overrun in your web browser is pretty serious. ...
    (sci.crypt)
  • Re: FC9 Compromised...
    ... of time before they get root. ... should be aware of the likelihood that these machines have keyloggers ... Get your data off via the rescue disk boot, them completely wipe and re-install you compromised machines. ...
    (Fedora)
  • Re: how to access remote CUPS printer?
    ... On the remote machine, FC5, I am root. ... Is there a nonroot IPP client that can ... which consists of a single FC5 box. ... The automatic browsing only works for machines on the same LAN. ...
    (Fedora)
Quantcast