Re: Strange command histories in hacked shell history
From: Elvedin Trnjanin (mnsan11_at_earthlink.net)
Date: Fri, 17 Dec 2004 22:13:47 -0600 To: email@example.com
Bill Vermillion wrote:
> I understand that after using Unix for about 2 decades.
>However in FreeBSD a user is supposed to be in the wheel group [if
>it exists] to be able to su to root.
>But if a person who is not in wheel su's to a user who is in wheel,
>then they can su to root - as the system sees them as the other
>This means that the 'wheel' security really is nothing more
>than a 2 password method to get to root.
Precisely. If you don't like this then the way around is to only allow a
certain group access to su and none for everyone else.
>If the EUID of the orignal invoker is checked, even if they su'ed
>to a person in wheel, then they should not be able to su to root.
>I'm asking why is this permitted, or alternatively why is putting a
>user in the wheel group supposed to make things secure, when in
>reality it just makes it seem more secure - as there is only one
>more password to crack.
One more password to crack is more time which means a better chance of
catching the cracker in the act. Although I don't know why exactly the
authors of su did that the way they did but my first and best guess
would be convenience. The two password method is better than a new login
session each time you want to get to root. Second best guess would be is
that they didn't figure out that issue or at least think much of it.
-- --- Elvedin Trnjanin http://www.ods.org _______________________________________________ firstname.lastname@example.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "email@example.com"