Re: NIS with local root

From: Kilian CAVALOTTI (kilian.cavalotti@crans.org)
Date: 01/30/03

  • Next message: Kevin Jackson: "Re: NIS with local root" 
    From: "Kilian CAVALOTTI" <kilian.cavalotti@crans.org>
To: "Kevin Jackson" <kevin.jackson@genaware.com>, <focus-linux@securityfocus.com>
Date: Thu, 30 Jan 2003 17:30:07 +0100

    Kevin Jackson wrote:
    > Not entirely true.
    > Its the NFS export options - i.e. root_squash that needs to be used.
    >
    > /export/home @netgroup(rw,root_squash)
    > /export/home adminpc(rw,no_root_squash)
    >
    > only adminpc's root can modify files.

    You're right when you say that root@netgroup can't directly modify
    users' NFS mounted files. But, as previously said, everybody being root
    on a @netgroup computer can 'su - user' and modify any file owned by
    "user".

    NIS+NFS is definitively "at risk" as long as any @netgroup user knows
    root password (or is in sudoers). 

    -- 
Kilian CAVALOTTI | GPGKeyId: 0xD657340C
BOFH excuse #236:
Fanout dropping voltage too much, try cutting some of those little
traces

    Relevant Pages

    • Re: getaffinity/setaffinity and cpu sets.
      ... The notion would be that you can create a new numbered cpuset with cpuset. ... You can modify or inspect its affinity with get/setaffinity above and the CPU_WHICH_SET argument. ... This set would not be modifiable by user processes or by processes in a jail. ... Another option would be to expel the offending thread from the set that is in violation and reparent it to the real system root along with a syslog message or similar. ...
      (freebsd-arch)
    • Re: block root access to NFS mount
      ... I need to give root access to an NFS client host machine, ... Often this also means that root may not even access the nfs filesystem ...
      (Fedora)
    • Re: Tools for FreeBSD development
      ... Most typically, the setup involves a central development server running -STABLE, with a private network link to a series of crash boxes. ... The development server NFS exports a file system to use as an NFS root and for file sharing, as well as running tftp and dhcp servers. ... Each test system has its own exported root, so I can use individual loader.conf's to tell test systems to boot off NFS, boot off local disks, etc. ...
      (freebsd-hackers)
    • Re: Tools for FreeBSD development
      ... Most typically, the setup involves a central development server running -STABLE, with a private network link to a series of crash boxes. ... The development server NFS exports a file system to use as an NFS root and for file sharing, as well as running tftp and dhcp servers. ... Each test system has its own exported root, so I can use individual loader.conf's to tell test systems to boot off NFS, boot off local disks, etc. ...
      (freebsd-questions)
    • Re: Problem setting up NFS on Ubuntu
      ... I have installed Ubuntu ... > I used System - Administration - Synaptic Package Manager to include NFS ... Should I be using the GUI, and if so, how do I do that as root, ... and doesn't change the permissions displayed by ls -l ...
      (comp.os.linux.setup)