Re: Rename root to avoid hacking?

From: Colin McKinnon (colin.deletethis_at_andthis.mms3.com)
Date: 09/22/05 

Date: Thu, 22 Sep 2005 09:17:57 +0100

Vilmos Soti wrote:

> Noozer <dont.spam@me.here> wrote:
>
>> If I rename root, it eliminates a known user for a hacker to try to break
>> in as.
>
> Another thing I was thinking about was to rename /bin/sh to something
> else since a lot of exploits contain an 'exec /bin/sh' in some form.
>
> But I discarded the idea, since while it could be a relative effective
> way to stop automated attacks, it would also render my box unusable
> since a lot of legal (on my box) programs also have 'exec /bin/sh'.
>
> Renaming root or /bin/sh is not the best way to protect your box.
> It will cause a lot of headache, and at the end, you will undo your
> "security" change.
>

It's certainly not a starting point for securing a box. And I agree that it
has limited value. Yeah "root" provides a convenient starting point for
dictionary attacks, but who in their right mind actually allows users to
logon as root anywhere but on the console? (OK, SuSE for one - the default
sshd_config permits root logins).

C.

Relevant Pages

  • Re: hacking with uptime
    ... but to change to root he had to use su with password. ... > way the hacker get to get root-access. ... in one of your scripts that is world writeable - if one of these scripts ... and the hacker (had write accses using normal user) ...
    (alt.os.linux.suse)
  • Re: Security basics
    ... Examine the .bash_history file for your user and root. ... What other commands did they execute (cp, scp, ftp, wget, useradd, ... A hacker who cannot compromise the root account can still substitute ...
    (Fedora)
  • [Full-Disclosure] /usr/ports/games/abuse
    ... This should give root, i give root to by the way, on all BSD systems ... but now i have become a hacker i am going to send out many advisories ... char *buff, *ptr, *egg; ...
    (Full-Disclosure)
  • Re: Removing hackers file
    ... >> as owned by root, but root can't delete or edit it, only change its ... I have changed its permissions ... The other possibility is that this hacker has local access to your machine. ... Or local side network access. ...
    (comp.os.linux.security)
  • Removing hackers file
    ... A hacker has put what looks like a data file in my /dev/cpu. ... owned by root, but root can't delete or edit it, only change its ... I have changed its permissions ...
    (comp.os.linux.security)