lkml.org 
[lkml]   [1996]   [Mar]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: promiscuous mode
Date
> Recently, a user was able to temporarily gain root access on one of my 
> systems, and of course the first thing they did was install a password
> sniffer. Why is there not an option when compiling the kernel to
> completely disable promiscuous mode? I started to look over the source
> to see how difficult it would be to just remove the code responsible for
> activating promiscous mode, but I don't have time right now to dig deeper.

Because its a stupid option: All the hacker has to do if you dont have the
kernel code for promiscuous mode is upload a tiny root runnable binary that
does the relevant I/O operations. False security is worse than making the
issue clear.

If you want security:

a) Don't run plaintext passwords over the network use ssh/slogin or kerberos.
b) Use a filtering hub. Yes most of those you can get through with a lot of
skill but it stops the masses pulling a fast one.

Alan


\
 
 \ /
  Last update: 2005-03-22 13:36    [W:0.193 / U:0.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site