lkml.org 
[lkml]   [2003]   [Oct]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: A new model for ports and kernel security?
From
Date
John Lange <john.lange@bighostbox.com> writes:

> My understanding is that this is a hold-over from ancient days gone past
> where it was meant to be a security feature. Since only root processes
> can listen on ports less than 1024, you could "trust" any connection
> made to a low port to be "secure". In other words, nobody could be
> "bluffing" on a telnet port that didn't have root access therefore it
> was "safe" to type in your password.

It was for rlogin-like accesses, too - the server knew the client is
a suid and trusted program.
Think - NFS.

> Are not processes forced to run as root (at least at startup) that have
> security holes in them not the leading cause of "remote root exploits"?

Not commonly. They usually change ownership to something like www.www
and that is what the exploit gains first.
--
Krzysztof Halasa, B*FH
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.074 / U:0.260 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site