[lkml]   [1996]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Passwords & telnet/ftp
In article <> you write:
>> Use ssh. It's the best thing since sliced bread.
>> Heh. We can't do it that way, because then anybody could just read
>> /etc/passwd and send the proper (or rather, "improper") encrypted password
>> directly without having to worry about have to know and type the real
>> password. This is an issue even with shadow passwords, because _if_ the
>> shadow file is ever readable you're then wide open (instead of at least
>> having the normal crypt() security).
>Pity Microsoft didn't relise this.

And a great many other things.

Microsoft Mail also has severe security problems: it's not
client/server. To send or receive mail, you need to have full
read/write access to the mailbox you're sending to. (To send external
mail, outside of the local domain, say X.400 or SMTP email, this means
access to the *system* mailbox.) It's quite possible to delete the
whole lot by doing a DELTREE on the servers mail directory.

New versions of course implement Microsoft 'Advanced Security', which
means that whereas before the server mail directory was permanently
mounted as a DOS network drive, now you actually have to type 'MAP M:
//server/mail$' before it lets you do a DELTREE on the drive. (still
no password required.)

>Just one of the many bits of trivia you discover when implementing SMB :-)

Or trying to set up an NT server for mail and fileservice.

i built it up now i take it apart climbed up real high now fall down real far
no need for me to stay the last thing left i just threw it away
i put my faith in god and my trust in you
now there's nothing more fucked up i could do
<p><a href="">Me.</a>

 \ /
  Last update: 2005-03-22 13:37    [W:0.030 / U:0.128 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site