lkml.org 
[lkml]   [1998]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Linux login security approaches
On Tue, 8 Dec 1998, Neil Conway wrote:

> Jeez, wrong on both counts. No-one needs to replace /bin/login, simply
> print a message to the screen saying "Linux blah \n login:" and then
> wait for someone to take the bait.
>
> Secondly, NT's C-A-D requirement DOES prevent this, and thus DOES add
> security, AND to make things better, I don't see how it makes life any
> harder for users - it's just some keys you press to get a login screen.

This whole argument is stupid... If you have access to the console then
chances are you don't need the root password to get root. Bring out your
handy floppy disk and manually edit /etc/shadow or whatever you want. The
attack couldn't be done remotely by any means. If you are Joe
Administrator and dumb enough to let someone log onto the console who
might run a program like that, you deserve to get hacked wide open. I'm no
expert on the subject, but wouldn't it be nearly impossible to completely
disguise the fact that it wasn't really a login running on a getty?
Regardless, I seriously doubt any OS is so secure you can allow open
access to the console and not worry about it (of course you can always
physically secure the actual case but lets not argue about this forever).

WM



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:46    [from the cache]
©2003-2011 Jasper Spaans