[lkml]   [1998]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Linux login security approaches
    On Tue, 8 Dec 1998, Neil Conway wrote:

    > Jeez, wrong on both counts. No-one needs to replace /bin/login, simply
    > print a message to the screen saying "Linux blah \n login:" and then
    > wait for someone to take the bait.
    > Secondly, NT's C-A-D requirement DOES prevent this, and thus DOES add
    > security, AND to make things better, I don't see how it makes life any
    > harder for users - it's just some keys you press to get a login screen.

    This whole argument is stupid... If you have access to the console then
    chances are you don't need the root password to get root. Bring out your
    handy floppy disk and manually edit /etc/shadow or whatever you want. The
    attack couldn't be done remotely by any means. If you are Joe
    Administrator and dumb enough to let someone log onto the console who
    might run a program like that, you deserve to get hacked wide open. I'm no
    expert on the subject, but wouldn't it be nearly impossible to completely
    disguise the fact that it wasn't really a login running on a getty?
    Regardless, I seriously doubt any OS is so secure you can allow open
    access to the console and not worry about it (of course you can always
    physically secure the actual case but lets not argue about this forever).


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:46    [W:0.018 / U:11.716 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site