Messages in this thread | | | Date | Tue, 8 Dec 1998 22:40:00 -0500 (EST) | From | Wesley Morgan <> | Subject | Re: Linux login security approaches |
| |
On Tue, 8 Dec 1998, Neil Conway wrote:
> Jeez, wrong on both counts. No-one needs to replace /bin/login, simply > print a message to the screen saying "Linux blah \n login:" and then > wait for someone to take the bait. > > Secondly, NT's C-A-D requirement DOES prevent this, and thus DOES add > security, AND to make things better, I don't see how it makes life any > harder for users - it's just some keys you press to get a login screen.
This whole argument is stupid... If you have access to the console then chances are you don't need the root password to get root. Bring out your handy floppy disk and manually edit /etc/shadow or whatever you want. The attack couldn't be done remotely by any means. If you are Joe Administrator and dumb enough to let someone log onto the console who might run a program like that, you deserve to get hacked wide open. I'm no expert on the subject, but wouldn't it be nearly impossible to completely disguise the fact that it wasn't really a login running on a getty? Regardless, I seriously doubt any OS is so secure you can allow open access to the console and not worry about it (of course you can always physically secure the actual case but lets not argue about this forever).
WM
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |