[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: How to block telnet access.




Man, I'd like to be a user on your system...

Given a shell account, it's almost trivial to gain root. Read bugtraq and
you'll see. A rootshell bug is discovered every week. In a course of a year,
every given computer can be exploited to gain root, but you are protected
from outsiders in more than one 'wall' (they have to go through the
firewall, bypass your intrusion detection system, find an exploit, be able
to run it, erase the logs, etc.). Internal users, on the other hand, are
free to execute applications, which means they already bypassed most of your
security measures. Now they just have to wait for that one exploit to
appear...

So if you don't trust your internal users - DON'T give them accounts. Going
from regular user to root is trivial and only a matter of time (even if
you're superadmin).

But why give them shell accounts? Give them FTP access if you need file
transfer. If they INSIST on having shell accounts, set up a special computer
for them which will be sacrificial.

-------------------------
Aviram Jenik

"Addicted to Chaos"

-------------------------
Today's quote:

I think men who have a pierced ear are better prepared for
marriage. They've experienced pain and bought jewellery.
 - Rita Rudner


----- Original Message -----
From: "Or Sagi" <ors@actcom.co.il>
To: <linux-il@linux.org.il>
Sent: Sunday, September 26, 1999 2:12 PM
Subject: Re: How to block telnet access.


> On Sun, 26 Sep 1999, Adam Morrison wrote:
> >
> > Sorry, but you are in trouble.  If you have untrusted users on your
system,
> > then your security is broken by definition (and in practice).
> >
>
> I Disagree. There's no such thing as a perfectly secure system, but it's
> quite possible to build a system which is hard to compromise --- even from
> the inside.
>
>
> > Theoretically, you could try to build a chroot() jail for them.
> > Unfortunately, doing this correctly isn't quite trivial and does not
protect
> > you from all the threats.  Worse, assuming these people need to get some
work
> > done, they'll need access to (potentially vulnerable) applications and
> > directories and the `security' of the jail gets evenworse.
> >
>
> Practically all security measures aren't trivial --- and require a
> competent admin. Is that the case here ?
>
> (IMO, if going for security, some _basic_ questions need to be asked ---
> starting with - why linux ?).
>
> > FreeBSD has a jail(2) facility for similar purposes, but even that isn't
> > perfect.
> >
>
> SeOS is quite nice --- however, it's an incredible hassle to admin. above
> a certain (small) size, you practically need a SeOS admin, from my
> experience.
>
>
> > This appears to be a political problem, not a technical problem.
Untrusted
> > users on your system will lead to a security breach; the decision needs
to
> > be made as to what is more important.
> >
>
> having a machine turned on will lead to a security breach. the question is
> how easy is it to compromise the machine.
>
> -- Ors.
>
>
>
> =================================================================
> To unsubscribe, send mail to linux-il-request@linux.org.il with
> the word "unsubscribe" in the message body, e.g., run the command
> echo unsubscribe | mail linux-il-request@linux.org.il
>
>


=================================================================
To unsubscribe, send mail to linux-il-request@linux.org.il with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail linux-il-request@linux.org.il