Re: Student suspended for distributing /etc/passwd

Thread View: comp.admin.policy

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Bill Smead Wed, 12 Jun 1991 23:24

#638

Author: Bill Smead
Date: Wed, 12 Jun 1991 23:24

30 lines
1680 bytes

[Stuff about UofGa student distributing passwd file removed.]

Stefan Linnemann writes:

> In the mean time users have to be able to read /etc/passwd in order to
> get a home directory, a login shell, etcetera.
> 
> /etc/passwd is a security risk, that has not been plugged, yet.

Sorry Stefan,  maybe it is not distributed in the Netherlands (see other
discussions re: crypt), but this HAS been "plugged":

Under Unix System V, there is an "/etc/shadow" feature which masks the
decrypted passwords from nosey users.  In the /etc/passwd file, only
a single x is shown in the second field.  The rest of the /etc/passwd is
straight from the old days (userid, UID, GID, full name, $HOME and login
shell).  The /etc/shadow contains the userid, the encrypted password,
and the password aging, in days.  This feature is turned on with a one-
time command ("pwconv", I believe), which creates /etc/shadow and alters
/etc/passwd.  The defaulr permissions for /etc/shadow restrict access
for all but root.  The concept, and proper use of shadow passwords
take some time to get used to, but after a short while, they become
second nature.

Regards,
  -Bill Smead
   Platform Manager
   AT&T

attmail!fsmead

Re: Student suspended for distributing /etc/passwd

#639

Author: David G. Paschich
Date: Thu, 13 Jun 1991 09:24

28 lines
1624 bytes

In article <2718@lafcol.UUCP> smeadf@lafcol.UUCP (Bill Smead) writes:

   [Stuff about UofGa student distributing passwd file removed.]

   Stefan Linnemann writes:

   > In the mean time users have to be able to read /etc/passwd in order to
   > get a home directory, a login shell, etcetera.
   > 
   > /etc/passwd is a security risk, that has not been plugged, yet.

   Sorry Stefan,  maybe it is not distributed in the Netherlands (see other
   discussions re: crypt), but this HAS been "plugged":

   [description of /etc/shadow in sysV]

The hole has been plugged in the Unix sold by AT&T after a certain
date, not everywhere that it exists in older software, obscure
software, etcetera.

BTW, is AT&T demanding a license fee to use the code which implements
/etc/shadow?  If so, they're certainly not doing everything they can
to promote the security of the Unix community.

--
David G. Paschich	Open Computing Facility		UC Berkeley
dpassage@ocf.berkeley.edu
"But I'd rather be a fish, 'cause a fish is an animal" -- Gener Fox

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads