🚀 go-pugleaf

In article <PCG.91Jun14182440@aberdb.aber.ac.uk> pcg@aber.ac.uk (Piercarlo Grandi) writes:

   crissl> Read the following carefully:
   crissl> [ ... /etc/passwd can be searched for obvious password ... ]
   crissl> /etc/passwd is a security risk, that has not been plugged, yet.

   This is only true for system administrators that are not that careful
   about security. There are at least two freely available /etc/shadow
   implementations. Kerberos is freely available too. If your /etc/passwd
   does contain the encryptions of actual password, you have *chosen* to do
   so, or you are very much behind the times, and you should not be a
   sysadmin.

Unless you're running a very strange proprietary OS, like Apollo's
Domain/OS, which makes it impossible to replace the standard login,
passwd, etc. programs because they use an unpublished, proprietary
format.

Please don't make blanket statements that having passwords in
/etc/passwd is always the administrator's fault.  I would very much
like to run shadow password software on the system I run, but my
group's lack of funds to buy a better machine with a better OS
prevents me from doing so.

--
David G. Paschich	Open Computing Facility		UC Berkeley
dpassage@ocf.berkeley.edu
"But I'd rather be a fish, 'cause a fish is an animal" -- Gener Fox

In article <PCG.91Jun14182440@aberdb.aber.ac.uk> pcg@aber.ac.uk (Piercarlo Grandi) writes:
>
>No. The point is: what the student did was not improper. There was a
>file readable to all. He took a copy of it, and gave it to somebody
>else. Had he had done so with /etc/motd, would that have been a breach
>of security? Clearly not. So this guy was suspended for having done
>something that was thoroughly harmless.
>It's not always true, but the shrillest screams about "hackers" often
>come from the sysadmins that know they are inadequate.
>--

Yes, it's not true. I suspect that the screams come from sysadmins who 
were once "hackers" themselves. A simple extension of the "it takes one
to know one" maxim, frankly, I would think that while it is true that
/etc/passwd is world readable, there really isn't any reason why someone
should pass copies of it around. If there was a legitimate reason,
certainly a note to the sysadmin telling him why it was being copied
would clear the air, eh? :-)

Once again, sites need to DEFINE their policy and EDUCATE their user
community and if the users AGREE to abide by that policy, we have no
right to denigrate a particular site's handling of a policy violation.
Sysadmins need to formulate a DRAFT policy and obtain the support of
their administration (pres., vice-pres., dean, etc.) to enforce it.

	-Randy Marchany
	VA Tech Computing Center
	Blacksburg, VA 24060

INTERNET: marchany@vtserf.cc.vt.edu
"my opinions are my own"

Whether the action taken by the university on this occasion was
justified is hard to say without hearing the full story. No
doubt that will be resolved at the suspension hearing :-)

As a naive user I would think the file was readable and so I could
give it to people. As a sysadmin I would garrot him. So without
deciding which hat to wear, some comments on a previous followup:

In article <1911@vtserf.cc.vt.edu>, marchany@vtserf.cc.vt.edu (Randy Marchany) writes:
> In article <PCG.91Jun14182440@aberdb.aber.ac.uk> pcg@aber.ac.uk (Piercarlo Grandi) writes:
>>
>>No. The point is: what the student did was not improper. There was a
>>file readable to all.
                   ^^^
I think *all* needs clarifying. We have no reason to assume that the
file was readable by anonymous users. I agree that the file would have
been readable by all registered, password verified users.

I take exception with your comment that the action was "not improper"!
Supposedly the student mailed a password file to an offsite person, so
said person could attempt to break onto usercodes. A person is not
judged guilty of an ILLEGAL act until proved guilty, but surely a
person mailing /etc/passwd offsite to a cracker without the agreement
of the sysadmin is clearly committing an IMPROPER act!

>>                      He took a copy of it, and gave it to somebody
>>else. Had he had done so with /etc/motd, would that have been a breach
>>of security? Clearly not. So this guy was suspended for having done
>>something that was thoroughly harmless.

There is a proven potential for unauthorised access to a system to be
gained by analyzing /etc/passwd. Is what the guy did thoroughly
harmless in the eyes of the sysadmin, users who rely on the integrity
of the system, and whoever pays for it?


[...] And from Randy Marchany:

> Once again, sites need to DEFINE their policy and EDUCATE their user
> community and if the users AGREE to abide by that policy, we have no
> right to denigrate a particular site's handling of a policy violation.
> Sysadmins need to formulate a DRAFT policy and obtain the support of
> their administration (pres., vice-pres., dean, etc.) to enforce it.
>
> 	-Randy Marchany
> 	VA Tech Computing Center
> 	Blacksburg, VA 24060
>
> INTERNET: marchany@vtserf.cc.vt.edu
> "my opinions are my own"

These are good words! People can argue about the policy, whether it is
right or wrong, but whether you agree to abide by it is a separate
issue.

--
The views expressed here are my own, and not necessarily those of my employer.

John Gee                        University of Otago, New Zealand
erin@otago.ac.nz (Internet)

In article <1911@vtserf.cc.vt.edu> marchany@vtserf.cc.vt.edu (Randy Marchany) writes:

<Once again, sites need to DEFINE their policy and EDUCATE their user
<community and if the users AGREE to abide by that policy, we have no
<right to denigrate a particular site's handling of a policy violation.
<Sysadmins need to formulate a DRAFT policy and obtain the support of
<their administration (pres., vice-pres., dean, etc.) to enforce it.

Yep -- it's that simple. And has no substitute.
Bud Hovell
-------------------------------------
bud@eecs.ee.pdx.edu -or- bud@mtek.com
The Policy Hacker  :-)

In <PCG.91Jun14182440@aberdb.aber.ac.uk> pcg@aber.ac.uk (Piercarlo Grandi) writes:

>... the most heinous security crime one can commit is employing a
>sysadmin that instead of knowing his system and how to fix obvious
>problems ...

>I would send to jail inadequate, opportunistic sysadmins. These cause a
>lot more damage than a few hackers.

Well, well, well.  The normally brilliant Piercarlo Grandi, who is
one of the very few people in the world to qualify for "global
select" in my newsreader, has a destructive, childish side!  Hmmm.

I suppose, according to his line of argument, if I fail to use the
latest, high-tech lock on my front door, or if I'm so backward as
to have a sliding glass door at all, then when Mr. Holy Hacker
comes in and rapes my daughter _I'm_ the one to be killed.

Fortunately, our backward country has slightly saner laws than
those in Mr. Grandi's current home, which recognize my right to
shoot the intruder to death even before he touches my daughter, an
act which I am well trained and fully prepared emotionally to
perform.  I trust most sane people would applaud my public-spirited
action in such a case.

I am not concluding that passing along /etc/passwd should be
considered even mildly criminal.  But it is entirely reasonable to
kick him off the system completely for a term or two, so that some
work in the real world might give him more prudent judgment.  A
year's delay in the student's career is of minor consequence,
compared with the valuable gift of maturity, insight, and
consideration for others that the suspension might encourage.

On 17 Jun 91 14:03:41 GMT, marchany@vtserf.cc.vt.edu (Randy Marchany) said:

marchany> I would think that while it is true that /etc/passwd is world
marchany> readable, there really isn't any reason why someone should
marchany> pass copies of it around. If there was a legitimate reason,

This is entirely backwards. Users are not there at the sufferance of the
syadmin. They don't have to prove they are innocent before copying a
file:

marchany> certainly a note to the sysadmin telling him why it was being
marchany> copied would clear the air, eh? :-)

This is just a bit fascistic. But it can lead on to all sorts of
nastiness. It's not the user that has to find a legitimate reason; it's
the sysadmin that must find a good reason to forbid it. Or do you
believe that the Government knows best?

marchany> Once again, sites need to DEFINE their policy and EDUCATE
marchany> their user community and if the users AGREE to abide by that
marchany> policy, we have no right to denigrate a particular site's
marchany> handling of a policy violation.

I was denigrating people who characterized copying /etc/passwd as a
security violation in itself. If the file is readable, and there is no
explicit rule that prohibits copying it, it can be copied, unless the
purpose of the copying is to aid trespass, if *proven*, after the fact,
not before.

There are places where only registered locksmiths can legally own lock
breaking equipment, and it is a crime for anybody else to carry them,
without any need to prove any criminal intent. These places may not be
pleasant to live in.

marchany> Sysadmins need to formulate a DRAFT policy and obtain the
marchany> support of their administration (pres., vice-pres., dean,
marchany> etc.) to enforce it.

This is OK, as long as the policy is not the default of "everything is
forbidden, just in case, and while in general we don't give a damn,
whenever we want we can nail you for one thing or another". This is a
very nasty habit of many governments and organizations, especially
Universities. It is used to lop the head off troublemakers... If
everybody is made into a criminal, those who decide whom to prosecute
can put anybody they choose behind bars.

In a University it may well happen that the students that break windows
to celebrate graduation get away with it, while those that stand on a
patch of grass while they protest some administration policy get
suspended for damaging University property.
--
Piercarlo Grandi                   | ARPA: pcg%uk.ac.aber@nsfnet-relay.ac.uk
Dept of CS, UCW Aberystwyth        | UUCP: ...!mcsun!ukc!aber-cs!pcg
Penglais, Aberystwyth SY23 3BZ, UK | INET: pcg@aber.ac.uk