🚀 go-pugleaf

john@iastate.edu (John Hascall) writes:

>dag@ossi.com (Darren Alex Griffiths) writes:
>}coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size) writes:
>}>    So what's supposed to happen?  I'm running a system with standard ULTRIX
>}>    (other than modified FTP), and all this does is a full finger of the
>}>    passwd file of the remote system.  Is that the screwup? ...
>}It's definately a major screwup.  This allows the pond scum who try and 
>}break into systems to get a list off all users and then attempt to crack the
>   ...
>}Instead it should complain about the bogus user not existing.

>I like our fix better, try: finger @@iastate.edu
>(a bunch of gotta-try-it students doing this on a system with 7000 passwd
>entries convinced us to fix this in a hurry before system meltdown).

If you have problems with people using "@@", get a fingerd source (or
write your own :) and include '@' with the white space separators such
as \t, \n, ' ', etc.

Also stops people doing "finger @host1@host1@host1@host1@host1..." and
some other similar things.

For systems with large /etc/passwd files there should be a version of
getpwuid() & getpwnam() which look for information in hashed versions
on the passwd file (should be regenerated after any vipw or changes
to the /etc/group file).  I'm sure I've seen this implemented somewhere.

darren