Re: hushlogin

Article View: comp.security.misc

Article #302

Back to comp.security.misc Previous Next

#302

From: Adam Shostack
Date: Thu, 27 Aug 1992 21:48

28 lines
1459 bytes

In article <1992Aug27.200330.24859@news.duc.auburn.edu> hendefd@woof.duc.auburn.edu writes:
>What is a .hushlogin file and why does my system have an empty 
>one in /usr/spool/uucppublic?

From Sun login(1)

     When successful, login updates accounting files, prints disk
     usage  and  limits (by running quota(1),) prints the message
     of the day, informs you of the existence of  any  mail,  and
     displays  the  time  you last logged in.  None of these mes-
     sages is printed if there is a .hushlogin file in your  home
     directory.   This  is  mostly  used  to make life easier for
     nonhuman users, such as uucp(1C).

The crackers may have used this file to store data, stolen passwords,
etc.

Since the contents of .hushlogin (so far as I know) are ignored, this
is a fairly good place to hide something.

Adam



Adam Shostack 					adam@das.harvard.edu

What a terrible thing to have lost one's .sig.  Or not to have a .sig
at all.  How true that is.

Technical Details

Message-ID: <1992Aug27.214859.8408@das.harvard.edu>

Path: arc1-ca.pugleaf.net!sparky!uunet!europa.asd.contel.com!emory!ogicse!das-news.harvard.edu!calliope!adam

References: <1992Aug27.200330.24859@news.duc.auburn.edu>

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!sparky!uunet!europa.asd.contel.com!emory!ogicse!das-news.harvard.edu!calliope!adam
From: adam@calliope.uucp (Adam Shostack)
Newsgroups: comp.security.misc
Subject: Re: hushlogin
Message-ID: <1992Aug27.214859.8408@das.harvard.edu>
Date: 27 Aug 92 21:48:59 GMT
References: <1992Aug27.200330.24859@news.duc.auburn.edu>
Sender: usenet@das.harvard.edu (Network News)
Organization: Aiken Computation Lab, Harvard University
Lines: 28

Reply to Parent Message