🚀 go-pugleaf

In <92309.193737CXF111@psuvm.psu.edu> Charles Fee <CXF111@psuvm.psu.edu> writes:

>Why would a hacker (who apparently has root access) need to tell users to
>change their password?  On my system (Linux) all root has to do is wipe out
>the users' old password and then the account is free.  You could then log in
>as that user without a password and run the passwd program to change it to
>whatever the cracker feels like doing.  Similarly, couldn't this also be
>done to the root password as well?  This is all assuming that there is a
>normal /etc/passwd file.  I don't know what the story is with Yellow Pages..
>If a user has access to the passwd file, he can change the users group Id to
>0, too no?

You don't even have to go through all this, if you already have root
access.  Just use passwd from root with the username argument and you
can change it directly from root.

>I'm curious as to (if the above is correct) what can be done to cut down the
>chances of such an attack..

Mail forgery is a problem inherent in the non-encrypted non-verified
SMTP mail world.  Tell your users not to do certain things when you
give them the account.

-- 
"Insisting on perfect safety is for people who don't have the balls to live
 in the real world."   -- Mary Shafer, NASA Ames Dryden
------------------------------------------------------------------------------
Fred.McCall@dseg.ti.com - I don't speak for others and they don't speak for me.