🚀 go-pugleaf

In article <92309.193737CXF111@psuvm.psu.edu>, Charles Fee <CXF111@psuvm.psu.edu> writes:
> Why would a hacker (who apparently has root access) need to tell users to
> change their password?
> On my system (Linux) all root has to do is wipe out
> the users' old password and then the account is free.  You could then log in
> as that user without a password and run the passwd program to change it to
> whatever the cracker feels like doing.  Similarly, couldn't this also be
> done to the root password as well?  This is all assuming that there is a
> normal /etc/passwd file.  I don't know what the story is with Yellow Pages..
> If a user has access to the passwd file, he can change the users group Id to
> 0, too no?
> 
> I'm curious as to (if the above is correct) what can be done to cut down the
> chances of such an attack..

You don't need root access to forge a mail message from "root".

-- 
Cosmik Debris --- "I owe money, therefore I am!"