🚀 go-pugleaf

coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size) writes:

>    So what's supposed to happen?  I'm running a system with standard ULTRIX
>    (other than modified FTP), and all this does is a full finger of the
>    passwd file of the remote system.  Is that the screwup?  What should it do
>    instead?

It's definately a major screwup.  This allows the pond scum who try and 
break into systems to get a list off all users and then attempt to crack the
password for each of these users.  Even worse, they can see who hasn't logged
in for a while and try those accounts knowing that they may not be detected,
or see what accounts have never been logged into and try them assuming that
they were recently added and have a null or obvious password.

Instead it should complain about the bogus user not existing.


   Cheers,
     --dag
_______________________________________________________________________________
Darren Alex Griffiths               | dag@nasty.ossi.com
Open Systems Solutions, Inc         | (510) 652-6200 x139
Fujitsu                             | Fax: (510) 652-5532
6121 Hollis Street                  | Berkeley is famous for two exports
Emeryville, CA 94608-2092           | LSD and unix, this isn't a coincidence.
_______________________________________________________________________________

dag@ossi.com (Darren Alex Griffiths) writes:
}coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size) writes:
}>    So what's supposed to happen?  I'm running a system with standard ULTRIX
}>    (other than modified FTP), and all this does is a full finger of the
}>    passwd file of the remote system.  Is that the screwup? ...
}It's definately a major screwup.  This allows the pond scum who try and 
}break into systems to get a list off all users and then attempt to crack the
   ...
}Instead it should complain about the bogus user not existing.

I like our fix better, try: finger @@iastate.edu
(a bunch of gotta-try-it students doing this on a system with 7000 passwd
entries convinced us to fix this in a hurry before system meltdown).

John
-- 
John Hascall                                       ``Live with it pink-boy!''
Project Vincent                                                              
Iowa State University Computation Center                     john@iastate.edu
Ames, IA  50011                                      515/294-9551 [fax -1717]

john@iastate.edu (John Hascall) writes:

>dag@ossi.com (Darren Alex Griffiths) writes:
>}coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size) writes:
>}>    So what's supposed to happen?  I'm running a system with standard ULTRIX
>}>    (other than modified FTP), and all this does is a full finger of the
>}>    passwd file of the remote system.  Is that the screwup? ...
>}It's definately a major screwup.  This allows the pond scum who try and 
>}break into systems to get a list off all users and then attempt to crack the
>   ...
>}Instead it should complain about the bogus user not existing.

>I like our fix better, try: finger @@iastate.edu
>(a bunch of gotta-try-it students doing this on a system with 7000 passwd
>entries convinced us to fix this in a hurry before system meltdown).

If you have problems with people using "@@", get a fingerd source (or
write your own :) and include '@' with the white space separators such
as \t, \n, ' ', etc.

Also stops people doing "finger @host1@host1@host1@host1@host1..." and
some other similar things.

For systems with large /etc/passwd files there should be a version of
getpwuid() & getpwnam() which look for information in hashed versions
on the passwd file (should be regenerated after any vipw or changes
to the /etc/group file).  I'm sure I've seen this implemented somewhere.

darren

In <dag.712016415@ossi.com> dag@ossi.com (Darren Alex Griffiths) writes:

>This allows the pond scum who try and 
>break into systems to get a list off all users and then attempt to crack the
>password for each of these users.  Even worse, [you can find idle usernames].

Isn't this carrying security by obscurity just a bit too far?  In
today's networking world, finding usernames is too easy.  Just scan
Usenet and collect email addresses -- you can build up a HUGE
collection in a day.  If you want idle usenames, well, do another scan
a month later, and look for the ones that aren't found any more.
-- 
Rahul Dhesi <dhesi@cirrus.com>
also: dhesi@rahul.net
"He's metabolically challenged, Jim."

dhesi@cirrus.com (Rahul Dhesi) writes:
}dag@ossi.com (Darren Alex Griffiths) writes:
} [...finger...]  Even worse, [you can find idle usernames].
}Isn't this carrying security by obscurity just a bit too far?  In
}today's networking world, finding usernames is too easy.  Just scan
}Usenet and collect email addresses -- you can build up a HUGE
}collection in a day.  If you want idle usenames, well, do another scan
}a month later, and look for the ones that aren't found any more.

Nothing says a site has to use usernames as e-mail/news addresses.
I expect firstname.lastname@site will probably become more popular
for this and other reasons.

John
-- 
John Hascall                                       ``Live with it pink-boy!''
Project Vincent                                                              
Iowa State University Computation Center                     john@iastate.edu
Ames, IA  50011                                      515/294-9551 [fax -1717]

john@iastate.edu (John Hascall) writes:

>I like our fix better, try: finger @@iastate.edu

Cute.

-- 
Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

  "Every extreme attitude is a flight from the self."  -- Eric Hoffer.