🚀 go-pugleaf

[Newsgroups: slightly trimmed, F'Up set]

Daryle Niedermayer <dniederm@gds.ca> writes:

>This is a multi-part message in MIME format.

Urgh.

[...]

In another posting in this thread, I already stated that I overlooked
your statement about the added entry. The first paragraph of your original
posting was a bit misleading. My apologies.

>About WU-FTP. Thanks Barry for restating my point with such clarity. IMHO,
>WU-FTP should not be allowing openings that the shells deny. 

[...]

Last try:

a) On a system with shadow password enabled, an empty string in the 
   password field in /etc/passwd (and no entry in /etc/shadow) 
   will let you login without a password prompt.

b) You can't login via telnet as root due to the standard security
   precautions that prevent logins with EUID 0 (aka root) via the network
   (/etc/securetty) .

c) WU-FTPD doesn't look into /etc/securetty . Why should it ? It doesn't
   open a tty at all. Therefor, FTPD doesn't reject root logins that way.

Fact: Your system has been compromised. Backup your vital data and
reinstall , using the latest RH edition and the updates from the errata
page .

Michael
-- 
Michael Buchenrieder * mibu@scrum.greenie.muc.de * http://www.muc.de/~mibu
          Lumber Cartel Unit #456 (TINLC) & Official Netscum
   Note: If you want me to send you email, don't mungle your address.