🚀 go-pugleaf

[Newsgroups: slightly trimmed]

Barry Margolin <barmar@bbnplanet.com> writes:

>In article <F5n9LH.AnB@scrum.muc.de>,
>M. Buchenrieder <mibu@scrum.muc.de> wrote:
>>No. The entry in the /etc/passwd file had been added _before_ the attack
>>could take place. So either the security had been compromised before, then 
>>the FTP attack would have been useless (since the intruder obviously had
>>root access alreeady), or the entry has been made by the sysadmin just
>>to _allow_ FTP access with root permissions.

>If you read the post, you would know that the second was not what
>happened.  Later in his post he said that they're still trying to figure
>out how the passwd entry got put in, and he asked for advice about that.

OK. I missed that one, then.

>The fact that there are other ways to break into the system does not excuse
>FTPD from being usable to implement a back-door.  

I'd not call this a backdoor. 
If you have a system with shadow passwords installed
and manually edit the /etc/passwd file to have an entry with an empty
password string and no corresponding entry in /etc/shadow, then you'll
always be able to login without password. Try it. Add a user manually
and login. I just tested it on a SuSE 5.3 system, using login.c v. 1.4 .
Using an FTP account to actually access the system is just a way to hide
the intruder(s) from the eyes of the sysadmin. But the damage is already
done.

Michael
-- 
Michael Buchenrieder * mibu@scrum.greenie.muc.de * http://www.muc.de/~mibu
          Lumber Cartel Unit #456 (TINLC) & Official Netscum