🚀 go-pugleaf

In article <%3No2.325$oD6.26447@burlma1-snr1.gtei.net>, Barry Margolin
<barmar@bbnplanet.com> wrote:

>In article <distler-1801991415380001@192.168.0.2>,
>Jacques Distler <distler@golem.ph.utexas.edu> wrote:
>>Color me stupid, but why does he allow root ftp logins, *period*.
>>Shouldn't root be in his ftpusers file?
>
>Even if it were, it wouldn't have helped in this case.  The line that the
>cracker added to /etc/passwd had a UID of 0, but the name wasn't "root".
>The ftpusers file lists names, not UIDs.

Given that the cracker must have had root access to do that, it would not
have mattered whether the ftpusers file lists names or UIDs. He could have
circumvented that, too. In this particular case, *nothing* could have
helped.

So the particular details of this attack do not seem to be salient to the
more general question about restricting ftp access by certain users. That
is controlled by the contents of the /etc/shells and /etc/ftpusers files,
not by the contents (or lack thereof) of the password field in
/etc/passwd.
I don't understand why the poster thinks that this is "less secure".

JD

-- 
PGP public key: http://golem.ph.utexas.edu/~distler/distler.asc