🚀 go-pugleaf

In article <1992Aug26.090053.28832@unibi.uni-bielefeld.de> mib@bio128.uni-bielefeld.de writes:
>6. REMOVE any pd apps you received in binary form.  NEVER AND I MEAN NEVER 
>   install pd binaries on ANY machine.  If you can't get the source for the pd    
>   stuff then don't install it.

Hmm...sounds like most of the NeXT apps I've seen out there. Especially
  some that are fairly useful to our users.

>7. Give the machines a boot password.  Anybody can bring a NeXT to single user 
>   mode and change password

Are you talking about a hardware password? I sure hope you don't forget it.
  What we do here is simply have "exec /bin/login -p root" as the last
  line of /.profile. Works well.

Here's a few that you missed:
  A) Make sure you remove "decode" alias from /usr/lib/aliases. I was only
     mildly amused when some tried to break in that way. Good thing we
     don't run sendmail here, otherwise it would have worked.
     (okay, so you mentioned this in #5, just not explicitly)
  B) There's something involving IFS and "some setuid root program". None
     of us here have been able to duplicate this. No fix either because
     you'd need to patch /bin/sh and you need source for that.
  C) Go through the password file and make sure no accounts have home
     directories in /tmp. It was annoying that ALL our NeXT stations came
     that way. Took no time to become user "daemon" using this. And daemon
     to root takes only a bit longer.
  D) People who administrate NeXTs on the INTERNET should really go through
     Chapter 16 of the Network and Systems Administration manual. They
     describe some of the things you must do to secure your NeXTs since
     they shipped open (like several other systems). The one about getting
     netinfo to give you the password file is probably something to look at.

	-Heiji

===========================================================================
 Mr. Heiji Horde    (Non NeXT mail only please)     e-mail: horde@reed.edu
   All insane acts are done in affiliation with Madd Hacker Enterprises
    The opinions expressed here are stolen from the person next to me.