🚀 go-pugleaf

jeffo@ux1.cso.uiuc.edu (J.B. Nicholson-Owens) writes:

>And while I'm asking this, does 3.0 come with the changes that they
>say are 'secure' versus 2.1 insecure features (the things I'm speaking
>of are listed in the SysAdmin manual)?  Why, if these things are
>known, would NeXT choose to ship insecure machines?
There are good reasons that standalone machines would want to be set
up the way that NeXT ships them.  You could go through each thing
that is mentioned in the infamous Chapter 16 and find a reason that
it is shipped that way.  By the way, if you read Chapter 16, it
always tells why one would want the insecure behavour.
A few (I'm basically quoting out of the manual):
Why is / 1777 ?  Plenty of people like to make directories off of
their root without having to become root to do this.  Maybe they
'shouldn't', but it isn't that big of a deal when you are the only
one who uses this machine.
Why is PrintManager setuid root?  So you can delete print jobs,
regardless of who created them.  
Why is Preferences setuid root?  So that you can change the time
without having to log in as root, which people shouldn't be doing
all the time anyway.
Why isn't trusted_networks already set?  It would be impossible for
them to know which networks I want to trust!
etc...

There are somethings that a system administrator has to do.  
No system ships their system competely impenetrable... Sun still
ships machines with a '+' in the /etc/hosts.equiv.  (I wonder
whether they will still do so with Solaris 2.0, if it ever comes
out...)
The fact that NeXT documents these 'holes' sure is nice.  The other
holes that are fairly important have been issued through CERT
advisories and NeXT has remedied them (rdist, for example...which
hit almost every BSD system  anywhere).
-- 
David Lemson                                                 (217) 244-1205
University of Illinois NeXT Campus Consultant  / CCSO NeXT Lab System Admin
Internet : lemson@uiuc.edu                 UUCP :...!uiucuxc!uiucux1!lemson 
NeXTMail accepted                                   BITNET : LEMSON@UIUCVMD

lemson@ux1.cso.uiuc.edu (David Lemson) writes:
>Why is / 1777 ?  Plenty of people like to make directories off of
>their root without having to become root to do this.  Maybe they
>'shouldn't', but it isn't that big of a deal when you are the only
>one who uses this machine.

Actually, I found it to be a very big deal when I clicked on a
directory as some big image was being rendered (and the system became
jumpy, but the mouse still moved freely) and went to click on my Edit
icon in my dock (located just above the recycler).  A file I had
clicked on what I thought to be once ended up being dragged into the
recycler (since the path my mouse went to get to the Edit icon went
past the recycler).  Had I not noticed the dot in the recycler when I
purposefully went to recycle some files later on, I might have
inadvertantly recycled some very important system-level stuff.  I was
root at the time, so everything became deletable.

Also, with the root dir world-writeable, someone could quickly click
on Initialize instead of Eject, routinely say "Yes" to the panel that
comes up and reformat their hard disk.

I would think that it would benefit people if more accident-proofing
were put in from the start, like making the root directory only
root-writeable, as mentioned in the Network and System Administration
manual.

>Why is Preferences setuid root?  So that you can change the time
>without having to log in as root, which people shouldn't be doing
>all the time anyway.

Actually, my NeXT as well as 8 other NeXTs I know of came from NeXT
with the right time already set (only the timezone needed fixing).
Based on these occurrences, I would gamble that every NeXT has the
right time set.  Since this is something that people shouldn't be
messing with anyhow and the timezone only needs to be adjusted once
(thanks to the excellent automation of daylight savings time), why
ship with setuid?  Since NeXT knows where each NeXT goes anyhow (if
they know from the production line), they could even set the timezone
so it is received by the customer ready-to-go as far as the computer
clock goes.

To me, these are things that wouldn't cause any problem since they can
be tweaked or set once and forgotten about, and they have the added
advantage of not costing anything to implement at the factory.  If the
users want to remove the protection, I'd say that that is their
business, but I wouldn't want to have the computer for only a couple
of days and accidentally trash something necessary.

Anyways, my original question still stands on whether 3.0's daemons
are trustworthy or do we still need to go elsewhere to get ones that
protect against invaders.
-- 
-- Jeff (jeffo@ux1.cso.uiuc.edu)
-- No NeXTmail please