Re: Security of Debian SuX0r?

2000-09-03 Thread Peter Makholm
Peter Palfrader [EMAIL PROTECTED] writes: I'ld prefer keeping 755 as a default. I prefer 755 too. Peeking in others configuration files has been one of my best way of learning new programs at uni. I prefer a singel 'users' group for users as standard too, but lets not change the default

Re: Security of Debian SuX0r?

2000-09-02 Thread Roland Bauerschmidt
On Wed, Aug 30, 2000 at 02:57:20PM +0300, Juhapekka Tolvanen wrote: Kurt Seifried While we are at it. Kurt critizes that adduser creates home directories readable for all users by default. The woody version has an option in /etc/adduser.conf to change it to any value you want. Shall we make

Re: Security of Debian SuX0r?

2000-09-02 Thread Herbert Xu
Roland Bauerschmidt [EMAIL PROTECTED] wrote: want. Shall we make something like 700 default? It would break some things like UserDir public_html in Apache, etc. In my school server You could make it 711. -- Debian GNU/Linux 2.2 is out! ( http://www.debian.org/ ) Email: Herbert Xu ~{PmVHI~}

Re: Security of Debian SuX0r?

2000-09-02 Thread Joseph Carter
On Sat, Sep 02, 2000 at 10:07:04AM +1100, Herbert Xu wrote: want. Shall we make something like 700 default? It would break some things like UserDir public_html in Apache, etc. In my school server You could make it 711. 751 seems more reasonable IMO. -- Joseph Carter [EMAIL PROTECTED]

Re: Security of Debian SuX0r?

2000-09-02 Thread Bob Bernstein
On Fri, Sep 01, 2000 at 05:40:15PM -0500, Roland Bauerschmidt wrote: Shall we make something like 700 default? No. Resist the urge to dumb things down. Better to insist on intelligent, responsible users who have been educated, and have educated themselves, about the realities of computer

Re: Security of Debian SuX0r?

2000-09-02 Thread Jonathan D. Proulx
On Fri, Sep 01, 2000 at 05:40:15PM -0500, Roland Bauerschmidt wrote: :On Wed, Aug 30, 2000 at 02:57:20PM +0300, Juhapekka Tolvanen wrote: : Kurt Seifried : :While we are at it. Kurt critizes that adduser creates home :directories readable for all users by default. The woody version has :an option

Re: Security of Debian SuX0r?

2000-09-02 Thread Roland Bauerschmidt
On Fri, Sep 01, 2000 at 06:21:51PM -0500, Joseph Carter wrote: 751 seems more reasonable IMO. This sounds also reasonable for me. And because of the x-bit UserDirs, etc. should work. Does anyone objects if I change this with the next upload of adduser? Consider that this is only the default

Re: Security of Debian SuX0r?

2000-09-02 Thread Peter Palfrader
Hi Roland! On Fri, 01 Sep 2000, Roland Bauerschmidt wrote: On Fri, Sep 01, 2000 at 06:21:51PM -0500, Joseph Carter wrote: 751 seems more reasonable IMO. This sounds also reasonable for me. And because of the x-bit UserDirs, etc. should work. Does anyone objects if I change this with the

Re: Security of Debian SuX0r?

2000-09-02 Thread Ethan Benson
On Fri, Sep 01, 2000 at 08:06:20PM -0400, Jonathan D. Proulx wrote: Anything less than 700 breaks RSA authentication for ssh. A point to consider though I'll gladly concede that anyone using RSA keys ought to know what permissions they want on their home directory and how to change them.

Re: Security of Debian SuX0r?

2000-09-02 Thread Adam McKenna
On Fri, Sep 01, 2000 at 09:03:10PM -0800, Ethan Benson wrote: On Fri, Sep 01, 2000 at 08:06:20PM -0400, Jonathan D. Proulx wrote: Anything less than 700 breaks RSA authentication for ssh. A point to consider though I'll gladly concede that anyone using RSA keys ought to know what

Re: Security of Debian SuX0r?

2000-09-02 Thread Joseph Carter
On Sat, Sep 02, 2000 at 03:06:16AM +0200, Peter Palfrader wrote: 751 seems more reasonable IMO. This sounds also reasonable for me. And because of the x-bit UserDirs, etc. should work. Does anyone objects if I change this with the next upload of adduser? Consider that this is only the

Re: Security of Debian SuX0r?

2000-09-02 Thread Ethan Benson
On Sat, Sep 02, 2000 at 01:25:09AM -0400, Adam McKenna wrote: my home directory is mode 710 and ssh works fine, on other systems my home is mode 755 and ssh still works fine (all with RSA auth and StrictModes yes) Actually, sshd only cares about ~/.ssh and ~/.ssh/authorized_keys and

Re: Security of Debian SuX0r?

2000-09-02 Thread Bernhard R. Link
On Fri, 1 Sep 2000, Roland Bauerschmidt wrote: While we are at it. Kurt critizes that adduser creates home directories readable for all users by default. The woody version has an option in /etc/adduser.conf to change it to any value you want. Shall we make something like 700 default? I

Re: Security of Debian SuX0r?

2000-09-02 Thread Peter Palfrader
Hi Ethan! On Fri, 01 Sep 2000, Ethan Benson wrote: On Sat, Sep 02, 2000 at 01:25:09AM -0400, Adam McKenna wrote: my home directory is mode 710 and ssh works fine, on other systems my home is mode 755 and ssh still works fine (all with RSA auth and StrictModes yes) Actually,

Re: Security of Debian SuX0r?

2000-09-01 Thread Simon Richter
On Thu, 31 Aug 2000, Joey Hess wrote: Shadow passwords make your system more secure because nobody is able to view even encrypted passwords. Passwords are stored in a separate file that can only be read by special programs. We recommend the use of shadow passwords. If you're going to use

Re: Security of Debian SuX0r?

2000-09-01 Thread Joey Hess
Simon Richter wrote: Yup, this question is senseless. If you happen to have encrypted passwords in the passwd file, the shadow file is not looked at for these accounts. So having shadow passwords will not break NIS. The question is about the default setting. -- see shy jo -- To

Re: Security of Debian SuX0r?

2000-09-01 Thread Simon Richter
On Thu, 31 Aug 2000, Joey Hess wrote: Yup, this question is senseless. If you happen to have encrypted passwords in the passwd file, the shadow file is not looked at for these accounts. So having shadow passwords will not break NIS. The question is about the default setting. Maybe, but I

Re: Security of Debian SuX0r?

2000-08-31 Thread Peter Makholm
Bob Bernstein [EMAIL PROTECTED] writes: So there's a warning? At least MD5 *can* be implemented at install-time. Why doesn't he mention that Caldera for one doesn't even offer MD5 as an _option_ at install-time? Next: What Caldera do doesn't matter at all. Neither does it matter what anyone

Re: Security of Debian SuX0r?

2000-08-31 Thread Decklin Foster
Peter Makholm writes: I've just helped a friend instaling Debian. He had two comment about the above question. Is it the red or blue button there is active? It is badly marked which button you are about the press. You know, that *has* been bugging me... However you can use the cursor to

Confusing Red/Blue buttons (was: Security of Debian SuX0r?)

2000-08-31 Thread Ben Armstrong
Peter Makholm writes: I've just helped a friend instaling Debian. He had two comment about the above question. Is it the red or blue button there is active? It is badly marked which button you are about the press. On Thu, 31 Aug 2000, Decklin Foster wrote: You know, that *has* been

Re: Security of Debian SuX0r?

2000-08-31 Thread Daniel Burrows
On Thu, Aug 31, 2000 at 10:03:04AM -0400, Decklin Foster [EMAIL PROTECTED] was heard to say: Peter Makholm writes: I've just helped a friend instaling Debian. He had two comment about the above question. Is it the red or blue button there is active? It is badly marked which button you

Re: Security of Debian SuX0r?

2000-08-31 Thread Joey Hess
Peter Makholm wrote: I've just helped a friend instaling Debian. He had two comment about the above question. Is it the red or blue button there is active? It is badly marked which button you are about the press. Yes well there are already bugs filed on this, but it is going to change a lot in

Re: Security of Debian SuX0r?

2000-08-31 Thread Joey Hess
Daniel Burrows wrote: I know that joeyh has been working on a much nicer-looking slang frontend which doesn't suffer from this problem; maybe we can just ditch dialog eventually and use that? That is the plan; dialog is very limiting. However there is a trivial fix for dialog/whiptail too

Security of Debian SuX0r?

2000-08-30 Thread Juhapekka Tolvanen
I don't subscribe to these lists, but I am smart enough to use archives of these mailing-lists in www. And you can Cc: to me, if you want. * * * Have you guys and girls seen this? What do you think about it? http://www.securityportal.com/closet/ Debian 2.2 Kurt Seifried August 30, 2000 - I

Re: Security of Debian SuX0r?

2000-08-30 Thread Robert van der Meulen
Hi, I don't like crossposting to mailinglists, so i post this to debian-devel, as well as a Cc to the original author. Quoting Juhapekka Tolvanen ([EMAIL PROTECTED]): Have you guys and girls seen this? What do you think about it? http://www.securityportal.com/closet/ Before you flame me,

Re: Security of Debian SuX0r?

2000-08-30 Thread Colin Watson
Robert van der Meulen [EMAIL PROTECTED] wrote: I don't like crossposting to mailinglists, so i post this to debian-devel, as well as a Cc to the original author. Maybe you should have *really* Cc'd the original author :) (Read the article again; he isn't Juhapekka, that's for sure ...) -- Colin

Re: Security of Debian SuX0r?

2000-08-30 Thread Bob Bernstein
Juhapekka Tolvanen [EMAIL PROTECTED] wrote: Have you guys and girls seen this? What do you think about it? http://www.securityportal.com/closet/ I demur from the generally benign flavor of the reactions I've seen so far. I think this was a hatchet job by a guy who appears completely