On Thu, 6 Jul 2000, Guy T. Rice wrote:
> There seems to be a bug in the security checking program. Here's an
> example of a piece a mail I receive from a mailserver I admin every day:
>
> ---------- Forwarded Message ----------
> Subject: *** Security Check, Wed Jul 5 00:00:28 CDT 2000 ***
> Date: Wed, 5 Jul 2000 00:00:28 -0500 (CDT)
> From: [EMAIL PROTECTED] (root)
>
>
> Security Warning: these home directory should not be owned by someone else or
>writeable :
> user=accounting : home directory is owned by accounti.
> user=compliance : home directory is owned by complian.
> -------------------------------------------------------
>
> I suspect it's comparing the text from "ls" to verify who owns what files,
> but that cuts off longer usernames. It could just compare the first 8
> characters, but that's insecure. It should use "ls -n" which will give
> the numeric UID/GID instead, which is the only way to do this securely.
Er... I already sent a patch. Here's the reply of Yoann:
On 2 Jun 2000 [EMAIL PROTECTED] wrote:
> Frank Meurer <[EMAIL PROTECTED]> writes:
>
> > Hello,
> >
> > I don't know the state of the current security scripts, but I've made
> > a patch for /etc/security/msec/cron-sh/security_check.sh (Mdk7,
> > msec-0.9-14mdk).
> > If you have users with login names longer than 8 chars than the security
> > check will fail due to a wrong comparison.
> > Here's the patch:
> >
> > --- /etc/security/msec/cron-sh/security_check.sh.orig Thu Jan 6 18:14:37
>2000
> > +++ /etc/security/msec/cron-sh/security_check.sh Fri Jun 2 10:27:43 2000
> > @@ -106,10 +106,10 @@
> > fi
> >
> > ### Check home directories. Directories should not be owned by someone else or
>writeable.
> > -awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
> > +awk -F: '/^[^+-]/ { print $3 " " $6 }' /etc/passwd | \
> > while read uid homedir; do
> > if [[ -d ${homedir} ]] ; then
> > - file=`ls -ldg ${homedir}`
> > + file=`ls -ldgn ${homedir}`
> > printf "$uid $file\n"
> > fi
> > done | awk '$1 != $4 && $4 != "root" \
>
> Thanks for your patch, will be included ASAP :-)
>
"As soon as possible" can be defined like one wishes. ;-)
-------------------------------------------------------------------------
"Nazis. Ooh, I hate these guys." -- Indiana Jones
Sending unsolicited commercial email to this address may be a violation
of the Washington State Consumer Protection Act, chapter 19.86 RCW.
Das Verschicken unverlangter kommerzieller email an diese Adresse ist
verboten (LG Traunstein, 2 HK O 3755/97 vom 14.10.1997, CR 1998, 171f).
(Frank Meurer, <[EMAIL PROTECTED]>, PGP ID: 0x5E756DA8)
