On Mon, Jun 18, 2007 at 07:53:17PM +0200, Klaus Ethgen wrote:
Hello Bill,
Am Mo den 18. Jun 2007 um 17:53 schrieb Bill Allombert:
It is not the case on Debian by default:
nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
That's true but it is not as save as I wanna have it on my systems.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hi Bill,
Am Di den 19. Jun 2007 um 14:30 schrieb Bill Allombert:
What is you attack model ? So the server has a security flaw and run as
user nobody. If the attacker can run arbitrary code as user nobody, why
cannot they just exec /bin/sh ? Where
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Or another example which I remember of, I had a system where the pam
setup was a bit buggy. Now the only user which could attacked was one
with a real shell. All other was save. (Well, more or less.)
Gruß
Klaus
- --
Klaus Ethgen
On Sun, Jun 17, 2007 at 10:32:25PM +0200, Klaus Ethgen wrote:
Package: popularity-contest
Version: 1.41
Severity: important
Long time now I got the following line every week:
Jun 17 22:06:07 ikki popularity-contest: unable to submit report to
http://popcon.debian.org/cgi-bin/popcon.cgi.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hello Bill,
Am Mo den 18. Jun 2007 um 17:53 schrieb Bill Allombert:
It is not the case on Debian by default:
nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
That's true but it is not as save as I wanna have it on my systems. (All
system users on
Package: popularity-contest
Version: 1.41
Severity: important
Long time now I got the following line every week:
Jun 17 22:06:07 ikki popularity-contest: unable to submit report to
http://popcon.debian.org/cgi-bin/popcon.cgi.
I was wondering why I get this message as everything with this site
6 matches
Mail list logo
