Re: SECURITY PROBLEM: autofs [all versions]

2000-07-04 Thread Christopher W. Curtis
Nathan Paul Simons wrote: Yeah, but a lot of our users like to use these machines remotely because they can rely on them not to be in Windows (unlike our other dual boot clients). We try to keep only stable releases running on our production net machines so that we don't have to

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-04 Thread Tim
heh, it wont even boot on my athlon let alone be stable tim. Failure is not an option. It comes bundled with your Microsoft product. -- Ferenc Mantfeld On Tue, 4 Jul 2000, Christopher W. Curtis wrote: Nathan Paul Simons wrote: Yeah, but a lot of our users like to use

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-04 Thread Christopher W. Curtis
Tim wrote: heh, it wont even boot on my athlon let alone be stable I had to use the test (potato) boot disks, I believe. The problem is just that the old kernels won't boot athlon. Compile a new kernel (the latest 2.2.x should do) and make a boot disk (dunno how to make a bootdisk using the

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-04 Thread Roberto Magana
Perhaps yosu should move to potato, my Athlon is been working flawlessly. On Tue, Jul 04, 2000 at 05:42:05PM +1000, Tim wrote: heh, it wont even boot on my athlon let alone be stable tim. -- % [EMAIL PROTECTED]

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-03 Thread Wichert Akkerman
Previously Christopher W. Curtis wrote: Is the reason for disabling SysRq sinply the same (ability to reboot, etc) or do you think there could be an exploitable condition with the information given? SysRq is very good for killing a console lock such as vlock.. Wichert. --

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-03 Thread Christopher W. Curtis
Alvin Oga wrote: anytime someone has physical access to the machine... you already have a security problem ( my definition ) Fine definition. Not all computers are locked up, however, and if there is a huge room with only remote access allowed, there are often trust relationships setup

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-03 Thread Christopher W. Curtis
Nathan Paul Simons wrote: On top of that, we have our Linux-only machines set up so that ctl-alt-del spits up a message saying "This is a Linux-only machine", and the power and reset buttons are disabled, as well as the magic sys request keys. I thought about unplugging the reset

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-03 Thread Christopher W. Curtis
Alvin Oga wrote: anytime someone has physical access to the machine... you already have a security problem ( my definition ) Fine definition. Not all computers are locked up, however, and if there is a huge room with only remote access allowed, there are often trust relationships setup

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-03 Thread Christopher W. Curtis
Nathan Paul Simons wrote: On top of that, we have our Linux-only machines set up so that ctl-alt-del spits up a message saying This is a Linux-only machine, and the power and reset buttons are disabled, as well as the magic sys request keys. I thought about unplugging the reset

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-03 Thread Wichert Akkerman
Previously Christopher W. Curtis wrote: Is the reason for disabling SysRq sinply the same (ability to reboot, etc) or do you think there could be an exploitable condition with the information given? SysRq is very good for killing a console lock such as vlock.. Wichert. --

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-03 Thread Alexander Hvostov
Wichert, So is root's password. ;) Regards, Alex. --- PGP/GPG Fingerprint: EFD1 AC6C 7ED5 E453 C367 AC7A B474 16E0 758D 7ED9 -BEGIN GEEK CODE BLOCK- Version: 3.12 GCS/CMCC/IT d- s:+ a16 C++()$ UL$ P---() L E++ W+(-) N o? K? w--() !O M- !V PS++ PE- Y+ PGP t+ !5 X-- !R

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-03 Thread Nathan Paul Simons
On Mon, Jul 03, 2000 at 02:24:55PM -0400, Christopher W. Curtis wrote: I thought about unplugging the reset button and power switches, but it's tough to hit them accidentally and if someone wanted the system down, they'd pull the plug out of the back. I like having the ability to reset

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-02 Thread Peter Cordes
On Sat, Jul 01, 2000 at 09:45:43AM -0700, Alexander Hvostov wrote: Thor, Disable booting from floppy in BIOS, password protect LILO, install chassis intrusion detection system wired to gun turrets with 50mm heavy machine guns... ...okay, I think I'm going a little overboard here... ;)

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-02 Thread Peter Cordes
On Sat, Jul 01, 2000 at 09:45:43AM -0700, Alexander Hvostov wrote: Thor, Disable booting from floppy in BIOS, password protect LILO, install chassis intrusion detection system wired to gun turrets with 50mm heavy machine guns... ...okay, I think I'm going a little overboard here... ;)

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-01 Thread Thor
Hi, I'm obviously doing something wrong ... I've written to the maintainer of the autofs package according to the page summary listed under 'packages' from the website, and as I also saw somewhere else (dpkg -s listing?). I filed a bug report against autofs and marked it as release

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-01 Thread Alvin Oga
hi christopher... anytime someone has physical access to the machine... you already have a security problem ( my definition ) i am not sure that you can get physical access as root from the options shown in /etc/auto.misc but if oyu are correctwow...wonder how many people tried

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-01 Thread Mark Janssen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 1 Jul 2000, Thor wrote: huh ? and you call this an xploit ? if you have physical access to the console and floppy drive you can always start with a boot + root floppy, mount the hard disk and modify the mounted /etc/passwd file ...

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-01 Thread Daniel Burrows
On Sat, Jul 01, 2000 at 10:19:39AM +0200, Thor [EMAIL PROTECTED] was heard to say: if you have physical access to the console and floppy drive you can always start with a boot + root floppy, mount the hard disk and modify the mounted /etc/passwd file ... this is an old trick, usefull when

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-01 Thread Alexander Hvostov
Thor, Disable booting from floppy in BIOS, password protect LILO, install chassis intrusion detection system wired to gun turrets with 50mm heavy machine guns... ...okay, I think I'm going a little overboard here... ;) Regards, Alex. --- PGP/GPG Fingerprint: EFD1 AC6C 7ED5 E453 C367 AC7A

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-01 Thread Nathan Paul Simons
On Sat, Jul 01, 2000 at 08:55:10AM -0400, Daniel Burrows wrote: On Sat, Jul 01, 2000 at 10:19:39AM +0200, Thor [EMAIL PROTECTED] was heard to say: ..unless, of course, the machine's owner has disabled floppy boots..in which case, you have to open the thing up and reset the BIOS; if the

Re: SECURITY PROBLEM: autofs [all versions]

2000-07-01 Thread Thor
Hi, I'm obviously doing something wrong ... I've written to the maintainer of the autofs package according to the page summary listed under 'packages' from the website, and as I also saw somewhere else (dpkg -s listing?). I filed a bug report against autofs and marked it as release

Re: SECURITY PROBLEM: autofs [all versions]

2000-06-30 Thread Adam Heath
severity 66556 normal thanks On Fri, 30 Jun 2000, Christopher W. Curtis wrote: [ snipped 'sploit ] I do not consider this a problem. If you have console access to a machine, you can do much more damage than creating trojan floppys. Please search the list archives for discussions about mbr,

SECURITY PROBLEM: autofs [all versions]

2000-06-30 Thread Christopher W. Curtis
I'm obviously doing something wrong ... I've written to the maintainer of the autofs package according to the page summary listed under 'packages' from the website, and as I also saw somewhere else (dpkg -s listing?). I filed a bug report against autofs and marked it as release critical. I have

Re: SECURITY PROBLEM: autofs [all versions]

2000-06-30 Thread Adam Heath
severity 66556 normal thanks On Fri, 30 Jun 2000, Christopher W. Curtis wrote: [ snipped 'sploit ] I do not consider this a problem. If you have console access to a machine, you can do much more damage than creating trojan floppys. Please search the list archives for discussions about mbr,