Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-10 Thread Daniel P. Berrange
On Wed, Apr 09, 2014 at 10:20:36PM +0200, Lennart Poettering wrote: On Wed, 02.04.14 09:12, quickbooks office (quickbooks.off...@gmail.com) wrote: [CHANGE PROPOSAL] The securetty file is empty by default All the info has been sitting here @

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-09 Thread Lennart Poettering
On Wed, 02.04.14 09:12, quickbooks office (quickbooks.off...@gmail.com) wrote: [CHANGE PROPOSAL] The securetty file is empty by default All the info has been sitting here @ https://fedoraproject.org/wiki/Changes/securetty_file_is_empty_by_default since March 20th. Did I mess something

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-09 Thread Matthew Miller
On Wed, Apr 09, 2014 at 10:20:36PM +0200, Lennart Poettering wrote: [technical reasoning snipped] Hence: please let's just remove securetty entirely from the default PAM stacks. It's annoying, it creates a false sense of security, it's a relict of a different time and not compatible with modern

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-09 Thread Chris Adams
Once upon a time, Matthew Miller mat...@fedoraproject.org said: On Wed, Apr 09, 2014 at 10:20:36PM +0200, Lennart Poettering wrote: [technical reasoning snipped] Hence: please let's just remove securetty entirely from the default PAM stacks. It's annoying, it creates a false sense of

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-09 Thread Paul Wouters
On Wed, 9 Apr 2014, Chris Adams wrote: Once upon a time, Matthew Miller mat...@fedoraproject.org said: On Wed, Apr 09, 2014 at 10:20:36PM +0200, Lennart Poettering wrote: [technical reasoning snipped] Hence: please let's just remove securetty entirely from the default PAM stacks. It's

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-09 Thread Chris Adams
Once upon a time, Paul Wouters p...@nohats.ca said: On Wed, 9 Apr 2014, Chris Adams wrote: Once upon a time, Matthew Miller mat...@fedoraproject.org said: On Wed, Apr 09, 2014 at 10:20:36PM +0200, Lennart Poettering wrote: [technical reasoning snipped] Hence: please let's just remove

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-09 Thread Lennart Poettering
On Wed, 09.04.14 22:20, Lennart Poettering (mzerq...@0pointer.de) wrote: This sounds entirely backwards, and I'd instead vote for removing securetty from the PAM stacks we ship altogether. The concept is outdated. It was useful in a time where the primary way to access a server was via

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-09 Thread Matthew Miller
On Wed, Apr 09, 2014 at 11:39:19PM +0200, Lennart Poettering wrote: To clarify this: while I believe dropping securetty from the default PAM config is the right thing to do, I am not vulunteering to do it. But I'd love to see somebody to pick this up! I looked, and I think this is just a

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-04 Thread Andrew Clayton
On Thu, 3 Apr 2014 07:32:38 -0700, quickbooks office wrote: This change will not affect logging into the console using the local account and then doing su to get root privileges. Is there a problem with logging into the local user account and then typing su and the root password? Maybe if

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread Simo Sorce
On Wed, 2014-04-02 at 19:15 -0400, Matthew Miller wrote: On Wed, Apr 02, 2014 at 02:12:50PM -0400, Simo Sorce wrote: How does someone express strong disagreement to this change ? Posting here is a good start. You can also add a note in the FESCo ticket for approval once one is filed, and if

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread quickbooks office
This change will not affect logging into the console using the local account and then doing su to get root privileges. Is there a problem with logging into the local user account and then typing su and the root password? You are as such prompted to make a local user account when doing an install

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread Reindl Harald
Am 03.04.2014 16:32, schrieb quickbooks office: This change will not affect logging into the console using the local account and then doing su to get root privileges. Is there a problem with logging into the local user account and then typing su and the root password? i do *not* need a

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread Simo Sorce
On Thu, 2014-04-03 at 07:32 -0700, quickbooks office wrote: This change will not affect logging into the console using the local account and then doing su to get root privileges. What local account ? Is there a problem with logging into the local user account and then typing su and the root

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread Chris Adams
Once upon a time, quickbooks office quickbooks.off...@gmail.com said: This change will not affect logging into the console using the local account and then doing su to get root privileges. The only local account on many (most?) systems with network authentication is root. -- Chris Adams

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread Paul Wouters
On Thu, 3 Apr 2014, Simo Sorce wrote: On Thu, 2014-04-03 at 07:32 -0700, quickbooks office wrote: This change will not affect logging into the console using the local account and then doing su to get root privileges. What local account ? Is there a problem with logging into the local user

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread Miloslav Trmač
2014-04-03 15:06 GMT+02:00 Simo Sorce s...@redhat.com: On Wed, 2014-04-02 at 19:15 -0400, Matthew Miller wrote: On Wed, Apr 02, 2014 at 02:12:50PM -0400, Simo Sorce wrote: How does someone express strong disagreement to this change ? Posting here is a good start. You can also add a note

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread Miloslav Trmač
2014-04-02 20:12 GMT+02:00 Simo Sorce s...@redhat.com: On Wed, 2014-04-02 at 09:12 -0700, quickbooks office wrote: [CHANGE PROPOSAL] The securetty file is empty by default All the info has been sitting here @ https://fedoraproject.org/wiki/Changes/securetty_file_is_empty_by_default I

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread Przemek Klosowski
On 04/03/2014 10:32 AM, quickbooks office wrote: 3.1.4.2.2. Disabling Root Logins To further limit access to the root account, administrators can disable root logins at the console by editing the /etc/securetty file. This is done in the name of accountability, by forcing an administrative

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-03 Thread Andrew Lutomirski
On Thu, Apr 3, 2014 at 2:46 PM, Przemek Klosowski przemek.klosow...@nist.gov wrote: On 04/03/2014 10:32 AM, quickbooks office wrote: 3.1.4.2.2. Disabling Root Logins To further limit access to the root account, administrators can disable root logins at the console by editing the

[CHANGE PROPOSAL] The securetty file is empty by default

2014-04-02 Thread quickbooks office
[CHANGE PROPOSAL] The securetty file is empty by default All the info has been sitting here @ https://fedoraproject.org/wiki/Changes/securetty_file_is_empty_by_default since March 20th. Did I mess something up? Or is there just a backlog? -- devel mailing list devel@lists.fedoraproject.org

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-02 Thread Jóhann B. Guðmundsson
On 04/02/2014 04:12 PM, quickbooks office wrote: [CHANGE PROPOSAL] The securetty file is empty by default All the info has been sitting here @ https://fedoraproject.org/wiki/Changes/securetty_file_is_empty_by_default since March 20th. Did I mess something up? Or is there just a backlog? I

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-02 Thread Jaroslav Reznik
- Original Message - [CHANGE PROPOSAL] The securetty file is empty by default All the info has been sitting here @ https://fedoraproject.org/wiki/Changes/securetty_file_is_empty_by_default since March 20th. Did I mess something up? Or is there just a backlog? Backlog. But for

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-02 Thread Chris Adams
Once upon a time, Jaroslav Reznik jrez...@redhat.com said: - Original Message - [CHANGE PROPOSAL] The securetty file is empty by default All the info has been sitting here @ https://fedoraproject.org/wiki/Changes/securetty_file_is_empty_by_default since March 20th. Did I

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-02 Thread Reindl Harald
Am 02.04.2014 19:29, schrieb Chris Adams: Once upon a time, Jaroslav Reznik jrez...@redhat.com said: - Original Message - [CHANGE PROPOSAL] The securetty file is empty by default All the info has been sitting here @

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-02 Thread Simo Sorce
On Wed, 2014-04-02 at 09:12 -0700, quickbooks office wrote: [CHANGE PROPOSAL] The securetty file is empty by default All the info has been sitting here @ https://fedoraproject.org/wiki/Changes/securetty_file_is_empty_by_default since March 20th. Did I mess something up? Or is there just a

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-02 Thread Matthew Miller
On Wed, Apr 02, 2014 at 02:12:50PM -0400, Simo Sorce wrote: How does someone express strong disagreement to this change ? Posting here is a good start. You can also add a note in the FESCo ticket for approval once one is filed, and if you are incredibly passionate you can come to the FESCo

Re: [CHANGE PROPOSAL] The securetty file is empty by default

2014-04-02 Thread Stephen John Smoogen
On 2 April 2014 17:15, Matthew Miller mat...@fedoraproject.org wrote: On Wed, Apr 02, 2014 at 02:12:50PM -0400, Simo Sorce wrote: How does someone express strong disagreement to this change ? Posting here is a good start. You can also add a note in the FESCo ticket for approval once one is