Baslinux mailing list

[3aoo-cvfd AT dea.spamcon.org]

sindi keesan wrote:
>
> How would someone attack and do any damage as user?  

There are many methods of getting root access from a 
user account.  Up-to-date distributions are designed
to block all known methods.  When a new method is
found, distributions are updated to block it.

Any distribution (like BasicLinux) that is not right
up-to-date will be vulnerable to one or more methods.  
The older the distribution, the more potential
vulnerabilities it is exposed to.

Keep in mind, however, that for a remote attacker to
get access, some sort of network server must be running
on the target system.  The default BasicLinux does not
run network servers, so there is no actual vulnerability.
However, if you run telnetd on BasicLinux and connect to
the internet, your system is wide open to remote access.
And, yes, there are malicious users who scan the internet 
for vulnerable Unix-type systems.  Having root access to
anonymous systems is useful for crackers, spammers, and 
hardcore porn distributors.

> If we use this setup to share a modem connection, it 
> still seems unlikely anyone would telnet from elsewhere 
> to our dialed-in computer.

Yes, a dial-in connection is less likely to be compromised
than a 24/7 connection.  It is certainly much less useful 
to crackers (etc).  However, you might be unlucky and get 
a malicious attempt at the precise moment you dial in.  
Even then, however, it is unlikely the malicious user will 
get control of your system (because his rootkit is unlikely 
to run correctly in the minimalistic BL3 environment).  The
most likely result is a system crash or perhaps a corrupted
filesystem.
 
> Can someone from outside damage our computer if we are 
> running httpd?  

Even though httpd is a network server, it does not pose
the risk that telnetd does.  httpd is restricted to a 
particularly directory and has no way of providing a shell 
to remote users (AFAIK).  

> Is that also accessible only as user?  

All http clients are served the same.  No client has write 
access to the server (AFAIK).

Cheers,
Steven

____________________________
http://www.basiclinux.com.ru