Baslinux mailing list

["Samual Acorn" <sam.acorn AT gmail.com>]

> Should I worry about running anything offline as root?

the rule of thumb is; only run as root when you absolutely have to...
'root' is for system administration/maintenance... not for regular
use...

On 28/01/07, sindi keesan <keesan AT sdf.lonestar.org> wrote:
> From a helpful TAG (The Answer Gang) member:
>
> Open ports are not the only security problem. You already got many hints
> from the TAG subscribers. Security is not a state that is either
> switched on or off by configuration. It is a process and considering the
> code people usually run on workstations (graphically or not) it is next
> to impossible to predict what code will do in all possible
> circumstances.
>
> > http://bcheck.scanit.be found 0 vulnerabilities in Opera 8.52. [...]
>
> If you try http://www.securityfocus.com/vulnerabilities instead and
> enter "Opera Software" and then "Opera Web Browser" in the search form
> you get a long list of (known) bugs along with their security
> implications and possible fixes or upgrades. A Google search for '"opera
> 8.52" security bugs' has http://security.nnov.ru/soft/8550.html as first
> search result. This page says:
>
> "Integer overflow on long stylsheet sttribute. Can potentially be
> used for hidden malware installation."
>
> A lot of online scanners are woefully incomplete and only check for the
> top 10 (100 or 1000) bugs and a good part of them is designed to work
> with MS Windows clients. These scanners are only a part of a security
> strategy and their output should be treated as such.
>
> > Another list member pointed out that startx allows only local access to
> > the X server so is also not vulnerable.
>
> Some GNU/Linux distributions (such as Debian) also deactivate X's port
> 6000 by default. Of course this doesn't protect you against running an X
> session with lots of software (which is not designed to run as root)
> with root privileges.
>
> Apologies for repeating things others have said in this thread. The part
> about online scanners and Opera 8.52 made a little noise on my email
> radar. :)
>
> Best wishes,
> René.
>
>
> -------------------
> Apparently it IS a good idea to run opera only as user.  I will try to
> check out lynx and links as well.  su user lynx.  And fix permissions to
> run ssh as user.
>
> Should I worry about running anything offline as root?
>
> Sindi



--
--
--sam
--
Web; http://mephitus.no-ip.org/
Skype; Mephitus
ICQ; 51687964
--
"When you've done something right, no one will be sure you've done
anything at all." -- Futurama
--