Baslinux mailing list

[sindi keesan <keesan AT sdf.lonestar.org>]

ssh is working as user on this other computer.  No idea what I did 
differently.

I can go online as user by doing the following (BL2):

Insert relevant modules as root or in an rc (slhc, ppp or ppp_generic and 
ppp_async, for linmodems other required modules like pctel and ptserial or 
lt_modem and lt_serial, etc.).

Copy all the files from /root to /home/user
chown -R user user
chown -R users user

Make relevant devices readable and writeable:
chmod +rw /dev/null, /dev/ttyS* and /dev/ttyLT0 (modems), /dev/ttyp*
(pseudo-terminal needed by rxvt).

chmod +s Xvesa (must be suid), rxvt, any svgalib programs (zgv, bmv, 
links2), eznet, pppd.

abiword, kermit, opera, links, and lynx already work as user.  I may have 
done a chmod +x on them earlier.

pppd run as user requires /etc/ppp/options to exist.  It can be empty.

At least in BL2, /usr/sbin is not on the path for user.  Instead of 
putting it on the path (bad for security) I symlinked ppp-on and ppp-off 
to a directory that is on the path (in my case /usr/local/sbin which I put 
my scripts in).

I can now login user, dial with ppp-on or eznet up (or eznet up 1 or 2 for 
other configurations), startx (with a script or alias in BL2), run 
programs, exit X, ppp-off, and reboot.

Most or all of /bin and /usr/bin are executable by user.  Is this bad for 
security?  user can't remove files in /bin or probably anything else not 
owned by user.  Why is mini_httpd owned by 500?  Most executables are 
owned by root or bin.

What else should be done to improve security other than giving root and 
user real passwords?  Are there programs not in /usr/sbin or /sbin that 
user should not have access to?

Sindi

keesan AT sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org