Skip to Content.
Sympa Menu

baslinux - [BL] Going online as user, summary, was Re: ssh as 'user'

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: sindi keesan <keesan AT sdf.lonestar.org>
  • To: baslinux AT lists.ibiblio.org
  • Subject: [BL] Going online as user, summary, was Re: ssh as 'user'
  • Date: Wed, 28 Feb 2007 04:17:49 +0000 (UTC)

ssh is working as user on this other computer. No idea what I did differently.

I can go online as user by doing the following (BL2):

Insert relevant modules as root or in an rc (slhc, ppp or ppp_generic and ppp_async, for linmodems other required modules like pctel and ptserial or lt_modem and lt_serial, etc.).

Copy all the files from /root to /home/user
chown -R user user
chown -R users user

Make relevant devices readable and writeable:
chmod +rw /dev/null, /dev/ttyS* and /dev/ttyLT0 (modems), /dev/ttyp*
(pseudo-terminal needed by rxvt).

chmod +s Xvesa (must be suid), rxvt, any svgalib programs (zgv, bmv, links2), eznet, pppd.

abiword, kermit, opera, links, and lynx already work as user. I may have done a chmod +x on them earlier.

pppd run as user requires /etc/ppp/options to exist. It can be empty.

At least in BL2, /usr/sbin is not on the path for user. Instead of putting it on the path (bad for security) I symlinked ppp-on and ppp-off to a directory that is on the path (in my case /usr/local/sbin which I put my scripts in).

I can now login user, dial with ppp-on or eznet up (or eznet up 1 or 2 for other configurations), startx (with a script or alias in BL2), run programs, exit X, ppp-off, and reboot.

Most or all of /bin and /usr/bin are executable by user. Is this bad for security? user can't remove files in /bin or probably anything else not owned by user. Why is mini_httpd owned by 500? Most executables are owned by root or bin.

What else should be done to improve security other than giving root and user real passwords? Are there programs not in /usr/sbin or /sbin that user should not have access to?

Sindi

keesan AT sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org




Archive powered by MHonArc 2.6.24.

Top of Page