Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] restricting access to important spells

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Jeremy Blosser <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] restricting access to important spells
  • Date: Sat, 15 Jul 2006 22:31:37 -0500

On Jul 14, Arjan Bouter [abouter AT sourcemage.org] wrote:
> On Thu, 13 Jul 2006 21:39:48 +0200
> Ladislav Hagara <ladislav.hagara AT unob.cz> wrote:
> > > +config_query PAM_SECTTY "Install a default /etc/securetty?" n &&
> > If user cast linux-pam for the first time with default answer (*n*)
> > he/she will not be able to login on console (no /etc/securetty). :-(

s/login on console/login on console *as root*/

> That's the default config for linux-pam as installed from source by hand.

And so it should remain that way.
>
> Along the same line one could argue that /etc/pam.d/other should contain
> pam_permit instead of pam_deny because
> "it's convenient not having to configure things".

Along the same lines, we should probably leave pam.d/other out because it's
not there by default. I know there was a bug mentioning pam.d/other for
some other spell but really that spell shoudl just install a
facility-specific pam.d file.

We definitely shouldn't install a pam.d/other that changes the default
behaviour, and I don't think that's deny, is it? If it's not this
pam.d/other file should definitely come out.

> There's a message in FINAL stating that one needs to edit /etc/securetty
> to enable root logins.
>
> But if you want to change that question to have a default on 'y' I'm not
> stopping you.

No thanks, provide options for sure and warnings if necessary but stick
with upstream defaults. I'm one who expects a pam system to not allow root
logins unless I specifically enable them, it is definitely not good if you
enable them without me saying I want them!

Attachment: pgpDT3Z1ZLoML.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page