Re: Strange command histories in hacked shell history

Bill Vermillion wrote:

> I understand that after using Unix for about 2 decades.
>
>However in FreeBSD a user is supposed to be in the wheel group [if
>it exists] to be able to su to root.
>
>But if a person who is not in wheel su's to a user who is in wheel,
>then they can su to root - as the system sees them as the other
>user.  
>

>This means that the 'wheel' security really is nothing more
>than a 2 password method to get to root.
>
>  
>
Precisely. If you don't like this then the way around is to only allow a 
certain group access to su and none for everyone else.

>If the EUID of the orignal invoker is checked, even if they su'ed
>to a person in wheel, then they should not be able to su to root.
>
>I'm asking why is this permitted, or alternatively why is putting a
>user in the wheel group supposed to make things secure, when in
>reality it just makes it seem more secure - as there is only one
>more password to crack.
>  
>

One more password to crack is more time which means a better chance of 
catching the cracker in the act.  Although I don't know why exactly the 
authors of su did that the way they did but my first and best guess 
would be convenience. The two password method is better than a new login 
session each time you want to get to root. Second best guess would be is 
that they didn't figure out that issue or at least think much of it.

-- 
---
Elvedin Trnjanin
http://www.ods.org

_______________________________________________
[e-mail] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[e-mail]"