Regarding sudo

On 2007-07-12, ArameFarpado <a-farpado.spam DeleteThis @netcabo.pt> wrote:
> Em Quinta, 12 de Julho de 2007 18:52, Keith Keller escreveu:
>
>>> by the way, do we have a point when a user acount is blocked because of
>>> bad paswords? if so, how many wrong passwords are needed?
>>> I know windows does this after 3 or 5 wrong passwords, but never seen
>>> linux do it...
>>
>> Most distros by default do not lock accounts on bad passwords, but it
>> can be easily configured. There is plenty of documentation online and
>> in the man pages.
> Ok, then i would sugest sudoers to use this funtion, or desable the password
> timestamp.

Read the manpage for sudoers to figure out how to disable the timestamp.

>> I'm getting off into speculation, since I don't know in detail how other
>> distros configure their /etc/sudoers file. *If* you have sudo, and
>> *if* you have sudo su, *then* yes, you are vulnerable to trojans in that
>> time period.
>> The solution is to not be stupid when using sudo. It
>> appears that you are looking for a technical solution to what is
>> fundamentally a human problem, and it is not the OS's job to protect the
>> administrator from every conceivable mistake he could make.
>
> the trojan could allready running and waiting to sudo be used.

Of course it could. The solution is to not be stupid when using sudo.

>> It is the
>> admin's job to act in such a way that he doesn't compromise his
>> security; it is the OS's job to ensure that the security measures the
>> admin has configured are enforced.
> home computers are usualy administrated by is owner and usualy only user.

It is still the admin's job to act in such a way that he doesn't
compromise his security. This is the same as with any OS; the problem
being that Windows (for example) has historically made it very easy to
always run as an administrator, and very difficult not to do so. Even
in the situation where sudo has a 5 minute timeout, that's a relatively
small window in which a trojan can do its damage. But it doesn't allow
an admin to do whatever he wants and not worry about security!

As an aside, processes can't actually read the sudo timestamps, so
trojans actually need to attempt a sudo (with sudo -l, for example) in
order to test whether sudo works. Since sudo attempts are logged, a
sysadmin (yes, even the only owner of a home system) can monitor these
attempts to detect a running trojan.

> Facilities like this, lowers security, and i think sudo should not be used
> at least the way some distros are configuring it by default.

You could lobby individual distributions to disable the sudo timestamp,
or you could post instructions on how to configure sudo for this
functionality. (If the user didn't want to be prompted he could sudo su,
with all the caveats that brings.) But I really think you should try to
better understand how all of these mechanisms work together before
commencing such a campaign; otherwise, distribution maintainers will
ignore (or ridicule) your suggestion.

--keith

--
kkeller-usenet DeleteThis @wombat.san-francisco.ca.us
(try just my userid to email me)
AOLSFAQ=http://www.therockgarden.ca/aolsfaq.txt
see X- headers for PGP signature information

Em Quinta, 12 de Julho de 2007 20:42, John Hasler escreveu:

> Alan Adams writes:
>> If the hashed version contains less information than the original
>> password, doesn't this imply that there is more than one possible
>> password which will hash to the same result?
>
> Yes, of course. As a result the search space is reduced slightly. It is
> still, however, in the bajillions. It's a good tradeoff.

So we have bajillions of diferent passwords all given the same hash?
i don't think so... how does the system knows you typed the exact password
when there is so many others that generates the same hash?
can't be...