OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Sep) 1994: Re: Bad Advise

Re: Bad Advise

smbresearch.att.com
Tue, 26 Jul 94 00:28:37 EDT 

	 
	 Here is some advise from Sun that I highly recommend you DO NOT DO.

	 If you look at the MAN page for ftpd, you will see the following 
	 advise: 

	      the following rules are recommended. 
	      ~ftp)
	           Make the home directory owned by ``ftp'' and unwritable
	           by anyone. 

	 I highly recommend you change that to owned by ``root''.  If anyone can lo
	g
	 in as ftp, there is nothing to stop them from doing SITE CHMOD 777 to the
	 main directory and putting .rhosts or .forward there allowing instant
	 access. 

	 With advise like that, who needs trojans? 

Of course, Sun's ftpd doesn't support chmod.  Not that that excuses their
advice, but it's not *quite* as bad...  (I'm talking about 4.1.x, for some
values of x.)