Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: !SPAM! [Full-Disclosure] Automated ssh scanning
From: Barry Fitzgerald (bkfsecsdf.lonestar.org)
Date: Thu Aug 26 2004 - 12:08:42 CDT
Ron DuFresne wrote:
>If your uasers are not trustable, then they should not have access to
>local systems of yours. Once a person has a shell, then they are 95% to
I'm not sure I entirely agree with what you're saying.
Scratch that - I'm sure I don't agree with what you're actually saying
here -- though I probably agree with what I think you mean.
If you mean that most default installs have so many packages and that
many of those packages have methods that most people don't know about of
getting around security barriers, then I agree with you.
If you mean that even having a shell on a system means that the person
will eventually get root access, I'm forced to disagree. It depends on
a number of things; including packages installed, their configuration;
the presence of SUID programs; the ability to compile/run code...
Actually locking down a system is not easy, but unlike with MS Windows,
you're not going to break the system by doing it properly. (Read the
filesystem heirarchy standard for some ideas on why that is.)
So, if someone can log into a shell on any *nix system and gain root --
there's still something wrong. It can't just be written off as "well if
you can get shell you can get root, so don't let them get shell"...
that's a cop-out argument and if that's the case, then why are we even
bothering to secure anything anyway?!? The shell is just an interface -
it's security status is only as good as the tools available to it and
p.s. Not trying to ruffle feathers, simply calling it like I see it.
Full-Disclosure - We believe in it.