Subject: Re: Strange problem out of the blue

From: [email-masked]
Date: Fri, 24 Feb 1995 09:20:29 -0800 (PST)

There has been enough discussion about tight security on this list recently for this to 
go unnoticed.  If this is in fact the actual configuration of this file system it is 
*not* tight by any standards I have come across yet for wu-ftpd.  I've lost the URL for 
the searchable archives for this list or I would put it in (Judy, are you there?).  Some 
of the good mail on this is only about 3 days old.

>Tentative Moral:
>
>	Keep those ownerships, permission modes and ftpd configurations
>	good and tight for a good night's sleep.  8^)
>
>drwxr-xr-x  5 root     other         512 Feb 23 19:12 ./

>drwxrwxr-x 27 root     sys          1024 Feb 23 18:49 ../
 dr-xr-xr-x 27 root     sys          1024 Feb 23 18:49 ../

>drwxr-xr-x  2 root     other         512 Feb 23 18:49 bin/
>drwxr-xr-x  2 root     other         512 Feb 23 18:54 dev/
>drwxr-xr-x  2 root     other         512 Feb 23 18:49 etc/
 d--x--x--x  2 root     other         512 Feb 23 18:49 bin/
 d--x--x--x  2 root     other         512 Feb 23 18:54 dev/  (??????? see below)
 d--x--x--x  2 root     other         512 Feb 23 18:49 etc/

>-rw-r--r--  1 root     other         228 Feb 23 19:00 motd

>bin:
 no ls?  set prots to --x--x--x

>
>dev:
>crw-rw-rw-  1 root     other     11,  42 Feb 23 18:54 tcp
>crw-rw-rw-  1 root     other     11,   9 Feb 23 18:54 ticotsord
>crw-rw-rw-  1 root     other     11,  41 Feb 23 18:54 udp
>crw-rw-rw-  1 root     other     13,  12 Feb 23 18:54 zero

(I'm unsure of the best prots for the /dev entries above - Linux doesn't
need a /dev directory.  Is write permission needed?)

>
>etc:
>-rw-r--r--  1 root     other          14 Feb 23 18:49 group
>-rw-r--r--  1 root     other          55 Feb 23 18:49 passwd
 -r--r--r--  1 root     other          14 Feb 23 18:49 group
 -r--r--r--  1 root     other          55 Feb 23 18:49 passwd

Make sure the passwd file has only those names absolutely needed, with locked passwords. 
There is more to be said here, but this should point out some of the booboos here.  This 
is *not* a flame; rather, attention to what has been so well said this week on this list 
(and even the faulty man page!) should have been enough to tighten up some of this.

---------------
Michael Brennen                    Intecom, Inc.
[email-masked]               5057 Keller Springs
(214) 447-8074                     Dallas,  TX  75248

---

From: [email-masked] (Russell Street)
Date: Sat, 25 Feb 1995 15:28:47 +1300 (NDT)

[you have control Ms in your message!]

> >drwxr-xr-x  5 root     other         512 Feb 23 19:12 ./

Call me paranoid, but I would take out write permissions on that
directory.  Root does not need them anyway!

>  dr-xr-xr-x 27 root     sys          1024 Feb 23 18:49 ../

Just like that one is.

> need a /dev directory.  Is write permission needed?)

These have me worried...

>  -r--r--r--  1 root     other          55 Feb 23 18:49 passwd

if you can live with numeric IDs on your dir listings, you can remove
them all together!  Someone can always do
	ls -ln
to discover them anyway.

> (and even the faulty man page!) should have been enough to tighten up some of this.

Some of this 'security' stuff seems to be a series of sucessive
approximations, rather than a closed-form analytical solution, with
single-valued, real-numbered, well-defined, finite, infinitely
differentiable boundary conditions :-)

Russell