Subject: Re: Password changing...

From: [email-masked]
Date: Thu, 2 May 1996 09:44:32 +0100

Try setting up the login shell for ftponly users to be /etc/passwd.
Users logging in via telnet can change their password but can do

nothing else.

There may be security implications beyond the obvious problem of
being forced to allow incoming telnet access. 

Anyone care to comment?

Stephen A.

===============================================================
       Stephen M. Adams		:    [email-masked] 
   Systems/Software Engineer	:    Tel: +44 1232 894334
  BT Belfast Engineering Centre	:    Fax: +44 1232 894316
===============================================================

---

From: [email-masked] (Bill Campbell)
Date: Thu, 2 May 1996 07:46:02 -0700 (PDT)

>being forced to allow incoming telnet access. 
Users could change their passwords using e-mail programs that support
the Eudora protocols (which are extremely simple).  It wouldn't be
difficult to handle this with an http form and proper cgi script
either (I think I've seen postings about people who have done this).

When I compiled the pwserve program for SCO Unix, I limited it so that
it will not allow password changes for root and other administrative
accounts via the server, and I further restrict access to it via
tcp_wrappers and router filtering just to be on the safe side.

Bill
--
INTERNET:   [email-masked]  Bill Campbell; Celestial Systems, Inc.
UUCP:               camco!bill  PO Box 820; 2835 82nd Avenue S.E. S-100
FAX:            (206) 232-9186  Mercer Island, WA 98040-0820; (206) 236-1676
URL: http://www.celestial.com/

Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation.
		-- Johnny Hart