Subject: /etc/passwd questions on FreeBSD 2.25

From: Derek Leung <[email-masked]>
Date: Fri, 09 Oct 1998 18:37:09 -0700

I know this is kind of out of topic, could someone help me to solve this

question?

As I can see from Beroftpd, it can specify to read password file other
than /etc/passwd.  I am just wondering if I can actually move
/etc/passwd to another location for secruity issue?  What I mean is that

not only ftp, all other application like email, telnet will actually
look up the passwd file in a different location.  Anyway to specify a
alternate passwd file location for FreeBSD 2.25?

Another question is that how can I restrict people from using nslookup
to query my domain with the command ls -a domain_name.com?   Thanks for
your help in advance

rgd,
Derek

---

From: Gregory A Lundberg <[email-masked]>
Date: Sat, 10 Oct 1998 03:37:29 -0400 (EDT)

On Fri, 9 Oct 1998, Derek Leung wrote:

> /etc/passwd to another location for secruity issue?  What I mean is
> that not only ftp, all other application like email, telnet will
> actually look up the passwd file in a different location.  Anyway to
> specify a alternate passwd file location for FreeBSD 2.25?

It'd be a lot of work and hacking a lot of software for little or no gain.
Security through obscurity doesn't work.  Take a look at shadow passwords
instead.

BeroFTPD doesn't use alternate passwd files for security, it does it for
flexability; so the virtual site can have virtual users all it's own.

> to query my domain with the command ls -a domain_name.com?  Thanks for

Tell your Bind not to allow zone transfers except to authorized hosts or
firewall TCP to the DNS ports.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Sat, 10 Oct 1998 11:16:15 +0200 (CEST)

On Fri, 9 Oct 1998, Derek Leung wrote:

> look up the passwd file in a different location.

Theoretically it's possible... but I don't think it's worth the try.
First, it's a lot of work - you'd have to modify and recompile your libc so
getpwent(), getpwnam(), etc. access an alternate passwd file.
Next, you'd have to check all the programs you're using - if they're using
getpw* (or getsp*), the changes to your libc are enough, if they are using
some other means (fgetspent(), or maybe even raw file I/O), you have to
modify the filenames there, as well.
Second, what good will this do? AFAIK FreeBSD uses shadow passwords anyway,
and everyone must have read access to /etc/passwd or whatever you'll call it
anyway.
The option in BeroFTPD is primarily for virtual hosts, not for security
(i.e. if ftp.domain2.com is a virtual host on ftp.domain1.com, domain1.com
and domain2.com can both have a user webmaster, but with a different UID and
password).

> to query my domain with the command ls -a domain_name.com?

It's some setting in named.conf (or named.boot if you're still using
BIND4) I don't recall - read the docs that come with bind.

LLaP
bero

-- 
Windows 98 supports real multitasking - it can boot and crash simultaneously.
***
Anyone sending unwanted advertising e-mail to this address will be charged
$25 for network traffic and computing time. By extracting my address from
this message or its header, you agree to these terms.