From: Digestifier To: Linux-Admin@senator-bedfellow.mit.edu Reply-To: Linux-Admin@senator-bedfellow.mit.edu Date: Mon, 23 Aug 93 15:21:52 EDT Subject: Linux-Admin Digest #15 Linux-Admin Digest #15, Volume #1 Mon, 23 Aug 93 15:21:52 EDT Contents: Re: Why use shadow? (Craig T Manske) Re: tar & mt (Arne Wichmann) Re: Why use shadow? (Brandon S. Allbery) Re: Why use shadow? (Mark A. Davis) Re: Why use shadow? (Mark A. Davis) Linux Ftp Site... (Daniel - Shsu) Re: Why use shadow? (Yonik Christopher Seeley) Re: Why use shadow? (Frank Lofaro) Sample DIP scripts (Mark Kassab) Re: Help 1)Booting SCO from LILO 2)common fs for both (Vinod G Kulkarni) Re: Why use shadow? (Alec Muffett) Re: Why use shadow? (Alec Muffett) Re: Sample DIP scripts (Sandy Knapp) Re: Why use shadow? (Thomas Dunbar) Re: sending ^H from backspace (Sean Harris) Re: Why use shadow? (Brandon S. Allbery) ---------------------------------------------------------------------------- From: albion@csd4.csd.uwm.edu (Craig T Manske) Subject: Re: Why use shadow? Date: 22 Aug 1993 21:48:22 GMT Reply-To: albion@csd4.csd.uwm.edu Not to change the subject, but does anyone remember the old way of hacking passwords? In my old hacking days, for the fun of it, I would put a watch on tty's. When a user would try to login in at one of the terminals on campus, my account would send a fake login: and password: prompt to them. They would obviously type there info in, then I would send them a login failed, and give them back the real prompts. I am pretty sure that the permissions in Linux do not allow this, but that's what we did in the old days. Albion albion@csd4.csd.uwm.edu ------------------------------ From: aw@math.uni-sb.de (Arne Wichmann) Crossposted-To: comp.os.linux Subject: Re: tar & mt Date: 22 Aug 1993 14:24:31 GMT In article <24t8qv$6d@usenet.rpi.edu> clemmd@aix.rpi.edu (Dave Clemmer Jr.) writes: [...] >>If he's got the tar from SLS 1.02 or earlier, that won't work. :-( >thank you again... i've got 1.00 ... (i was wondering why it complained >about the file not being compressed w/ compress when i used the -z option...:) I solved this problem by using 'ln -fs `type -path gunzip` `type -path uncompress`' when I hit it... ciao, AW -- That you are not paranoid doesn't mean that they aren't out to get you... Arne Wichmann (aw@math.uni-sb.de) ------------------------------ From: bsa@kf8nh.wariat.org (Brandon S. Allbery) Subject: Re: Why use shadow? Date: Mon, 23 Aug 1993 00:10:21 GMT In article <258pj6INNj2f@uwm.edu> albion@csd4.csd.uwm.edu writes: >Not to change the subject, but does anyone remember the old way of hacking >passwords? In my old hacking days, for the fun of it, I would put a watch We remember it quite well: Ted T'so brought it up constantly while overhauling the tty driver several months back.... ++Brandon -- Brandon S. Allbery kf8nh@kf8nh.ampr.org bsa@kf8nh.wariat.org "MSDOS didn't get as bad as it is overnight -- it took over ten years of careful development." ---dmeggins@aix1.uottawa.ca ------------------------------ From: mark@taylor.uucp (Mark A. Davis) Subject: Re: Why use shadow? Date: Sun, 22 Aug 1993 23:53:25 GMT bsa@kf8nh.wariat.org (Brandon S. Allbery) writes: >In article <1993Aug22.032038.21655@taylor.uucp> mark@taylor.uucp (Mark A. Davis) writes: >>bsa@kf8nh.wariat.org (Brandon S. Allbery) writes: >> >>>If you limit it to lowercase letters, multiply by 26*26=676. All letters, >>>52*52=2704. Which implies that an 8-letter password could be checked in under >>>18 hours on the second machine if the claim is correct, and in 108 hours on >>>the first. >> >>Only if that machine could try out each of those 2704 passwords on the >>actual machine it is trying to break into. What system would anyone have >UFC-crypt duplicates the password encryption algorithm used on most (I'm >tempted to say "all") *ix systems, so all you need from the target system is >the encrypted passwords. Which brings us back to the beginning of the >discussion: that's why there is a root-only shadow password file. EEEK- forgot about that. So the real point is to prevent access to the passwd file or to have the encrypted passwords in another non-readable file. I have resisted using shadow for many years due to the same "I like quicky editing the psswd file" reason as some others have. I have so many users and so many changes, that even one extra step can be painful. But security *IS* more important, even on a system such as mine where is would be difficult to even access the /etc/passwd file. I will reconsider our non-use the use of shadow mechanism. >By the way, you misread it --- I was saying how much to multiply the quoted >times by to get the time to check all of them (basically airchecking myself), >not how many passwords. Well, I wan't really responding directly to your post, but rather the thread in general, sorry :) -- /--------------------------------------------------------------------------\ | Mark A. Davis | Lake Taylor Hospital | Norfolk, VA (804)-461-5001x431 | | Sys.Administrator| Computer Services | mark@taylor.wyvern.com .uucp | \--------------------------------------------------------------------------/ ------------------------------ From: mark@taylor.uucp (Mark A. Davis) Subject: Re: Why use shadow? Date: Sun, 22 Aug 1993 23:58:56 GMT albion@csd4.csd.uwm.edu (Craig T Manske) writes: >Not to change the subject, but does anyone remember the old way of hacking >passwords? In my old hacking days, for the fun of it, I would put a watch >on tty's. When a user would try to login in at one of the terminals on >campus, my account would send a fake login: and password: prompt to them. >They would obviously type there info in, then I would send them a >login failed, and give them back the real prompts. I am pretty sure that >the permissions in Linux do not allow this, but that's what we did in the old >days. Hmm, this would assume that you, as a normal user, had access to inserting an offending executable program into the target user's path. This is unlikely is the system were set up properly. The other way, to run a background task interfacing to their terminal should also not be possible in a well set-up system as the normal users should not have write/read access to terminal port devices not in use. -- /--------------------------------------------------------------------------\ | Mark A. Davis | Lake Taylor Hospital | Norfolk, VA (804)-461-5001x431 | | Sys.Administrator| Computer Services | mark@taylor.wyvern.com .uucp | \--------------------------------------------------------------------------/ ------------------------------ From: shampoo@shell.portal.com (Daniel - Shsu) Subject: Linux Ftp Site... Date: Mon, 23 Aug 1993 01:48:48 GMT I was wondering if there a demo copy of linux somewhere on internet where I can ftp it. I want to run x on my pc. Or maybe a phone number where I can call for a demo copy. Thanks Dan ------------------------------ From: yseeley@leland.Stanford.EDU (Yonik Christopher Seeley) Subject: Re: Why use shadow? Date: Mon, 23 Aug 93 01:55:38 GMT In article <258pj6INNj2f@uwm.edu> albion@csd4.csd.uwm.edu writes: >Not to change the subject, but does anyone remember the old way of hacking >passwords? In my old hacking days, for the fun of it, I would put a watch >on tty's. When a user would try to login in at one of the terminals on >campus, my account would send a fake login: and password: prompt to them. >They would obviously type there info in, then I would send them a >login failed, and give them back the real prompts. I am pretty sure that >the permissions in Linux do not allow this, but that's what we did in the old >days. There is still the possibility of trojan horses of a simpler sort that you just run directly on your terminal to give a login prompt. This is dangerous because any user can think that up, and it works much of the time too! Very short and easy - less than a page of C code can get you lots of passwords. This is not a concern for home users of Linux, because one would have to have access to the box, but what about in a shared-workstation environment like most universities? I don't know how to get around this in general, but one thing that would help would be to use xdm. To make a trojan horse that would fool someone in this environment would require getting and hacking the xdm source code. Much tougher to do for a normal user. NT tries to improve security by catching the interrupt that CTRL-ALT-DEL generates, and disallowing user processes to catch that interrupt themselves. Doing a trojan horse of NT would not (shouldn't at least ;-) be possible while NT was running. Could this be done for Linux? Would it be worth it? A user could sit down at a Linux box and hit CTRL-ALT-DEL after a banner, to get the login prompt. They could then be sure that if Linux was indeed running, that this was not a trojan horse. Comments anyone? - Yonik Seeley yseeley@cs.stanford.edu > >Albion >albion@csd4.csd.uwm.edu ------------------------------ From: ftlofaro@unlv.edu (Frank Lofaro) Subject: Re: Why use shadow? Date: Mon, 23 Aug 93 02:28:11 GMT Ah, you're asking for a secure attention key. I hacked one up for pl9 (it would need to be changed to fit the new keyboard code, plus I'd have to make diffs, etc. My sources are a mess lately). Just bind a key to do a vhangup on the tty (I know there is SAK code in the serial driver, but it uses kill -9 on the processes, which isn't as elegant a solution, 'badly' backgrounded processes would get killed then too, not just lose tty access). I don't know much about the new keyboard code, but I'll take a look at hacking it in for that (no promises, I'm already deluged with stuff to do, and my IDE drive has a bad sector, and might be losing some more still ;( ). ------------------------------ From: mark@macs.ee.mcgill.ca (Mark Kassab) Subject: Sample DIP scripts Reply-To: mark@macs.ee.mcgill.ca Date: Mon, 23 Aug 1993 04:09:06 GMT Hi, Does anyone have sample DIP scripts which they could send me? I'm trying to write a script to start SLIP on our CISCO souter, but things are, alas, less than perfect". BTW, should one send "\n" or "\r\n" to emulate pressing return in term mode? Furthermore, "send slip 132.xxx.yyy.zzz" gives an incorrect usage error for some reason. Thanks for your help, Mark ------------------------------ From: vinod@cse.iitb.ernet.in (Vinod G Kulkarni) Subject: Re: Help 1)Booting SCO from LILO 2)common fs for both Date: Mon, 23 Aug 1993 05:51:19 GMT Thanks, I can now do both at last! My post stated: : | I am having SCO and linux both on same disk on different partitions. : | Has anyone configured LILO to boot SCO? : | Please mail me the config file. : | I also would like to have a common partition between SCO and DOS ^^^^^^^^^^^ I should have written SCO and Linux! I did receive right answers though. : | containing user's home directories. Can you recommend any : | common file system? Which file system recommended? (Apart from MSDOG ...) : | I am trying to go in for Xenix. Booting of SCO: LILO should be installed as MBR. And one of the entries should be: boot=/dev/hda ... other = /dev/hda4 label = sco table = /dev/hda It didnot work if LILO was installed as boot sector of Linux partition (and using DOS MBR). I have just received xenixfs patches, to the kernel code of .99.8. I could not find them in both sunsite/tsx-11. I am yet to compile them - they need to be converted to C++. (My special thanks to Anthony Wesley who sent me both the above information.) If I can successfully get some local C++ guru, I will place the diffs against the latest kernel in sunsite. It may take some time though. As Wm E. Davidsen Jr (davidsen@sixhub.UUCP) wrote, there may be performance issues - especially because there are no mkfs, fsck for xenixfs in Linux, I need to see the implications. -Vinod.Kulkarni (vinod@cse.iitb.ernet.in) Research Scholar, Dept. of CSE, IIT Bombay, INDIA._____________________________________________________________ ------------------------------ From: alecm@uk-usenet.uk.sun.com (Alec Muffett) Subject: Re: Why use shadow? Date: 23 Aug 1993 11:59:52 GMT Reply-To: alecm@uk-usenet.uk.sun.com In article 93Aug18071006@compi.hobby.nl, muts@compi.hobby.nl (Peter Mutsaers) writes: >Crack only checks words (and variations on these) from the dictionary. >If you have good passwords you STILL NEED A CRAY :: YOU _DON'T_ NEED >SHADOW PASSWORDS. And many of todays /bin/passwd programs enforce the >use of a 'good' password. Well, I'd still debate the use of a "cray", but in essence this is correct; if you do not use passwords devived from dictionary words or personal information, a cracker's last remaining resorts are: 1) outre' guessing ("what's the SA's wife's pet hamster called ? Footles ? Let's try that...") 2) so-called "brute force)" - which is why I ripped a lot of code out of the ongoing Crack-v5 effore and turned it into CrackLib; a library routine to check passwords against a specially compressed dictionary, to see if it's crackable. The latest release of "shadow" supports CrackLib. If I (ever) can afford the homebox I specc'ed up, I'll do up a suite and archive it. - alec ------------------------------ From: alecm@uk-usenet.uk.sun.com (Alec Muffett) Subject: Re: Why use shadow? Date: 23 Aug 1993 12:03:30 GMT Reply-To: alecm@uk-usenet.uk.sun.com In article 6890@sixhub.UUCP, davidsen@sixhub.UUCP (Wm E. Davidsen Jr) writes: > I believe that CRACK only uses the words in a dictionary, Wrong! (well, sort of) Crack will take dictionary words (eg: foobar) and try: foobar raboof foobarfoobar raboofraboof foobarraboof rabooffoobar FOOBAR Foobar foobaR f00bar F00BAR FBR ... - and god knows how many other permutations. ------------------------------ From: akingdom@vtaix.cc.vt.edu (Sandy Knapp) Subject: Re: Sample DIP scripts Date: 23 Aug 1993 14:24:05 GMT Mark Kassab (mark@macs.ee.mcgill.ca) wrote: : Hi, : Does anyone have sample DIP scripts which they could send me? I'm trying to : write a script to start SLIP on our CISCO souter, but things are, alas, : less than perfect". : BTW, should one send "\n" or "\r\n" to emulate pressing return in term mode? : Furthermore, "send slip 132.xxx.yyy.zzz" gives an incorrect usage error for : some reason. I have the same problem with send. I hacked up dip so that line would work. Look in the file command.c and modify the send command to send all the argv strings. ... Philip ------------------------------ From: tdunbar@vtaix.cc.vt.edu (Thomas Dunbar) Subject: Re: Why use shadow? Date: 23 Aug 1993 15:56:23 GMT >We remember it quite well: Ted T'so brought it up constantly while >overhauling the tty driver several months back.... wrt hacking and Ted, just noticed that Ted is mentioned in `Cuckoo's Nest' (in section on coping with internet worm) ------------------------------ From: sidney@f40.inmos.co.uk (Sean Harris) Subject: Re: sending ^H from backspace Date: Wed, 18 Aug 1993 09:36:59 GMT In article , pdh@netcom.com (P D H) writes: |> Is there a simple way, without having to recompile the kernel, to |> get the backspace key on the virtual consoles to send ^H (0x08) |> instead of RUBOUT (0x7f)? I could not find this in the FAQ other |> that for X (this is not X). |> |> Alternatively, is there a way to get the "trsh" client of the |> "term" package to translate 0x7f to 0x08 (something easily |> done in kermit with "set key 127 \008"). |> |> I need to make my virtual consoles consistent with other terminal |> inputs so that I don't have to keep changing the terminal setups |> manually on each host I am connecting to. |> -- |> /***********************************************************************\ |> | Phil Howard, KA9WGN, pdh@netcom.com | 8 yrs UNIX and C, 12 yrs total | |> | Will sysadmin UNIX and networks for food and $$$ in midwest and south | |> \***********************************************************************/ Type at the command line stty erase where is the key that you want to be the erase key. Alternatively you can put this command in your .login or shell rc file ------------------------------ From: bsa@kf8nh.wariat.org (Brandon S. Allbery) Subject: Re: Why use shadow? Date: Mon, 23 Aug 1993 16:27:57 GMT In article <1993Aug23.015538.20275@leland.Stanford.EDU> yseeley@leland.Stanford.EDU (Yonik Christopher Seeley) writes: >Could this be done for Linux? Would it be worth it? A user >could sit down at a Linux box and hit CTRL-ALT-DEL after >a banner, to get the login prompt. They could then be sure >that if Linux was indeed running, that this was not a trojan >horse. It's already there; look up the "Secure Attention Key". When enabled, it kill -9's all processes on the current terminal/VT; getty takes over from there if it's still enabled, so you can log in from a known secure state. (Assuming nobody replaced /etc/init or /etc/getty with a Trojan horse....) ++Brandon -- Brandon S. Allbery kf8nh@kf8nh.ampr.org bsa@kf8nh.wariat.org "MSDOS didn't get as bad as it is overnight -- it took over ten years of careful development." ---dmeggins@aix1.uottawa.ca ------------------------------ ** FOR YOUR REFERENCE ** The service address, to which questions about the list itself and requests to be added to or deleted from it should be directed, is: Internet: Linux-Admin-Request@NEWS-DIGESTS.MIT.EDU You can send mail to the entire list (and comp.os.linux.admin) via: Internet: Linux-Admin@NEWS-DIGESTS.MIT.EDU Linux may be obtained via one of these FTP sites: nic.funet.fi pub/OS/Linux tsx-11.mit.edu pub/linux sunsite.unc.edu pub/Linux End of Linux-Admin Digest ******************************