Linux users can get malware, too
Snit
lware_concerns.html>
-----
An announcement on the Unreal IRCd Forums states "This is
very embarrassing...We found out that the
Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
quite a while ago with a version with a backdoor (trojan) in
it. This backdoor allows a person to execute ANY command with
the privileges of he user running the ircd. The backdoor can
be executed regardless of any user restrictions (so even if
you have passworded server or hub that doesn't allow any
users in)."
The post goes on to say "It appears the replacement of the
.tar.gz occurred in November 2009 (at least on some mirrors).
It seems nobody noticed it until now."
-----
And then there is also this:
<http://www.theregister.co.uk/2010/06/10/critical_adobe_flash_vuln_fix/>
-----
The security update is available for versions 10.0.45.2 and
earlier of Flash for Windows, Mac OS X, and Linux. Last week,
Adobe warned that the vulnerability allows attackers to take
complete control of vulnerable machines when they view
websites that contained specially manipulated Flash content.
-----
Do not get me wrong - desktop Linux users, as with users of OS X, are much
less likely to get malware than are users of Windows. No doubt. But let us
not pretend the risk is not there at all.
--
[INSERT .SIG HERE]
Ezekiel
"Snit" <use...@gallopinginsanity.com> wrote in message
news:C83A7BA1.73CC1%use...@gallopinginsanity.com...
> <http://www.pcworld.com/businesscenter/article/198686/linux_trojan_raises_ma
> lware_concerns.html>
> -----
> An announcement on the Unreal IRCd Forums states "This is
> very embarrassing...We found out that the
> Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
> quite a while ago with a version with a backdoor (trojan) in
> it. This backdoor allows a person to execute ANY command with
> the privileges of he user running the ircd. The backdoor can
> be executed regardless of any user restrictions (so even if
> you have passworded server or hub that doesn't allow any
> users in)."
>
> The post goes on to say "It appears the replacement of the
> .tar.gz occurred in November 2009 (at least on some mirrors).
> It seems nobody noticed it until now."
> -----
Nice. First they hack the game. Next they hack the Linux server and upload
the malicious software. Then nobody bothers checking for well over 6 months.
<quote>
Basically, because of the false sense of security provided by Linux it
simply never occurred to anyone to check if the software might be
compromised. Combining that false sense of security with the security by
obscurity factor that Linux makes up less than two percent of the overall OS
market and isn't a target worth pursuing for attackers, means that many
Linux owners have zero defenses in place.
To be fair, Linux experts are aware that the operating system is not
bulletproof. You can pick any flavor of Linux, and its accompanying tools
and applications and find hundreds of vulnerabilities. The
difference--according to the many lectures I have received in the comments
of articles I have written on Windows security--is that the way the Linux OS
is written makes it harder to exploit a vulnerability, and that because its
open source vulnerabilities are fixed in hours rather than months.
</quote>
Moshe
Just ask Roy Schestowitz how his Boycottnovell server
got compromised not once but twice and was spewing nasty
stuff out towards anyone who visited there.
Should desktop Linux ever make a dent over 1 percent or
so, it will become a target and will be attacked on the
same scale that desktop Windows is attacked.
And when that happens, the freetards will deny they ever
made claims about Linux vs Windows security etc.
Just like when Ubuntu 9.04 was released and was full of
bugs.
The freetards and Ubuntu fanbois said "wait till 10.04
LTS is released" because it is better tested and
stable".
Well now that Ubuntu 10.04 LTS is turning out to have
even more bugs than Ubuntu 9.04, the freetards and
Ubuntu fanbois are uttering, "it was just released, give
it time".
Duhhhh....
Same old denial from the Linux "advocates".
Chris Ahlstrom
> Nice. First they hack the game. Next they hack the Linux server and upload
> the malicious software. Then nobody bothers checking for well over 6 months.
Very shitty, and not the fault of "Linux".
Actually quite lame admin.
--
Paranoia is simply an optimistic outlook on life.
Snit
12:18 PM:
Wonder which would stand up better: Linux or OS X. Real question - I do not
know.
> And when that happens, the freetards will deny they ever
> made claims about Linux vs Windows security etc.
>
> Just like when Ubuntu 9.04 was released and was full of
> bugs.
> The freetards and Ubuntu fanbois said "wait till 10.04
> LTS is released" because it is better tested and
> stable".
>
> Well now that Ubuntu 10.04 LTS is turning out to have
> even more bugs than Ubuntu 9.04, the freetards and
> Ubuntu fanbois are uttering, "it was just released, give
> it time".
>
> Duhhhh....
>
> Same old denial from the Linux "advocates".
I would prefer if they could advocate *and* be honest. Which is real
advocacy.
--
[INSERT .SIG HERE]
Snit
12:16 PM:
>
>
> "Snit" <use...@gallopinginsanity.com> wrote in message
> news:C83A7BA1.73CC1%use...@gallopinginsanity.com...
>> <http://www.pcworld.com/businesscenter/article/198686/linux_trojan_raises_ma
>> lware_concerns.html>
>> -----
>> An announcement on the Unreal IRCd Forums states "This is
>> very embarrassing...We found out that the
>> Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
>> quite a while ago with a version with a backdoor (trojan) in
>> it. This backdoor allows a person to execute ANY command with
>> the privileges of he user running the ircd. The backdoor can
>> be executed regardless of any user restrictions (so even if
>> you have passworded server or hub that doesn't allow any
>> users in)."
>>
>> The post goes on to say "It appears the replacement of the
>> .tar.gz occurred in November 2009 (at least on some mirrors).
>> It seems nobody noticed it until now."
>> -----
>
> Nice. First they hack the game. Next they hack the Linux server and upload
> the malicious software. Then nobody bothers checking for well over 6 months.
The fact it was there for six months is rather amazing.
> <quote>
> Basically, because of the false sense of security provided by Linux it
> simply never occurred to anyone to check if the software might be
> compromised. Combining that false sense of security with the security by
> obscurity factor that Linux makes up less than two percent of the overall OS
> market and isn't a target worth pursuing for attackers, means that many
> Linux owners have zero defenses in place.
>
> To be fair, Linux experts are aware that the operating system is not
> bulletproof. You can pick any flavor of Linux, and its accompanying tools
> and applications and find hundreds of vulnerabilities. The
> difference--according to the many lectures I have received in the comments
> of articles I have written on Windows security--is that the way the Linux OS
> is written makes it harder to exploit a vulnerability, and that because its
> open source vulnerabilities are fixed in hours rather than months.
> </quote>
They might be fixed quickly - but that does not mean they are used by
everyone just as quickly.
--
[INSERT .SIG HERE]
Tattoo Vampire
> Do not get me wrong - desktop Linux users, as with users of OS X, are much
> less likely to get malware than are users of Windows. No doubt. But let us
> not pretend the risk is not there at all.
No one here ever has.
--
Regards,
[tv]
Owner/proprietor, Trollus Amongus, LLC
...Ultimate office automation: networked coffee machines.
Ezekiel
"Chris Ahlstrom" <ahls...@launchmodem.com> wrote in message
news:hv3d3j$uh1$6...@news.eternal-september.org...
> Ezekiel pulled this Usenet boner:
>
>> Nice. First they hack the game. Next they hack the Linux server and
>> upload
>> the malicious software. Then nobody bothers checking for well over 6
>> months.
>
> Very shitty,
Like I said before, where there's a will there's a way. Put Linux onto
1-billion plus PC's and used by every Tom, Dick and Harry. Anyone who thinks
the world will be a virus-free safe computing Utopia is kidding themselves.
> and not the fault of "Linux".
Technically Linux is "just the kernel" so it isn't. And when Schestowitz's
website got hacked (twice) it technically wasn't the fault of Linux either.
Put this issue shows that there are faults with the Linux eco-system and
some of the attitudes and procedures. To some point you can't have it both
ways either. If people are going to claim "Linux is great because it
includes app XYZ" then the same people can't then turn around and claim
"It's not Linux's fault, it was app XYZ."
> Actually quite lame admin.
Yeah. There's a lot of that going around.
Moshe
wrote:
> Snit wrote:
>
>> Do not get me wrong - desktop Linux users, as with users of OS X, are much
>> less likely to get malware than are users of Windows. No doubt. But let us
>> not pretend the risk is not there at all.
>
> No one here ever has.
Roy Schestowitz didn't listen when he was told his Linux
server had been hacked.
He didn't think it was possible.
He was wrong.
Twice in fact.
TomB
Any operating system can be compromised, usually through 3rd pty
software.
The interesting fact in this story is that an intruder managed to
replace a file with a trojaned one on the unreal ircd mirrors without
anyone knowing it for a *very* long time. That is simply unacceptable.
I'd like to know how the intruder pulled that trick. Most likely very
sloppy sysadmins on the ircd end... But they learned from their
mistake:
"All our releases are from now on signed with GnuPG (PGP) again. Our
key is called rele...@unrealircd.com (0x9FF03937). The next few days
people will be signing this key to reflect the trusted nature of it.
Once you start a download you'll see instructions on how to verify a
release."
Signed with GPG /again/... One wonders why they decided to stop doing
that before.
About the Flash thing: "complete control" is very unlikely on a
GNU/Linux box, unless you're running your browser as root of course
(which would be a very stupid thing to do).
--
BOFH excuse #299:
The data on your hard drive is out of balance.
Clogwog
news:b1cxd2u0wgr5.1nj1pprilwiy5$.dlg@40tude.net...
In almost every post about Linux security Peter "Clueless" Koehlmann
(PIK-Peter Idiot Koehlmann) denied there were risks!
Snit
PM:
Correct.
> The interesting fact in this story is that an intruder managed to
> replace a file with a trojaned one on the unreal ircd mirrors without
> anyone knowing it for a *very* long time. That is simply unacceptable.
> I'd like to know how the intruder pulled that trick. Most likely very
> sloppy sysadmins on the ircd end... But they learned from their
> mistake:
>
> "All our releases are from now on signed with GnuPG (PGP) again. Our
> key is called rele...@unrealircd.com (0x9FF03937). The next few days
> people will be signing this key to reflect the trusted nature of it.
> Once you start a download you'll see instructions on how to verify a
> release."
>
> Signed with GPG /again/... One wonders why they decided to stop doing
> that before.
>
> About the Flash thing: "complete control" is very unlikely on a
> GNU/Linux box, unless you're running your browser as root of course
> (which would be a very stupid thing to do).
Who runs OS X as root?
--
[INSERT .SIG HERE]
Hadron
Interestingly TomB correctly notes it silly to run a browser as root (or
your desktop period), but a while back was claiming it was ok to wget,
untar and make as root in an always open root terminal. Strange.
Sinister Midget III
> Snit wrote:
>
>> Do not get me wrong - desktop Linux users, as with users of OS X, are much
>> less likely to get malware than are users of Windows. No doubt. But let us
>> not pretend the risk is not there at all.
>
> No one here ever has.
Except trolls, like, say, DuFuS, have repeatedly claimed some advocates
have said it.
--
Artificial Intelligence is no match for natural stupidity.
(So Snit trumps the artificial one)
Aspire One, Linux Mint 8 (LXDE)
Friends don't let friends use Windows
AZ Nomad
><http://www.pcworld.com/businesscenter/article/198686/linux_trojan_raises_ma
>lware_concerns.html>
> -----
> An announcement on the Unreal IRCd Forums states "This is
> very embarrassing...We found out that the
> Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
> quite a while ago with a version with a backdoor (trojan) in
> it. This backdoor allows a person to execute ANY command with
> the privileges of he user running the ircd. The backdoor can
> be executed regardless of any user restrictions (so even if
> you have passworded server or hub that doesn't allow any
The difference is that the default windows user is an admin and any
malware installed by browser or email client will be able to overwrite
*any* part of the system as opposed to the linux user which can't
overwrite the system.
Just as microsoft has never learned the difference between LAN and WAN
or between code and data, they've never managed to protect the OS from
its users.
Snit
slrni1au29....@ip70-176-155-130.ph.ph.cox.net on 6/13/10 5:31 PM:
> On Sun, 13 Jun 2010 12:12:17 -0700, Snit <use...@gallopinginsanity.com> wrote:
>> <http://www.pcworld.com/businesscenter/article/198686/linux_trojan_raises_ma
>> lware_concerns.html>
>> -----
>> An announcement on the Unreal IRCd Forums states "This is
>> very embarrassing...We found out that the
>> Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
>> quite a while ago with a version with a backdoor (trojan) in
>> it. This backdoor allows a person to execute ANY command with
>> the privileges of he user running the ircd. The backdoor can
>> be executed regardless of any user restrictions (so even if
>> you have passworded server or hub that doesn't allow any
>
> The difference is that the default windows user is an admin and any
> malware installed by browser or email client will be able to overwrite
> *any* part of the system as opposed to the linux user which can't
> overwrite the system.
Ah, you think just your data can get hosed but not the system... and that
makes it OK for you.
Again, do not get me wrong - Windows is unique in its tendency to get
malware... but *any* system can get it, esp. with user action, as in this
case (and in the case of malware on OS X).
> Just as microsoft has never learned the difference between LAN and WAN
> or between code and data, they've never managed to protect the OS from
> its users.
--
[INSERT .SIG HERE]
The Big Ticket
> On Sun, 13 Jun 2010 12:12:17 -0700, Snit <use...@gallopinginsanity.com> wrote:
>> <http://www.pcworld.com/businesscenter/article/198686/linux_trojan_raises_ma
>> lware_concerns.html>
>> -----
>> An announcement on the Unreal IRCd Forums states "This is
>> very embarrassing...We found out that the
>> Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
>> quite a while ago with a version with a backdoor (trojan) in
>> it. This backdoor allows a person to execute ANY command with
>> the privileges of he user running the ircd. The backdoor can
>> be executed regardless of any user restrictions (so even if
>> you have passworded server or hub that doesn't allow any
>
> The difference is that the default windows user is an admin and any
> malware installed by browser or email client will be able to overwrite
> *any* part of the system as opposed to the linux user which can't
> overwrite the system.
They are NOT default admin on Vista or Windows 7, and therefore, malware
can't do what it wants and overwrite the system.
>
> Just as microsoft has never learned the difference between LAN and WAN
> or between code and data, they've never managed to protect the OS from
> its users.
This is from an idiot office boy.
Big 666
> AZ Nomad stated in post
> slrni1au29....@ip70-176-155-130.ph.ph.cox.net on 6/13/10 5:31 PM:
>
>> On Sun, 13 Jun 2010 12:12:17 -0700, Snit <use...@gallopinginsanity.com> wrote:
>>> <http://www.pcworld.com/businesscenter/article/198686/linux_trojan_raises_ma
>>> lware_concerns.html>
>>> -----
>>> An announcement on the Unreal IRCd Forums states "This is
>>> very embarrassing...We found out that the
>>> Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
>>> quite a while ago with a version with a backdoor (trojan) in
>>> it. This backdoor allows a person to execute ANY command with
>>> the privileges of he user running the ircd. The backdoor can
>>> be executed regardless of any user restrictions (so even if
>>> you have passworded server or hub that doesn't allow any
>> The difference is that the default windows user is an admin and any
>> malware installed by browser or email client will be able to overwrite
>> *any* part of the system as opposed to the linux user which can't
>> overwrite the system.
>
> Ah, you think just your data can get hosed but not the system... and that
> makes it OK for you.
>
> Again, do not get me wrong - Windows is unique in its tendency to get
> malware... but *any* system can get it, esp. with user action, as in this
> case (and in the case of malware on OS X).
>
Not so much on Vista and Win 7 anymore, because those O/S(s) are
protected from user actions and a program actions that is not running
under the context of the admin account, which is the default setup on
those O/S(s) as the admin account is not in use. You don't hear about a
lot of malware attacks anymore with those O/S(s). That's not to say that
it doesn't happen. And one still sees it happening on the XP O/S.
The Big Ticket
> AZ Nomad stated in post
> slrni1au29....@ip70-176-155-130.ph.ph.cox.net on 6/13/10 5:31 PM:
>
>> On Sun, 13 Jun 2010 12:12:17 -0700, Snit <use...@gallopinginsanity.com> wrote:
>>> <http://www.pcworld.com/businesscenter/article/198686/linux_trojan_raises_ma
>>> lware_concerns.html>
>>> -----
>>> An announcement on the Unreal IRCd Forums states "This is
>>> very embarrassing...We found out that the
>>> Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
>>> quite a while ago with a version with a backdoor (trojan) in
>>> it. This backdoor allows a person to execute ANY command with
>>> the privileges of he user running the ircd. The backdoor can
>>> be executed regardless of any user restrictions (so even if
>>> you have passworded server or hub that doesn't allow any
>> The difference is that the default windows user is an admin and any
>> malware installed by browser or email client will be able to overwrite
>> *any* part of the system as opposed to the linux user which can't
>> overwrite the system.
>
> Ah, you think just your data can get hosed but not the system... and that
> makes it OK for you.
>
> Again, do not get me wrong - Windows is unique in its tendency to get
> malware... but *any* system can get it, esp. with user action, as in this
> case (and in the case of malware on OS X).
>
Not so much on Vista and Win 7 anymore, because those O/S(s) are
Snit
6/13/10 8:04 PM:
No doubt, Win 7 is a lot better in this area than is XP.
--
[INSERT .SIG HERE]
Kadaitcha Man
a bigmouthed pernicious and indubitate beggar, a repugnant kitchen
malkin, an unconscious fellow of no merits, thou blocks, thou stones,
thou worse than senseless things. Ye scolded:
You hace got gmail, Herr Doktor.
--
bung hole : n. Vagina. See fizzing at the bung hole.
Gregory Shearman
> Snit wrote:
>
>> Do not get me wrong - desktop Linux users, as with users of OS X, are much
>> less likely to get malware than are users of Windows. No doubt. But let us
>> not pretend the risk is not there at all.
>
> No one here ever has.
I get my MD5 hashes from one mirror, my sourcecode from another... and
gentoo does the rest... actually, Gentoo does it all. If the MD5 hash
fails then so does the install. It happens from time to time when
someone forgets to update the MD5 hash after updating the source.
--
Regards,
Gregory.
Gentoo Linux - Penguin Power
TomB
>
Not many I hope.
--
BOFH excuse #195:
We only support a 28000 bps connection.
TomB
> Snit <use...@gallopinginsanity.com> writes:
>> TomB stated in post 201006132...@usenet.drumscum.be on 6/13/10 1:30
>> PM:
>>
>>> GNU/Linux box, unless you're running your browser as root of
>>> course (which would be a very stupid thing to do).
>>
>> Who runs OS X as root?
>
> Interestingly TomB correctly notes it silly to run a browser as root
> (or your desktop period), but a while back was claiming it was ok to
> wget, untar and make as root in an always open root terminal.
> Strange.
Fetching a file from a trusted source with wget is something
completely different that browsing the www with a browser running a
bunch of 3rd pty plugins and add-ons.
--
BOFH excuse #285:
Telecommunications is upgrading.
Snit
AM:
Any benefit to running wget as root? Seems like a bizarre thing to do!
--
[INSERT .SIG HERE]
Hadron
> Snit wrote:
>
>> Do not get me wrong - desktop Linux users, as with users of OS X, are much
>> less likely to get malware than are users of Windows. No doubt. But let us
>> not pretend the risk is not there at all.
>
> No one here ever has.
Yes they have. Numerous times. In fact oodles of megabytes were
dedicated to how social engineering does not respect OSen with COLA
weenies crying and blubbering about Linux being secure. You know it. I
know it. Anyone that reads COLA knows it.
Hadron
TomB
>>>>> GNU/Linux box, unless you're running your browser as root of
>>>>> course (which would be a very stupid thing to do).
>>>>
>>>> Who runs OS X as root?
>>>
>>> Interestingly TomB correctly notes it silly to run a browser as
>>> root (or your desktop period), but a while back was claiming it
>>> was ok to wget, untar and make as root in an always open root
>>> terminal. Strange.
>>
>> Fetching a file from a trusted source with wget is something
>> completely different that browsing the www with a browser running a
>> bunch of 3rd pty plugins and add-ons.
>
> Any benefit to running wget as root? Seems like a bizarre thing to
> do!
The funny thing is that I *rarely* do it. I once mentioned in a
discussion with Hadron that I don't see a problem in doing so, as for
instance the ports system in FreeBSD fetches files as root anyway
(although I think the ports system uses 'fetch' instead - I'll have to
double-check that).
Of course now Hadron likes to claim that I download files with wget as
root like a maniac, which I don't.
There's no real benefit by the way. Not that I can see anyway. But
there's no real danger either.
--
BOFH excuse #421:
Domain controller not responding
Hadron
> On 2010-06-14, the following emerged from the brain of Snit:
>> TomB stated in post 201006140...@usenet.drumscum.be on 6/14/10 1:15
>> AM:
>>
>>>>>> About the Flash thing: "complete control" is very unlikely on a
>>>>>> GNU/Linux box, unless you're running your browser as root of
>>>>>> course (which would be a very stupid thing to do).
>>>>>
>>>>> Who runs OS X as root?
>>>>
>>>> Interestingly TomB correctly notes it silly to run a browser as
>>>> root (or your desktop period), but a while back was claiming it
>>>> was ok to wget, untar and make as root in an always open root
>>>> terminal. Strange.
>>>
>>> Fetching a file from a trusted source with wget is something
>>> completely different that browsing the www with a browser running a
>>> bunch of 3rd pty plugins and add-ons.
>>
>> Any benefit to running wget as root? Seems like a bizarre thing to
>> do!
>
> The funny thing is that I *rarely* do it. I once mentioned in a
> discussion with Hadron that I don't see a problem in doing so, as for
> instance the ports system in FreeBSD fetches files as root anyway
> (although I think the ports system uses 'fetch' instead - I'll have to
> double-check that).
>
> Of course now Hadron likes to claim that I download files with wget as
> root like a maniac, which I don't.
I have not claimed that and you are rewriting history. You openly and
repeatedly defended downloading, extracting and making as root. I
informed you it was bad practise and you repeatedly claimed it works
for you with Creepy backing you up and patting you on the back.
>
> There's no real benefit by the way. Not that I can see anyway. But
> there's no real danger either.
No there is NO benefit. What do you mean "that you can see"? There is
NONE. ONLY negatives. It is not something to be encouraged.
Ian Hilliard
Hash: SHA1
Snit wrote:
> <http://www.pcworld.com/businesscenter/article/198686/linux_trojan_raises_ma
> lware_concerns.html>
> -----
> An announcement on the Unreal IRCd Forums states "This is
> very embarrassing...We found out that the
> Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
> quite a while ago with a version with a backdoor (trojan) in
> it. This backdoor allows a person to execute ANY command with
> the privileges of he user running the ircd. The backdoor can
> be executed regardless of any user restrictions (so even if
> you have passworded server or hub that doesn't allow any
> users in)."
>
> The post goes on to say "It appears the replacement of the
> .tar.gz occurred in November 2009 (at least on some mirrors).
> It seems nobody noticed it until now."
> -----
>
> And then there is also this:
>
> <http://www.theregister.co.uk/2010/06/10/critical_adobe_flash_vuln_fix/>
> -----
> The security update is available for versions 10.0.45.2 and
> earlier of Flash for Windows, Mac OS X, and Linux. Last week,
> Adobe warned that the vulnerability allows attackers to take
> complete control of vulnerable machines when they view
> websites that contained specially manipulated Flash content.
> -----
>
> Do not get me wrong - desktop Linux users, as with users of OS X, are much
> less likely to get malware than are users of Windows. No doubt. But let us
> not pretend the risk is not there at all.
>
There is a big difference between this and the Windows problem of
getting pwned, because you visited the wrong web site or received the
wrong email. It is sloppy that the admin did not run tripwire on the
files to detect a change and didn't update the GNUPG signature when the
last valid update was done. Let's hope that it is done better in the future.
In the mean time, I hope that all those trojaned machines have been
cleaned out now.
Ian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwV/8UACgkQ0DzqJNlXtD73NQCfQjh3u4C0lliczcZe481DfV1g
zCEAnA4OIuGur9O87V2q9+OX0FVea920
=tIPM
-----END PGP SIGNATURE-----
Tattoo Vampire
> Yes
As always, you lie, Queeg.
--
Regards,
[tv]
Owner/proprietor, Trollus Amongus, LLC
...How do they get the deer to cross at the signs?
Hadron
> Hadron wrote:
>
>> Yes
>
> As always, you lie, Queeg.
You snip to hide the truth. I feel for you. Not in the same way Marti
does of course.
Chris Ahlstrom
> Hadron wrote:
>
>> Yes
>
> As always, you lie, Queeg.
Shameless, isn't he?
I'm prime, though not an odd number! :-)
--
Conjecture: All odd numbers are prime.
Mathematician's Proof:
3 is prime. 5 is prime. 7 is prime. By induction, all
odd numbers are prime.
Physicist's Proof:
3 is prime. 5 is prime. 7 is prime. 9 is experimental
error. 11 is prime. 13 is prime ...
Engineer's Proof:
3 is prime. 5 is prime. 7 is prime. 9 is prime.
11 is prime. 13 is prime ...
Computer Scientists's Proof:
3 is prime. 3 is prime. 3 is prime. 3 is prime...
Lusotec
><http://www.pcworld.com/businesscenter/article/198686/
>linux_trojan_raises_malware_concerns.html>
> -----
> An announcement on the Unreal IRCd Forums states "This is
> very embarrassing...We found out that the
> Unreal3.2.8.1.tar.gz file on our mirrors has been replaced
> quite a while ago with a version with a backdoor (trojan) in
> it. This backdoor allows a person to execute ANY command with
> the privileges of he user running the ircd. The backdoor can
> be executed regardless of any user restrictions (so even if
> you have passworded server or hub that doesn't allow any
> users in)."
>
> The post goes on to say "It appears the replacement of the
> .tar.gz occurred in November 2009 (at least on some mirrors).
> It seems nobody noticed it until now."
> -----
As an administrator I have to say that having ones machines compromised can
happen even with the greatest of cautions but letting it pass 6 months
without noticing it is either incompetence and/or negligence.
From a user's perspective, running "mystery" binaries in a unprivileged
secondary account is a very good idea, and the above is one of the reasons.
Stuff like games that don't need or should have access to one's files should
be run in a secondary account where the damage they can do is further
limited (assuming a reasonably configured machine and no root exploit is
used).
The general solution for all this is a MAC (Mandatory Access Control) system
with a default no access policy. This way any binary would only have the
minimal access it needed to do its job an nothing more, or no access if not
explicitly configured. The binaries and the rules would come from separate
locations to avoid both being switch like in this case.
GNU/Linux already has almost all the pieces needed to implement this. It
still needs an extensive rules set and an easy way to create them. Several
distributions already provide rules for many packages, but they are mainly
for server packages that are exposed to the outside. This great improves
security for a server, but it does nothing to stop trojans brought in by the
users, like in this case.
Improvements are still needed to make the creation of *good* rule sets easy.
In this aspect, Mandriva has made good work on tools, including GUIs, that
are a great help in creating such rules.
For example, I have setup rules that restricts Firefox's access to only the
~/.mozilla/ and ~/downloads/ directories. Firefox is also denied access to
localhost or the LAN. These rules fit well with the way I use Firefox. This
way, compromising my system even if Firefox is completely compromised is
much more difficult.
Similar restrictive rules for most binaries would make compromising a
GNU/Linux *extremely* difficult.
> And then there is also this:
>
> <http://www.theregister.co.uk/2010/06/10/critical_adobe_flash_vuln_fix/>
> -----
> The security update is available for versions 10.0.45.2 and
> earlier of Flash for Windows, Mac OS X, and Linux. Last week,
> Adobe warned that the vulnerability allows attackers to take
> complete control of vulnerable machines when they view
> websites that contained specially manipulated Flash content.
> -----
Flash being malware depends on who one asks. :)
> Do not get me wrong - desktop Linux users, as with users of OS X, are much
> less likely to get malware than are users of Windows. No doubt. But let
> us not pretend the risk is not there at all.
The user behavior is, currently, the biggest vector for malware propagation.
This is true for GNU/Linux, Mac OS X, and mostly true Windows. Windows had a
good number of malware that propagated to millions of machines without *any*
user intervention.
In this regard, GNU/Linux provides a better set of tools to protect the
system from the user, than both Mac OS X or Windows.
On the server, these tools are being put to effective use by several
distributions, but on the desktop there seams to be little interest from
both the distributions and the users. Unfortunately, only after a serious
security breakdown event on the GNU/Linux desktop will people want to put
"locks on the doors". That is human nature.
Regards.
chrisv
>Shit wrote:
>
>> Do not get me wrong - desktop Linux users, as with users of OS X, are much
>> less likely to get malware than are users of Windows. No doubt. But let us
>> not pretend the risk is not there at all.
>
>No one here ever has.
How many billion times do we have to "admit" this before stupid lying
asshole trolls stop accusing us of being "so unreasonable" about this?
--
"Linux is not totally safe and COLA advocates claiming it is are
foolish." - Hadron Quark, (again) lying about what advocates have
claimed.
ray
> <http://www.pcworld.com/businesscenter/article/198686/
linux_trojan_raises_ma
> lware_concerns.html>
> -----
> An announcement on the Unreal IRCd Forums states "This is very
> embarrassing...We found out that the Unreal3.2.8.1.tar.gz file on
> our mirrors has been replaced quite a while ago with a version with
> a backdoor (trojan) in it. This backdoor allows a person to execute
> ANY command with the privileges of he user running the ircd. The
> backdoor can be executed regardless of any user restrictions (so
> even if you have passworded server or hub that doesn't allow any
> users in)."
>
> The post goes on to say "It appears the replacement of the .tar.gz
> occurred in November 2009 (at least on some mirrors). It seems
> nobody noticed it until now." -----
>
> And then there is also this:
>
> <http://www.theregister.co.uk/2010/06/10/critical_adobe_flash_vuln_fix/>
> -----
> The security update is available for versions 10.0.45.2 and earlier
> of Flash for Windows, Mac OS X, and Linux. Last week, Adobe warned
> that the vulnerability allows attackers to take complete control of
> vulnerable machines when they view websites that contained specially
> manipulated Flash content. -----
>
> Do not get me wrong - desktop Linux users, as with users of OS X, are
> much less likely to get malware than are users of Windows. No doubt.
> But let us not pretend the risk is not there at all.
Certainly CAN - I don't think anyone has ever disputed that. I'll let you
know when it HAPPENS.
Hadron
Please raytard. You know as well as anyone, if you read any posts here
at all, that the usual dumb arses refused to believe that Linux could
get infected even though we kept stressing the idea of social
engineering. Amazing how many "advocates" are now rewriting history once
more.
One Shot, One Kill
"chrisv" <chr...@nospam.invalid> wrote in message
news:d5bc16pv1bbfkqrup...@4ax.com...
> Tattoo Vampire wrote:
>
>>Shit wrote:
>>
>>> Do not get me wrong - desktop Linux users, as with users of OS X, are
>>> much
>>> less likely to get malware than are users of Windows. No doubt. But
>>> let us
>>> not pretend the risk is not there at all.
>>
>>No one here ever has.
>
> How many billion times do we have to "admit" this before stupid lying
> asshole trolls stop accusing us of being "so unreasonable" about this?
>
chrisv is a piece of shit. chrisv is a fscking liar.
Moshe
> On 2010-06-13, Tattoo Vampire <sit...@this.computer> wrote:
>> Snit wrote:
>>
>>> Do not get me wrong - desktop Linux users, as with users of OS X, are much
>>> less likely to get malware than are users of Windows. No doubt. But let us
>>> not pretend the risk is not there at all.
>>
>> No one here ever has.
>
> I get my MD5 hashes from one mirror, my sourcecode from another..
Sounds like just the thing average Joe is interested in
figuring out how to do.
Tell me again how Linux is ready for the average person.
Moshe
Poor Shearman.
He is not too bright.
Snit
Ditto. Malware sucks... on *any* platform.
--
[INSERT .SIG HERE]
ray
No one is rewriting history except you, hardon. Like I said - I'll let
Hadron
You are telling lies OR you are ignorant of the subject and history. I
err to the second.
It really is that simple.
chrisv
> Larry lied:
>>
>> Please raytard. You know as well as anyone
...that "Hadron" is lying again.
>No one is rewriting history except you, hardon. Like I said - I'll let
>you know when it HAPPENS.
"Hadron" is a liar. "Hadron" is a POS.
--
'But then the COLA freeloaders, amongst others, steal the code, branch
it and then make their own "Free" alternative.' - "True Linux
advocate" Hadron Quark
ray
Sure, hardon - sure.
Snit
AM:
> On 2010-06-14, the following emerged from the brain of Snit:
>> TomB stated in post 201006140...@usenet.drumscum.be on 6/14/10 1:15
>> AM:
>>
>>>>>> About the Flash thing: "complete control" is very unlikely on a
>>>>>> GNU/Linux box, unless you're running your browser as root of
>>>>>> course (which would be a very stupid thing to do).
>>>>>
>>>>> Who runs OS X as root?
>>>>
>>>> Interestingly TomB correctly notes it silly to run a browser as
>>>> root (or your desktop period), but a while back was claiming it
>>>> was ok to wget, untar and make as root in an always open root
>>>> terminal. Strange.
>>>
>>> Fetching a file from a trusted source with wget is something
>>> completely different that browsing the www with a browser running a
>>> bunch of 3rd pty plugins and add-ons.
>>
>> Any benefit to running wget as root? Seems like a bizarre thing to
>> do!
>
> The funny thing is that I *rarely* do it.
Why would you ever? Really, why even log in as root? Other than just
playing on test systems I cannot think of a time I ever have. Not saying
you should not, but can you describe a case when it was a clear benefit for
you to do so?
> I once mentioned in a discussion with Hadron that I don't see a problem in
> doing so, as for instance the ports system in FreeBSD fetches files as root
> anyway (although I think the ports system uses 'fetch' instead - I'll have to
> double-check that).
>
> Of course now Hadron likes to claim that I download files with wget as root
> like a maniac, which I don't.
>
> There's no real benefit by the way. Not that I can see anyway. But there's no
> real danger either.
There is the danger of making mistakes when logged in as root.
--
[INSERT .SIG HERE]
Herr Doktor Evert van der Pik
news:Mon.14.Jun.201...@unsatisfactory.fudge-tunnel...
> Clogwog, why, thou full dish of fool. Thou art a droning muddy knave,
> a bigmouthed pernicious and indubitate beggar, a repugnant kitchen
> malkin, an unconscious fellow of no merits, thou blocks, thou stones,
> thou worse than senseless things. Ye scolded:
>
>> "Moshe" <goldee_l...@gmail.com> schreef in bericht
>> news:b1cxd2u0wgr5.1nj1pprilwiy5$.dlg@40tude.net...
>>> On Sun, 13 Jun 2010 16:15:31 -0400, Tattoo Vampire
>>> wrote:
>>>
>>>> Snit wrote:
>>>>
>>>>> Do not get me wrong - desktop Linux users, as with users of OS X, are
>>>>> much
>>>>> less likely to get malware than are users of Windows. No doubt. But
>>>>> let us
>>>>> not pretend the risk is not there at all.
>>>>
>>>
>>> server had been hacked.
>>> He didn't think it was possible.
>>>
>>> He was wrong.
>>> Twice in fact.
>>
>>
>> In almost every post about Linux security Peter "Clueless" Koehlmann
>> (PIK-Peter Idiot Koehlmann) denied there were risks!
>
> You hace got gmail, Herr Doktor.
Yes, COLA is full of "Doktors" these days!
http://groups.google.com/group/comp.os.linux.advocacy/msg/4c6d330172dfc705?hl=nl
TomB
> TomB stated in post 201006141...@usenet.drumscum.be on 6/14/10 2:52
> AM:
>
>>>>>>> a GNU/Linux box, unless you're running your browser as root of
>>>>>>> course (which would be a very stupid thing to do).
>>>>>>
>>>>>> Who runs OS X as root?
>>>>>
>>>>> Interestingly TomB correctly notes it silly to run a browser as
>>>>> root (or your desktop period), but a while back was claiming it
>>>>> was ok to wget, untar and make as root in an always open root
>>>>> terminal. Strange.
>>>>
>>>> Fetching a file from a trusted source with wget is something
>>>> completely different that browsing the www with a browser running
>>>> a bunch of 3rd pty plugins and add-ons.
>>>
>>> Any benefit to running wget as root? Seems like a bizarre thing
>>> to do!
>>
>> The funny thing is that I *rarely* do it.
>
> Why would you ever? Really, why even log in as root? Other than
> just playing on test systems I cannot think of a time I ever have.
> Not saying you should not, but can you describe a case when it was a
> clear benefit for you to do so?
Whenever something system-wide needs to be configured.
Installing/updating software. Managing xen virtual machines... There
are plenty of times I find myself working in a root console. When I
log on to a server at work, it is as root 9 times out of 10, because
the only thing I ever do on those machines is system configuration.
Why is it so fashionable to be against the usage of the root account
these days?
>> I once mentioned in a discussion with Hadron that I don't see a
>> problem in doing so, as for instance the ports system in FreeBSD
>> fetches files as root anyway (although I think the ports system
>> uses 'fetch' instead - I'll have to double-check that).
>>
>> Of course now Hadron likes to claim that I download files with wget
>> as root like a maniac, which I don't.
>>
>> There's no real benefit by the way. Not that I can see anyway. But
>> there's no real danger either.
>
> There is the danger of making mistakes when logged in as root.
Yes. So? Shall I wait until my servers configure themselves then?
--
BOFH excuse #72:
Satan did it
Snit
AM:
Because of the risks involved.
>>> I once mentioned in a discussion with Hadron that I don't see a
>>> problem in doing so, as for instance the ports system in FreeBSD
>>> fetches files as root anyway (although I think the ports system
>>> uses 'fetch' instead - I'll have to double-check that).
>>>
>>> Of course now Hadron likes to claim that I download files with wget
>>> as root like a maniac, which I don't.
>>>
>>> There's no real benefit by the way. Not that I can see anyway. But
>>> there's no real danger either.
>>
>> There is the danger of making mistakes when logged in as root.
>
> Yes. So? Shall I wait until my servers configure themselves then?
Huh? You see no other option?
--
[INSERT .SIG HERE]
chrisv
>> There is the danger of making mistakes when logged in as root.
>
>Yes. So? Shall I wait until my servers configure themselves then?
You'd better lock yourself in your bedroom and never come out, man.
Something bad might happen to you, otherwise.
--
"Freeloaders, thieves and general scroungers will indeed take
advantage. It's why the most used commercial SW projects in the world
do not give out their source codes as a general rule." - "True Linux
advocate" Hadron Quark
TomB
> TomB stated in post 201006141...@usenet.drumscum.be on 6/14/10 10:42
> AM:
>> On 2010-06-14, the following emerged from the brain of Snit:
>>>
>>
>> Yes. So? Shall I wait until my servers configure themselves then?
>
> Huh? You see no other option?
You're obviously referring to sudo. Believe me, when you're
configuring or maintaining a production server you *don't* want to
type sudo in front of every command. sudo is nice to use on a desktop
machine to execute the odd command with root privs, or for giving fine
grained access to certain parts of the system, but not for heavy
duting configuration and maintenance. That's what root's for.
--
BOFH excuse #167:
excessive collisions & not enough packet ambulances
Snit
PM:
I suggest you look up the su command.
--
[INSERT .SIG HERE]
TomB
> TomB <tommy.b...@gmail.com> writes:
>
>>>>>>> About the Flash thing: "complete control" is very unlikely on
>>>>>>> a GNU/Linux box, unless you're running your browser as root of
>>>>>>> course (which would be a very stupid thing to do).
>>>>>>
>>>>>> Who runs OS X as root?
>>>>>
>>>>> Interestingly TomB correctly notes it silly to run a browser as
>>>>> root (or your desktop period), but a while back was claiming it
>>>>> was ok to wget, untar and make as root in an always open root
>>>>> terminal. Strange.
>>>>
>>>> Fetching a file from a trusted source with wget is something
>>>> completely different that browsing the www with a browser running
>>>> a bunch of 3rd pty plugins and add-ons.
>>>
>>> Any benefit to running wget as root? Seems like a bizarre thing
>>> to do!
>>
>> The funny thing is that I *rarely* do it. I once mentioned in a
>> discussion with Hadron that I don't see a problem in doing so, as
>> for instance the ports system in FreeBSD fetches files as root
>> anyway (although I think the ports system uses 'fetch' instead -
>> I'll have to double-check that).
>>
>> Of course now Hadron likes to claim that I download files with wget
>> as root like a maniac, which I don't.
>
> I have not claimed that and you are rewriting history. You openly
> and repeatedly defended downloading, extracting and making as root.
Yes. And I still do. If you're an experienced *nix user and only do it
with trusted sources, there's little that can go wrong.
> I informed you it was bad practise
I *know* it is considered bad practice. So what if it is? I can make
up my own mind.
> and you repeatedly claimed it works for you with Creepy backing you
> up and patting you on the back.
I didn't, because - as I noted above - I rarely download, configure
and compile software as root. The one exeption is when I'm building a
custom kernel.
>> There's no real benefit by the way. Not that I can see anyway. But
>> there's no real danger either.
>
> No there is NO benefit. What do you mean "that you can see"? There
> is NONE. ONLY negatives. It is not something to be encouraged.
Nor is it something to get all psyched about.
--
BOFH excuse #168:
le0: no carrier: transceiver cable problem?
TomB
> TomB stated in post 201006142...@usenet.drumscum.be on 6/14/10 12:33
> PM:
>
>>>>
>>>> Yes. So? Shall I wait until my servers configure themselves then?
>>>
>>> Huh? You see no other option?
>>
>> You're obviously referring to sudo. Believe me, when you're
>> configuring or maintaining a production server you *don't* want to
>> type sudo in front of every command. sudo is nice to use on a
>> desktop machine to execute the odd command with root privs, or for
>> giving fine grained access to certain parts of the system, but not
>> for heavy duting configuration and maintenance. That's what root's
>> for.
>
> I suggest you look up the su command.
Do you honestly thing I don't know the su command?
And what about it? Wasn't being logged in as root dangerous then?
--
BOFH excuse #285:
Telecommunications is upgrading.
Snit
PM:
> On 2010-06-14, the following emerged from the brain of Snit:
>> TomB stated in post 201006142...@usenet.drumscum.be on 6/14/10 12:33
>> PM:
>>
>>>>>> There is the danger of making mistakes when logged in as root.
>>>>>
>>>>> Yes. So? Shall I wait until my servers configure themselves then?
>>>>
>>>> Huh? You see no other option?
>>>
>>> You're obviously referring to sudo. Believe me, when you're
>>> configuring or maintaining a production server you *don't* want to
>>> type sudo in front of every command. sudo is nice to use on a
>>> desktop machine to execute the odd command with root privs, or for
>>> giving fine grained access to certain parts of the system, but not
>>> for heavy duting configuration and maintenance. That's what root's
>>> for.
>>
>> I suggest you look up the su command.
>
> Do you honestly thing I don't know the su command?
Well, if you did it would not be "obvious" I meant su.
> And what about it?
Look it up.
> Wasn't being logged in as root dangerous then?
Yes. It can be.
--
[INSERT .SIG HERE]
TomB
> PM:
>
>>>>>>> There is the danger of making mistakes when logged in as root.
>>>>>>
>>>>>> Yes. So? Shall I wait until my servers configure themselves
>>>>>> then?
>>>>>
>>>>> Huh? You see no other option?
>>>>
>>>> You're obviously referring to sudo. Believe me, when you're
>>>> configuring or maintaining a production server you *don't* want
>>>> to type sudo in front of every command. sudo is nice to use on a
>>>> desktop machine to execute the odd command with root privs, or
>>>> for giving fine grained access to certain parts of the system,
>>>> but not for heavy duting configuration and maintenance. That's
>>>> what root's for.
>>>
>>> I suggest you look up the su command.
>>
>> Do you honestly thing I don't know the su command?
>
> Well, if you did it would not be "obvious" I meant su.
I don't quite follow.
>> And what about it?
>
> Look it up.
Don't need to. I have read the man page. Repeatedly.
>> Wasn't being logged in as root dangerous then?
>
> Yes. It can be.
So why are you suggesting su then? Without an argument it is used to
log in as root, and with the -c switch it is even more tiresome than
sudo.
--
BOFH excuse #320:
You've been infected by the Telescoping Hubble virus.
Tattoo Vampire
> You snip to hide the truth. I feel for you. Not in the same way Marti
> does of course.
Why the obsession with Marti, Queeg?
--
Regards,
[tv]
Owner/proprietor, Trollus Amongus, LLC
...I'm! A! Graduate! Of! The! Bill! Shatner! Acting! School!
Chris Ahlstrom
> On 2010-06-14, the following emerged from the brain of Snit:
>
> <Snit Circus� "su/sudo" trollery snipped>
>
> So why are you suggesting su then? Without an argument it is used to
> log in as root, and with the -c switch it is even more tiresome than
> sudo.
Just keep a root window tab open in "our screen". :-D
Snit is the very definition of a "tempest in a teapot".
--
Murphy's Law is recursive. Washing your car to make it rain doesn't work.
Chris Ahlstrom
> On 2010-06-14, the following emerged from the brain of Hadron:
>
>> No there is NO benefit. What do you mean "that you can see"? There
>> is NONE. ONLY negatives.
Sure there is a benefit. It is convenient for doing a large number of
sysadmin tasks in one session.
To hell with typing sudo after every command. Only a timorous moron like
our insane troll would do that.
>> It is not something to be encouraged.
>
> Nor is it something to get all psyched about.
Exactly.
And, if you do screw up, it only makes you a lot more careful
the next time around! :-D
Some people, having apparently screwed up almost every time they've logged
in as root (and apparently our pubeless noob "Hadron" is in this group)
get pretty superstitious about direct root access.
--
Anybody who doesn't cut his speed at the sight of a police car is
probably parked.
Chris Ahlstrom
> Hadron wrote:
>
>> You snip to hide the truth. I feel for you. Not in the same way Marti
>> does of course.
>
> Why the obsession with Marti, Queeg?
I dunno, TV, I'd be pretty Creeped Out® if "Hadron" claimed to "feel"
for me.
Although that might not be too bad after all, since "Hadron" can barely feel
for his arse with both hands.
--
What you don't know can hurt you, only you won't know it.
Gregory Shearman
> On 2010-06-14, the following emerged from the brain of Hadron:
>>
>> and repeatedly defended downloading, extracting and making as root.
My Gentoo boxes do this EVERY WEEK. What the FUCK is the problem?
Source from one mirror, MD5 hashes from another.... good backups...
where's the problem?
> Yes. And I still do. If you're an experienced *nix user and only do it
> with trusted sources, there's little that can go wrong.
Eggzackly.
--
Regards,
Gregory.
Gentoo Linux - Penguin Power
Gregory Shearman
> TomB pulled this Usenet boner:
>
>> On 2010-06-14, the following emerged from the brain of Hadron:
>>
>>> No there is NO benefit. What do you mean "that you can see"? There
>>> is NONE. ONLY negatives.
>
> Sure there is a benefit. It is convenient for doing a large number of
> sysadmin tasks in one session.
>
> To hell with typing sudo after every command. Only a timorous moron like
> our insane troll would do that.
Yep.. I find myself "suing" to root whenever I've got more than one root
command to execute, otherwise the constant password typing gets
annoying. The Caveats still stand... make sure you know EXACTLY what
your command is going to do... using "pretend" whenever certain commands
allow... and maintaining quality uptodate backups.
> Some people, having apparently screwed up almost every time they've logged
> in as root (and apparently our pubeless noob "Hadron" is in this group)
> get pretty superstitious about direct root access.
The insane quark troll doesn't run linux. It pretends to do so.
Snit
6/14/10 3:10 PM:
> TomB pulled this Usenet boner:
>
>> On 2010-06-14, the following emerged from the brain of Snit:
>>
>> <Snit Circus® "su/sudo" trollery snipped>
>>
>> So why are you suggesting su then? Without an argument it is used to
>> log in as root, and with the -c switch it is even more tiresome than
>> sudo.
>
> Just keep a root window tab open in "our screen". :-D
>
> Snit is the very definition of a "tempest in a teapot".
Why make such a big deal about this? I am not.
--
[INSERT .SIG HERE]
Snit
> On 2010-06-14, the following emerged from the brain of Snit:
>> TomB stated in post 201006142...@usenet.drumscum.be on 6/14/10 12:58
>> PM:
>>
>>>>>>>> There is the danger of making mistakes when logged in as root.
>>>>>>>
>>>>>>> Yes. So? Shall I wait until my servers configure themselves
>>>>>>> then?
>>>>>>
>>>>>> Huh? You see no other option?
>>>>>
>>>>> You're obviously referring to sudo. Believe me, when you're
>>>>> configuring or maintaining a production server you *don't* want
>>>>> to type sudo in front of every command. sudo is nice to use on a
>>>>> desktop machine to execute the odd command with root privs, or
>>>>> for giving fine grained access to certain parts of the system,
>>>>> but not for heavy duting configuration and maintenance. That's
>>>>> what root's for.
>>>>
>>>> I suggest you look up the su command.
>>>
>>> Do you honestly thing I don't know the su command?
>>
>> Well, if you did it would not be "obvious" I meant su.
>
> I don't quite follow.
You claimed it was "obvious" I meant sudo. Not su. My mistake. If you knew
of other options, what made that one option "obvious"?
>>> And what about it?
>>
>> Look it up.
>
> Don't need to. I have read the man page. Repeatedly.
So you do know about it. Good. Why ask then?
>>> Wasn't being logged in as root dangerous then?
>>
>> Yes. It can be.
>
> So why are you suggesting su then?
I noted it as an option. And one that is generally better than logging in
as root.
> Without an argument it is used to log in as root, and with the -c switch it is
> even more tiresome than sudo.
Who said anything about the -c switch? Oh, and while su gives permissions
of another user does it really log you in as that user? I admit I am not
sure.
--
[INSERT .SIG HERE]
Marti van Lin
The first thing I had to get used to in Ubuntu, was that the root
account was disabled by default.
A single Google search came up with a workaround:
$ sudo -s
will log you in as root
The sudo manpage also describes the option.
--
|_|0|_| Marti T. van Lin
|-|_|0| http://ml2mst.googlepages.com
|0|0|0| http://osgeex.blogspot.com
Big 666
He wouldn't know it if malware ran over him, because he has his security
blanket supposedly.
Lusotec
>> Without an argument it is used to log in as root, and with the -c switch
>> it is even more tiresome than sudo.
>
> Who said anything about the -c switch? Oh, and while su gives permissions
> of another user does it really log you in as that user? I admit I am not
> sure.
The only difference between starting a root shell with "su" and logging in
to a root shell (either in the console or with "su -") is that in the first
case the startup scripts are not executed and in the second case they are.
From a permissions perspective there is no difference. From a security
perspective, it is probably better to log in as root (using "su -" instead
of just "su") because the shell environment created may be a bit safer (e.g.
safer PATH).
If the user account is compromised, running just "su" will create a shell
with the root's permissions but the user's environment. This can potentially
help to compromise the root account.
For example, a malicious user can set PATH=/home/user/.malware/:$PATH
and then create a shell script named /home/user/.malware/ls
Every time that user executes su to get a root shell, and then executes ls
it will really run the malware ls shell script and not the system's ls
command. Running a malicious shell script as root is enough to fully
compromise a system.
By the way, this vector of exploit (and all others that require malware
executables) can easily be prevented if the partitions the user has write
access to are mounted with the noexec flag.
Regards.
Snit
6:02 PM:
> Snit wrote:
>>> Without an argument it is used to log in as root, and with the -c switch
>>> it is even more tiresome than sudo.
>>
>> Who said anything about the -c switch? Oh, and while su gives permissions
>> of another user does it really log you in as that user? I admit I am not
>> sure.
>
> The only difference between starting a root shell with "su" and logging in
> to a root shell (either in the console or with "su -") is that in the first
> case the startup scripts are not executed and in the second case they are.
From a user perspective, sure. From a security perspective and from a
technical perspective - no.
> From a permissions perspective there is no difference. From a security
> perspective, it is probably better to log in as root (using "su -" instead
> of just "su") because the shell environment created may be a bit safer (e.g.
> safer PATH).
I can accept that. Makes sense.
> If the user account is compromised, running just "su" will create a shell
> with the root's permissions but the user's environment. This can potentially
> help to compromise the root account.
>
> For example, a malicious user can set PATH=/home/user/.malware/:$PATH
> and then create a shell script named /home/user/.malware/ls
>
> Every time that user executes su to get a root shell, and then executes ls
> it will really run the malware ls shell script and not the system's ls
> command. Running a malicious shell script as root is enough to fully
> compromise a system.
Absolutely.
> By the way, this vector of exploit (and all others that require malware
> executables) can easily be prevented if the partitions the user has write
> access to are mounted with the noexec flag.
>
> Regards.
>
--
[INSERT .SIG HERE]
Moshe
Lusotec is correct on this one and it's preciously the
reason Ubuntu "disables" the root account.
I'll give Linux / OSX the edge on security compared to
Windows, even Windows 7, but again it's the user that is
the monkey wrench in all of this.
When that box pops up requiring root access, the typical
user just clicks away with no regard to what is actually
happening.
It's the same with Windows and UAC or a firewall or
Antivirus program etc.
We have all seen this happen.
Linux isn't attacked because as a desktop system, the
easiest to attack, Linux doesn't have a large enough
base to make it worthwhile.
When it does, then we can look and see what happens.
Rick
(snip)
> Linux isn't attacked because as a desktop system, the easiest to attack,
> Linux doesn't have a large enough base to make it worthwhile.
>
> When it does, then we can look and see what happens.
So, you're saying the Mac base isn't large enough either?
--
Rick
Snit
6:40 PM:
...
>>> For example, a malicious user can set PATH=/home/user/.malware/:$PATH
>>> and then create a shell script named /home/user/.malware/ls
>>>
>>> Every time that user executes su to get a root shell, and then executes ls
>>> it will really run the malware ls shell script and not the system's ls
>>> command. Running a malicious shell script as root is enough to fully
>>> compromise a system.
>>
>> Absolutely.
>
> Lusotec is correct on this one and it's preciously the
> reason Ubuntu "disables" the root account.
>
> I'll give Linux / OSX the edge on security compared to
> Windows, even Windows 7, but again it's the user that is
> the monkey wrench in all of this.
>
> When that box pops up requiring root access, the typical
> user just clicks away with no regard to what is actually
> happening.
On OS X you need to not just click but enter your admin password. Even on
an Admin account. But, sure, this does not stop people from installing
Trojans.
> It's the same with Windows and UAC or a firewall or
> Antivirus program etc.
>
> We have all seen this happen.
>
> Linux isn't attacked because as a desktop system, the
> easiest to attack, Linux doesn't have a large enough
> base to make it worthwhile.
>
> When it does, then we can look and see what happens.
At the *very least* more Trojans will appear for it and for OS X. Unless
you want a "locked" system like iOS you cannot really get around this.
--
[INSERT .SIG HERE]
Tattoo Vampire
> Although that might not be too bad after all, since "Hadron" can barely
> feel for his arse with both hands.
That's fine if he can't reach it; DFS and Flatfarb wash it for him anyhow.
Snit
6/14/10 6:52 PM:
While much larger than desktop Linux's, it is tiny compared to Windows. I
thought you would have known that.
--
[INSERT .SIG HERE]
Hadron
Why does Rick keep asking this silly, wimpy little questions? Is he
really so ignorant or is he trying to hint at some dark secret that only
he is aware of?
TomB
> TomB stated in post 20100614...@usenet.drumscum.be on 6/14/10 1:35 PM:
>
>> On 2010-06-14, the following emerged from the brain of Snit:
>>> TomB stated in post 201006142...@usenet.drumscum.be on 6/14/10 12:58
>>> PM:
>>>
>>>>>>>>> There is the danger of making mistakes when logged in as
>>>>>>>>> root.
>>>>>>>>
>>>>>>>> Yes. So? Shall I wait until my servers configure themselves
>>>>>>>> then?
>>>>>>>
>>>>>>> Huh? You see no other option?
>>>>>>
>>>>>> You're obviously referring to sudo. Believe me, when you're
>>>>>> configuring or maintaining a production server you *don't* want
>>>>>> to type sudo in front of every command. sudo is nice to use on
>>>>>> a desktop machine to execute the odd command with root privs,
>>>>>> or for giving fine grained access to certain parts of the
>>>>>> system, but not for heavy duting configuration and maintenance.
>>>>>> That's what root's for.
>>>>>
>>>>> I suggest you look up the su command.
>>>>
>>>> Do you honestly thing I don't know the su command?
>>>
>>> Well, if you did it would not be "obvious" I meant su.
>>
>> I don't quite follow.
>
> You claimed it was "obvious" I meant sudo. Not su. My mistake. If
> you knew of other options, what made that one option "obvious"?
Because it's the popular option of doing rooty stuff without actually
logging in as root.
With su you log in as root (unless you use the -c switch, but whoever
does that for regular system maintenance is crazy).
>>>> And what about it?
>>>
>>> Look it up.
>>
>> Don't need to. I have read the man page. Repeatedly.
>
> So you do know about it. Good. Why ask then?
Because you refer to su as another option as opposed to logging in as
root, while su'ing to root is virtually identical. The risk of making
mistakes after su is identical to the risk of making mistakes after
logging in as root directly.
I fail to see your point.
>>>> Wasn't being logged in as root dangerous then?
>>>
>>> Yes. It can be.
>>
>> So why are you suggesting su then?
>
> I noted it as an option. And one that is generally better than
> logging in as root.
Why would it be better than directly logging in as root? There are
even a couple of caveats as lusotec explained.
>> Without an argument it is used to log in as root, and with the -c
>> switch it is even more tiresome than sudo.
>
> Who said anything about the -c switch? Oh, and while su gives
> permissions of another user does it really log you in as that user?
> I admit I am not sure.
No, you're not actually logged in as the user. The w command will
still display to user you initially logged in with. But you're
basically runnning a root shell, with the same privs you get with
logging in as root directly. If you don't want to log in as root to
avoid making mistakes, you don't want to su to root either. Hell, you
even don't want to use sudo then.
--
BOFH excuse #119:
evil hackers from Serbia.
Snit
12:44 AM:
Rick is afraid to make any real points... anything that would go against his
herd.
--
[INSERT .SIG HERE]
Snit
AM:
...
>> You claimed it was "obvious" I meant sudo. Not su. My mistake. If
>> you knew of other options, what made that one option "obvious"?
>
> Because it's the popular option of doing rooty stuff without actually
> logging in as root.
>
> With su you log in as root (unless you use the -c switch, but whoever
> does that for regular system maintenance is crazy).
Are you actually logging in as root when you use su? I am not sure? I do
not think so. And if not, why not assume this instead of something else?
Seems you just jumped the gun on one solution and called it the "obvious"
one, even if not the best choice.
>>>>> And what about it?
>>>>
>>>> Look it up.
>>>
>>> Don't need to. I have read the man page. Repeatedly.
>>
>> So you do know about it. Good. Why ask then?
>
> Because you refer to su as another option as opposed to logging in as
> root, while su'ing to root is virtually identical.
What differences can you think of... in terms of security?
> The risk of making mistakes after su is identical to the risk of making
> mistakes after logging in as root directly.
>
> I fail to see your point.
Can you think of any differences in security between the two?
...
>> Who said anything about the -c switch? Oh, and while su gives
>> permissions of another user does it really log you in as that user?
>> I admit I am not sure.
>
> No, you're not actually logged in as the user. The w command will
> still display to user you initially logged in with. But you're
> basically runnning a root shell, with the same privs you get with
> logging in as root directly. If you don't want to log in as root to
> avoid making mistakes, you don't want to su to root either. Hell, you
> even don't want to use sudo then.
So you cannot think of any security differences in the three options?
--
[INSERT .SIG HERE]
Moshe
> TomB stated in post 201006150...@usenet.drumscum.be on 6/15/10 1:20
> AM:
>
> ...
>>> You claimed it was "obvious" I meant sudo. Not su. My mistake. If
>>> you knew of other options, what made that one option "obvious"?
>>
>> Because it's the popular option of doing rooty stuff without actually
>> logging in as root.
>>
>> With su you log in as root (unless you use the -c switch, but whoever
>> does that for regular system maintenance is crazy).
>
> Are you actually logging in as root when you use su? I am not sure? I do
> not think so. And if not, why not assume this instead of something else?
Here is what I was taught, and I might be wrong so take
this with a grain of salt.
1. When using su, the PATH or environment of the
ORIGINAL user is used. So if you are logged in as snit
and su to root, the PATH and environment for snit is
used, not that of the root user.
2. Using SU leaves an audit trail in the logs where as
logging in as root does not.
This may have changed in recent versions of Linux
though.
Sinister Midget III
> The first thing I had to get used to in Ubuntu, was that the root
> account was disabled by default.
>
> A single Google search came up with a workaround:
>
> $ sudo -s
>
> will log you in as root
>
> The sudo manpage also describes the option.
sudo su
Also works.
--
Useless Invention: Blinker Fluid.
Aspire One, Linux Mint 8 (LXDE)
Friends don't let friends use Windows
Chris Ahlstrom
> The first thing I had to get used to in Ubuntu, was that the root
> account was disabled by default.
>
> A single Google search came up with a workaround:
>
> $ sudo -s
>
> will log you in as root
>
> The sudo manpage also describes the option.
Safety by obscurity, eh? :-)
--
"There's always been Tower of Babel sort of bickering inside Unix, but this
is the most extreme form ever. This means at least several years of confusion."
-- Bill Gates, founder and chairman of Microsoft,
about the Open Systems Foundation
Chris Ahlstrom
> Chris Ahlstrom wrote:
One hand washes the other!
--
McGowan's Madison Avenue Axiom:
If an item is advertised as "under $50", you can bet it's not $19.95.
Moshe
wrote:
> Tattoo Vampire pulled this Usenet boner:
>
>> Chris Ahlstrom wrote:
>>
>>> Although that might not be too bad after all, since "Hadron" can barely
>>> feel for his arse with both hands.
>>
>> That's fine if he can't reach it; DFS and Flatfarb wash it for him anyhow.
>
> One hand washes the other!
Or in the world of Linux suck ups, one mouth sucks the
other's sphincter.
Hadron
You need to check out what the "advocates" and their nyms have done to
the Ubuntu group. It's trashed. Willy is strutting his stuff there with
another couple of like minded wankers called J G Miller and someone
called "Huge" as well as the inimitable Dan S. It's like a post
apocalyptic nightmare there. Somewhat amusingly, J G Miller did his
Koelhmann impression of shouting and yelling and telling everyone I was
a clueless troll - unfortunately for him I was right and he was totally
wrong and he had to thread slink. Tim Smith did a typically smooth slap
down of the clueless moron. Hilarious stuff. But then it was about
Linux, Gnome and Emacs - all things Miller (or Willy) knows little, if
anything about. But like Liarmutt he'll be back rewriting history in the
near future no doubt and crowing about how he was right.
Go see. It's an eye opener. Every second post is from an "advocate" type
saying it works for them or telling "windroids" to "fuck off back to
Windows".
TomB
> TomB stated in post 201006150...@usenet.drumscum.be on 6/15/10 1:20
> AM:
>
> ...
>>> You claimed it was "obvious" I meant sudo. Not su. My mistake.
>>> If you knew of other options, what made that one option "obvious"?
>>
>> Because it's the popular option of doing rooty stuff without
>> actually logging in as root.
>>
>> With su you log in as root (unless you use the -c switch, but
>> whoever does that for regular system maintenance is crazy).
>
> Are you actually logging in as root when you use su? I am not
> sure? I do not think so. And if not, why not assume this instead
> of something else?
>
> Seems you just jumped the gun on one solution and called it the
> "obvious" one, even if not the best choice.
What are you talking about? Since you were suggesting an option that
may reduce making errors, I thought you were referring to sudo.
Suggesting su as a way to avoid errors doesn't make sense. After su
you are root, and you can do anything you could do if you logged in as
root directly.
For the record: when I'm talking about logging in as root, I make no
distinction between direct logins and su'ing to root. I use both,
depending on the situation.
>>>>>> And what about it?
>>>>>
>>>>> Look it up.
>>>>
>>>> Don't need to. I have read the man page. Repeatedly.
>>>
>>> So you do know about it. Good. Why ask then?
>>
>> Because you refer to su as another option as opposed to logging in
>> as root, while su'ing to root is virtually identical.
>
> What differences can you think of... in terms of security?
>
>> The risk of making mistakes after su is identical to the risk of
>> making mistakes after logging in as root directly.
>>
>> I fail to see your point.
>
> Can you think of any differences in security between the two?
>
> ...
>>> Who said anything about the -c switch? Oh, and while su gives
>>> permissions of another user does it really log you in as that
>>> user? I admit I am not sure.
>>
>> No, you're not actually logged in as the user. The w command will
>> still display to user you initially logged in with. But you're
>> basically runnning a root shell, with the same privs you get with
>> logging in as root directly. If you don't want to log in as root to
>> avoid making mistakes, you don't want to su to root either. Hell,
>> you even don't want to use sudo then.
>
> So you cannot think of any security differences in the three
> options?
Sure I can. I know those mechanisms very well. See lusotec's excellent
explanation on possible $PATH issues for example.
I am still wondering why you were suggesting su as an alternative to
directly logging in as root, in order to avoid making mistakes. In
both cases you have the exact same control over the system. Total
control that is.
--
BOFH excuse #379:
We've picked COBOL as the language of choice.
TomB
Making stuff worse in my opinion. I don't want to know the number of
accounts with a 'dictionary password' and full sudo access on Ubuntu
installs.
--
BOFH excuse #443:
Zombie processes detected, machine is haunted.
TomB
> On 2010-06-14, TomB <tommy.b...@gmail.com> wrote:
>> On 2010-06-14, the following emerged from the brain of Hadron:
>>>
>>> I have not claimed that and you are rewriting history. You openly
>>> and repeatedly defended downloading, extracting and making as root.
>
> My Gentoo boxes do this EVERY WEEK. What the FUCK is the problem?
Sure. Whenever I upgrade my FreeBSD CURRENT box the entire operating
system is downloaded, compiled and installed as root too. It's
standard procedure.
> Source from one mirror, MD5 hashes from another.... good backups...
> where's the problem?
>
>> Yes. And I still do. If you're an experienced *nix user and only do it
>> with trusted sources, there's little that can go wrong.
>
> Eggzackly.
If you want to install system-wide, you'll have to execute the install
routine as root anyway. If you're going to get screwed over, it's with
the install routine.
--
BOFH excuse #353:
Second-system effect.
Chris Ahlstrom
> On 2010-06-14, the following emerged from the brain of Gregory Shearman:
>
>> Eggzackly.
>
> If you want to install system-wide, you'll have to execute the install
> routine as root anyway. If you're going to get screwed over, it's with
> the install routine.
Or the app you install (as root, if the app does a setuid to root).
Note:
http://en.wikipedia.org/wiki/Setuid
Due to the increased likelihood of security flaws[1], many operating
systems ignore the setuid attribute when applied to executable shell
scripts.
--
The big question is why in the course of evolution the males permitted
themselves to be so totally eclipsed by the females. Why do they tolerate
this total subservience, this wretched existence as outcasts who are
hungry all the time?
Hadron
> On 2010-06-14, TomB <tommy.b...@gmail.com> wrote:
>> On 2010-06-14, the following emerged from the brain of Hadron:
>>>
>>> I have not claimed that and you are rewriting history. You openly
>>> and repeatedly defended downloading, extracting and making as root.
>
> My Gentoo boxes do this EVERY WEEK. What the FUCK is the problem?
As usual Gregory Shearman has no idea of what is being discussed.
Every week? Huh? What happened to Windows being a "update mess"? Doh!
>
> Source from one mirror, MD5 hashes from another.... good backups...
> where's the problem?
Priceless. "Good backups". Thats like saying dont wear a seat belt
because you never crash and if you do, so what, the hospitals are good
around here. What a total and utterly incompetent dick you are Gregory.
>
>> Yes. And I still do. If you're an experienced *nix user and only do it
>> with trusted sources, there's little that can go wrong.
>
> Eggzackly.
Bullshit.
It is incompetent.
Why do you think even system utilities sudo down to lower authority
users when manipulating things online?
Seriously, you guys need to learn to look outside of your own basements
when thinking your shit shoddy practises are to be encouraged.
Hadron
You are shifting the goalposts completely and you know it. If you dont
know it then so be it. You can wallow in your happy little sty ;)
Snit
AM:
> On 2010-06-15, the following emerged from the brain of Snit:
>> TomB stated in post 201006150...@usenet.drumscum.be on 6/15/10 1:20
>> AM:
>>
>> ...
>>>> You claimed it was "obvious" I meant sudo. Not su. My mistake.
>>>> If you knew of other options, what made that one option "obvious"?
>>>
>>> Because it's the popular option of doing rooty stuff without
>>> actually logging in as root.
>>>
>>> With su you log in as root (unless you use the -c switch, but
>>> whoever does that for regular system maintenance is crazy).
>>
>> Are you actually logging in as root when you use su? I am not
>> sure? I do not think so. And if not, why not assume this instead
>> of something else?
>>
>> Seems you just jumped the gun on one solution and called it the
>> "obvious" one, even if not the best choice.
>
> What are you talking about?
I am talking about your claiming it was "obvious" I was talking about one
choice - which showed you did not even consider other choices.
This is not complex - why do you pretend it is?
> Since you were suggesting an option that may reduce making errors, I thought
> you were referring to sudo.
Where did I say anything about error reduction?
...
>> So you cannot think of any security differences in the three
>> options?
>
> Sure I can. I know those mechanisms very well.
Such as...?
> See lusotec's excellent
> explanation on possible $PATH issues for example.
>
> I am still wondering why you were suggesting su as an alternative to
> directly logging in as root, in order to avoid making mistakes.
Please quote where you think I talked about the risk of making mistakes in
terms of su.
> In both cases you have the exact same control over the system. Total control
> that is.
--
[INSERT .SIG HERE]
Snit
AM:
>>> Absolutely.
>>
>> Lusotec is correct on this one and it's preciously the reason Ubuntu
>> "disables" the root account.
>
> Making stuff worse in my opinion. I don't want to know the number of
> accounts with a 'dictionary password' and full sudo access on Ubuntu
> installs.
Most will not even have a root password.
--
[INSERT .SIG HERE]
Snit
1:54 AM:
> On Tue, 15 Jun 2010 01:40:10 -0700, Snit wrote:
>
>> TomB stated in post 201006150...@usenet.drumscum.be on 6/15/10 1:20
>> AM:
>>
>> ...
>>>> You claimed it was "obvious" I meant sudo. Not su. My mistake. If
>>>> you knew of other options, what made that one option "obvious"?
>>>
>>> Because it's the popular option of doing rooty stuff without actually
>>> logging in as root.
>>>
>>> With su you log in as root (unless you use the -c switch, but whoever
>>> does that for regular system maintenance is crazy).
>>
>> Are you actually logging in as root when you use su? I am not sure? I do
>> not think so. And if not, why not assume this instead of something else?
>
> Here is what I was taught, and I might be wrong so take
> this with a grain of salt.
>
> 1. When using su, the PATH or environment of the
> ORIGINAL user is used. So if you are logged in as snit
> and su to root, the PATH and environment for snit is
> used, not that of the root user.
Hmmm, I admit I do not know either way.
> 2. Using SU leaves an audit trail in the logs where as
> logging in as root does not.
Ah, this makes a difference with security - and is another reason to not log
in as root.
> This may have changed in recent versions of Linux
> though.
--
[INSERT .SIG HERE]
TomB
That's the point. Full root access to the system can be obtained with
the password of the account created during installation. Not good.
Keep the root account in place I say, and put a strict password policy
on it during installation. Much better than just giving the firstly
created user full root access. That's just lame.
--
BOFH excuse #234:
Someone is broadcasting pygmy packets and the router doesn't know how
to deal with them.
One Shot, One Kill
"chrisv" <chr...@nospam.invalid> wrote in message
news:atqc1612l8vf43mj4...@4ax.com...
> TomB wrote:
>
>>> There is the danger of making mistakes when logged in as root.
>>
>>Yes. So? Shall I wait until my servers configure themselves then?
>
> Something bad might happen to you, otherwise.
>
chrisv is a piece of shit. chrisv is a liar.
Snit
AM:
> On 2010-06-15, the following emerged from the brain of Snit:
>> TomB stated in post 201006151...@usenet.drumscum.be on 6/15/10 4:42
>> AM:
>>
>>>>> Absolutely.
>>>>
>>>> Lusotec is correct on this one and it's preciously the reason
>>>> Ubuntu "disables" the root account.
>>>
>>> Making stuff worse in my opinion. I don't want to know the number
>>> of accounts with a 'dictionary password' and full sudo access on
>>> Ubuntu installs.
>>
>> Most will not even have a root password.
>
> That's the point. Full root access to the system can be obtained with
> the password of the account created during installation. Not good.
This is true of any account in the Wheel group. Curious - any idea where
that name came from?
> Keep the root account in place I say, and put a strict password policy
> on it during installation. Much better than just giving the firstly
> created user full root access. That's just lame.
--
[INSERT .SIG HERE]
Snit
7:32 AM:
> TomB stated in post 201006151...@usenet.drumscum.be on 6/15/10 7:06
> AM:
>
>> On 2010-06-15, the following emerged from the brain of Snit:
>>> TomB stated in post 201006151...@usenet.drumscum.be on 6/15/10 4:42
>>> AM:
>>>
>>>>>> Absolutely.
>>>>>
>>>>> Lusotec is correct on this one and it's preciously the reason
>>>>> Ubuntu "disables" the root account.
>>>>
>>>> Making stuff worse in my opinion. I don't want to know the number
>>>> of accounts with a 'dictionary password' and full sudo access on
>>>> Ubuntu installs.
>>>
>>> Most will not even have a root password.
>>
>> That's the point. Full root access to the system can be obtained with
>> the password of the account created during installation. Not good.
>
> This is true of any account in the Wheel group. Curious - any idea where
> that name came from?
Wait: the Wheel group just is for su... not sudo... right? Arg... too long
since I have worked with this stuff.
Marti van Lin
> Marti van Lin pulled this Usenet boner:
>
>> The first thing I had to get used to in Ubuntu, was that the root
>> account was disabled by default.
>>
>> A single Google search came up with a workaround:
>>
>> $ sudo -s
>>
>> will log you in as root
>>
>> The sudo manpage also describes the option.
>
> Safety by obscurity, eh? :-)
Naah, the safety has mv'd /dev/null ;-)
--
|_|0|_| Marti T. van Lin
|-|_|0| http://ml2mst.googlepages.com
|0|0|0| http://osgeex.blogspot.com
Marti van Lin
> On 2010-06-14, Marti van Lin <ml2...@gmail.com> claimed:
>
>> The first thing I had to get used to in Ubuntu, was that the root
>> account was disabled by default.
>>
>> A single Google search came up with a workaround:
>>
>> $ sudo -s
>>
>> will log you in as root
>>
>> The sudo manpage also describes the option.
>
> sudo su
>
> Also works.
Thanks for reminding me, forgot that works too ;-)