From: sysmark@helios.physics.utoronto.ca (Mark Bartelt)
Subject: Re: Break-in through lp, nuucp accounts
Reply-To: mark@cita.toronto.edu
Organization: University of Toronto Physics/Astronomy/CITA
Date: Wed, 8 Apr 1992 10:09:19 GMT

[ Jeff Zurschmeide ]

| I'll be working on the next revision of the  Site Administration Guide this summer,
| and I'll include a section on plugging holes in the /etc/passwd file. There's already
| a fairly comprehensive section on system security in the standard UNIX
| model in that book today. 

Glad to hear it.  However, a few comments:

(1)  As I recall, the Site Administrator's Guide is an optional extra, which
presumably many new users will opt not to purchase.  Oughtn't a good section
on security be added to the Personal System Administration Guide (which comes
with all systems, I think) as well?

(2)  SGI seems to be going after a new class of customers, those who might be
charitably referred to as "less sophisticated", i.e. those migrating from the
PC world, many of whom don't want to do much beyond running a few shrink-wrap
software packages.  (Note, for example, the "dumbing down" of the documentation,
much of which seems oriented toward that sort of customer as opposed to SGI's
traditional customer base.  I'm not intending that term as pejoratively as it
might sound.  But this does seem to be the trend.  Anyway, I digress ...)

This being the case, doesn't it seem likely that new, not-terribly-UNIX-savvy
IRIS users who *do* opt for the Site Administrator's Guide might be at least
a bit intimidated by its size (nearly 500 pages), and might therefore tend to
overlook a small section on security?  After all, it seems that someone who
is well versed in security issues doesn't need to read the section.  But that
someone *not* aware of them might not recognize the importance of that section
and might therefore not bother reading it.  Accordingly ...

(3)  It seems that, in addition to the admirable goal of enhancing the manuals,
there nonetheless ought to be *no* unprotected accounts in /etc/passwd, with
the exception of root (which could be handled by a trivial modification to
/bin/login which would cause it, in the case logins to accounts with a null
root password, to automatically drop the user into /bin/passwd to force him/her
to assign one).

PS:  As long as we're on the subject of documentation, please note the minor
error on page 2-11 of the Personal System Administration Guide:

	Position your cursor within the new window and type:

	su

	then press <Enter>.

	Note:	su is short for "superuser", another name sometimes used
		for persons logged in with the root account.

Although it's true that the "superuser" colloquialism for "root" has been
around for at least a decade, this has nothing to do with the origin of
the name of the "su" command.  Although IRIX (and SunOS) seem to believe
otherwise, "su" derives from "substitute user ID", which was what used to
appear in the man page's synopsis line until SGI and Sun diddled with it.

I think the "su == superuser" assertion should be expunged, since it's
doubly confusing (especially to the unsophisticated users you're trying
to court):

First, the current synopsis line ("become super-user or another user") is
a bit misleading, since by default the command only runs a shell with the
specified user's uid.  Inexperienced users tend to get confused by this,
the expectation being that "becoming another user" ought to include the
processing of .profile (or .cshrc + .login).  It isn't until five or six
paragraphs down that the "-" option is discussed.

Secondly, I've encountered cases of minor confusion where a user wonders
why, if the "su" command can be used to assume the uid of any user whose
password one happens to know, the command is oddly called "superuser".

Would it be asking too much to dispose of this man page revisionism, and
revert back to the old Seventh Edition (or 4bsd) command description in
the case of "su".  (Ultrix, for all its faults, at least get *this* one
correct!)

Mark Bartelt                                                416/978-5619
Canadian Institute for                             mark@cita.toronto.edu
Theoretical Astrophysics                           mark@cita.utoronto.ca

"Clothes not busy being worn are busy drying."  -  Dylan, on laundry day