11 Sep
2013
11 Sep
'13
7:57 a.m.
What about sudo?
I'd be interested to know how many people have it disabled.
11 Sep
11 Sep
9:03 a.m.
New subject: NSA and SSL (Tony Andersson)
Is that involved in this NSA scheming too? If so, I have completely missed that.
Personally I have three levels:
- On exposed machines it is disabled. This includes my BitFolk vps.
- On machines in my private network I have barely no security at all, simple (easy to
type) passwords for the user and sudo enabled.
- On machines for work, shared with others, I leave the default
setting for that flavour of *nix. Half trusting the network team to have the (sub-)
network fairly secured, half trusting the other users (often sharing the local user name
due to the nature of the work we are doing) knowing what they are doing (and to change the
default for that Unix flavour would need us to have a company wide policy for what is
supposed to be instead. Which we don't have.)
__
/ony
-------
Wednesday, September 11, 2013, 8:57:39 AM, Andrew wrote:
What about sudo?
I'd be interested to know how many people have it
disabled.
11:17 a.m.
New subject: NSA and SSL (Tony Andersson)
On Wed, 11 Sep 2013, BitFolkList(a)tony-andersson.com wrote:
Is that involved in this NSA scheming too? If so, I
have completely missed that.
I don't think so.
There was a pretty serious bug in sudo that was subsequently fixed but
recently made the news when the Metasploit platform added it - because
Apple hadn't fixed sudo in OS X.
Martijn.
10:52 a.m.
New subject: NSA and SSL (Tony Andersson)
Ah, OK. Then I feel a bit safer again. ;-)
(Having read up on the original question it is quite ridiculous that
NSA actually got away with this in the first place...)
__
/ony
-------
Wednesday, September 11, 2013, 12:17:41 PM, Martijn wrote:
On Wed, 11 Sep 2013, BitFolkList(a)tony-andersson.com
wrote:
> Is that involved in this NSA scheming too? If so, I have completely missed that.
I don't think so.
There was a pretty serious bug in sudo that was
subsequently fixed but
recently made the news when the Metasploit platform added it - because
Apple hadn't fixed sudo in OS X.
Martijn.
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
12:54 p.m.
New subject: NSA and SSL (Tony Andersson)
Hi,
There was a pretty serious bug in sudo that was
subsequently fixed but
recently made the news when the Metasploit platform added it - because
Apple hadn't fixed sudo in OS X.
Shell access is a tricky thing. There are almost always local root
exploits at any given time so giving shell access out shouldn't be done
as lightly as other things: sudo is the least of your worries.
sudo itself is a handy tool to have on every machine and its auditing
and logging capabilities have a lot going for them so overall it's a win.
I'm glad I don't have to run a shell serv{er,ice}.
...but I'm also aware that the handful of users I have given adhoc
shells to are in a particularly privileged position with respect to the
data I store on behalf of other people who only have, say, IMAP access.
Regards,
@ndy
--
andyjpb(a)ashurst.eu.org
http://www.ashurst.eu.org/
0x7EBA75FF
4119
days inactive
4119
days old
4 comments
4 participants
participants (4)
-
Andrew Griffiths -
Andy Bennett -
BitFolkList＠tony-andersson.com -
Martijn Grooten