Hello I recently bought 7.1 pro and forgot my root password. It was terrible. Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I created a new user with no password and root privileges. With that I edited the root pwd and ... ping-- There is my new root pwd. Isn't this a security hole. Let's say Microsoft's WEB-Server's runnin' Linux and I would have 10 Minutes physical access and my CD 2 with me. Then I could change the ROOT pwd. Sascha
** from the outer limits of space and time electrons arranged themselves into a message from Sascha Kloss <01725832094@d2mail.de> on Mon, 26 Feb 2001 20:49:57 +0100 Earth Standard Time
I recently bought 7.1 pro and forgot my root password. It was terrible. Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I created a new user with no password and root privileges. With that I edited the root pwd and ...
ping-- There is my new root pwd.
Isn't this a security hole.
this is a "hole" IF strangers can gain *Physical* access to your machine log enough to do what you did... yet another reason folks dont like to let strangers see their "server/gateway" machines at all. I dont want any potential theif to know it's even in here. since, once they steel the box, it's security is truely comprimised! <s> Encryption of everything is what the paranoid admin would like, any bets on my chances of getting it? j It might look like I'm doing nothing, but at the cellular level I'm really quite busy.
You can do that with most any UNIX type of server/OS... If you want to prevent that, you set BIOS passwords to prevent someone from accessing the BIOS, then set your boot device to be the hard disk ONLY! Of course you would have been screwed in your situation, had you done this. Choose the lesser of two evils. - Herman On Mon, 26 Feb 2001, Sascha Kloss wrote: ->>Hello ->> ->>I recently bought 7.1 pro and forgot my root password. It was terrible. ->>Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue ->>system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I ->>created a new user with no password and root privileges. With that I ->>edited the root pwd and ... ->> ->>ping-- ->> There is my new root pwd. ->> ->>Isn't this a security hole. Let's say Microsoft's WEB-Server's runnin' ->>Linux and I would have 10 Minutes physical access and my CD 2 with me. ->>Then I could change the ROOT pwd. ->> ->>Sascha
hi, to avoid this you can use a crypting file system. i dont know if such is available for linux, but i know that this is available in form of scsi controllers that do this in raw form. so you have your hd encrypted, even booting from elsewhere didnt give access without the the propper passphrase. greets, chris On Montag, 26. Februar 2001 20:49, Sascha Kloss wrote:
Hello
I recently bought 7.1 pro and forgot my root password. It was terrible. Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I created a new user with no password and root privileges. With that I edited the root pwd and ...
ping-- There is my new root pwd.
Isn't this a security hole. Let's say Microsoft's WEB-Server's runnin' Linux and I would have 10 Minutes physical access and my CD 2 with me. Then I could change the ROOT pwd.
Sascha
X-Mozilla-Status2: 00000000 Message-ID: <3A9AA714.6E19605B@d2mail.de> Date: Mon, 26 Feb 2001 19:57:24 +0100 From: Sascha Kloss <01725832094@d2mail.de> X-Mailer: Mozilla 4.74 [de] (X11; U; Linux 2.2.16 i686) X-Accept-Language: en MIME-Version: 1.0 To: suse-linux-e@suse.com Subject: Security HOLE Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit
Hello
I recently bought 7.1 pro and forgot my root password. It was terrible. Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I created a new user with no password and root privileges. With that I edited the root pwd and ...
ping-- There is my new root pwd.
Isn't this a security hole. Let's say Microsoft's WEB-Server's runnin' Linux and I would have 10 Minutes physical access and my CD 2 with me. Then I could change the ROOT pwd.
Sascha
---------------------------------------- Content-Type: text/plain; charset="us-ascii"; name="Anhang: 2" Content-Transfer-Encoding: 7bit Content-Description: ---------------------------------------- -- visit me at http://mamalala.de ICQ-> NICK: chrisk ->UIN: 108069244 (not always online.....)
You don't even need the CDs if you use LILO: just put in the boot parameter init=/bin/sh and you'll be minimally logged in as root on startup. If you want to avoid this hole, put a password in lilo.conf, disable booting except from the hard disk in your bios setup, password protect your bios and never never network your computer. Then nobody can break in...unless they unscrew the box. JDL Sascha Kloss wrote:
Hello
I recently bought 7.1 pro and forgot my root password. It was terrible. Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I created a new user with no password and root privileges. With that I edited the root pwd and ...
ping-- There is my new root pwd.
Isn't this a security hole. Let's say Microsoft's WEB-Server's runnin' Linux and I would have 10 Minutes physical access and my CD 2 with me. Then I could change the ROOT pwd.
Sascha
At 08:49 PM 2/26/2001 +0100, you wrote:
Hello
I recently bought 7.1 pro and forgot my root password. It was terrible. Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I created a new user with no password and root privileges. With that I edited the root pwd and ...
ping-- There is my new root pwd.
Isn't this a security hole.
No, it is not a security hole. Part of proper security management is physical security. This is in relation to just how much protection you need. There are a number of things: set the BIOS to /not/ boot off any media except the hard drive - this precludes the possibility of using a floppy or CD to attack your system. 2. Encrypt your hard drive: there are several methods of doing this. That way even if the hard drive is physically stolen no one would be able to read it. Go read some good info on security - start at www.securityfocus.com :-)
Let's say Microsoft's WEB-Server's runnin' Linux and I would have 10 Minutes physical access and my CD 2 with me. Then I could change the ROOT pwd.
SaschaX-Mozilla-Status2: 00000000 Message-ID: <3A9AA714.6E19605B@d2mail.de> Date: Mon, 26 Feb 2001 19:57:24 +0100 From: Sascha Kloss <01725832094@d2mail.de> X-Mailer: Mozilla 4.74 [de] (X11; U; Linux 2.2.16 i686) X-Accept-Language: en MIME-Version: 1.0 To: suse-linux-e@suse.com Subject: Security HOLE Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit
Hello
I recently bought 7.1 pro and forgot my root password. It was terrible. Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I created a new user with no password and root privileges. With that I edited the root pwd and ...
ping-- There is my new root pwd.
Isn't this a security hole. Let's say Microsoft's WEB-Server's runnin' Linux and I would have 10 Minutes physical access and my CD 2 with me. Then I could change the ROOT pwd.
Sascha
-- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/support/faq
---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com
A server cannot be considered secure unless physical access to it is controlled. That is why companies are spending so much money to secure their computer rooms and control access to them. Avi --On Monday, February 26, 2001 20:49 +0100 Sascha Kloss <01725832094@d2mail.de> wrote:
Hello
I recently bought 7.1 pro and forgot my root password. It was terrible. Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I created a new user with no password and root privileges. With that I edited the root pwd and ...
ping-- There is my new root pwd.
Isn't this a security hole. Let's say Microsoft's WEB-Server's runnin' Linux and I would have 10 Minutes physical access and my CD 2 with me. Then I could change the ROOT pwd.
Sascha
-- Avi Schwartz avi@CFFtechnologies.com
And if you open the case and take the hard drives home and mount them on your system.... Granted - some would like more security in that vien...but generally, without physical security, all other security is useless..... Ruben On Mon, 26 Feb 2001 14:49:57 Sascha Kloss wrote:
Hello
I recently bought 7.1 pro and forgot my root password. It was terrible. Anyway, after a bit thinkin' I took out the CD 2 and started the 'rescue system'. With that I had FULL ACCESS on MY HDDs!! Even /etc/pwd... . I created a new user with no password and root privileges. With that I edited the root pwd and ...
ping-- There is my new root pwd.
Isn't this a security hole. Let's say Microsoft's WEB-Server's runnin' Linux and I would have 10 Minutes physical access and my CD 2 with me. Then I could change the ROOT pwd.
Sascha -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com
Also check the FAQ at http://www.suse.com/support/faq -- Brooklyn Linux Solutions http://www.mrbrklyn.com http://www.brooklynonline.com
1-718-382-5752
participants (8)
-
Avi Schwartz -
Christian Klippel -
Herman Knief -
jfweber＠eternal.net -
John D Lamb -
Ruben I Safir - Brooklyn Linux Solutions CEO -
Sascha Kloss -
wilson＠claborn.net