[net.unix-wizards] Convenient logins vs security

stew@hanauma.UUCP (Stewart Levin) (09/13/86)

------->
I'd like to set up a convenient login account "lpq" so that users
standing next to our printer can run /usr/ucb/lpq by simply typing
"lpq" to the "Login:" prompt at any of the nearby terminals.  The
following /etc/passwd line does the trick:

	lpq::12:0:Ipq:/usr/spool/uucppublic:/usr/ucb/lpq

where I've placed a .hushlogin file in uucppublic to supress the
usual display of /etc/motd and other login notices.

My concern is whether this no-password account would permit outsiders
access to our system.  I'm not concerned here about inside hackers,
only about outside breakin.  We're running a 4.2BSD clone (Convex Unix 4.0).

Reply by e-mail is fine, even preferable, and you may mail to "root" if
desired.  Thanks for any info.

			UUCP: ...!decvax!hanauma!stew

bzs@bu-cs.bu.EDU (Barry Shein) (09/18/86)

My solution at BU to this was to add a hack to finger: If the GECOS
field consists of the string 'RC' [utterly arbitrary] then the finger
daemon presumes there is a program by the same name as the account
in the 'home' directory that should be run and its output should be
sent instead of the normal finger output, thus:

	finger lpq@bu-cs

would respond with the queue info. I mainly liked this because adding
new ones is just a matter of adding /etc/passwd entries (like you're
moving towards.) It's also a lot cheaper than going through a login
just to get a queue status although we've done what you're doing also
with no problems. Obviously if the machine you are coming from doesn't
have net access you're out of luck for this soln.

	-Barry Shein, Boston University