[comp.bugs.4bsd] rdump security deficiency, or am I wrong?

sater@cs.vu.nl (Hans van Staveren) (09/11/87)

When running rdump on my workstation I have to be root (ofcourse).
However to write the tape on the remote machine I also have to be
in the /.rhosts file on dumphost.
Now *I* can be trusted :-), but there are other workstations on this
net. It would seem that rdump should not need to be root on dumphost
since it only writes a tape.

This could be
1) My lack of understanding
2) Something that one can kludge around
3) A bug

Which of the three?
Eternal gratitude for a day to the solver of this mystery.

				Hans van Staveren

matt@oddjob.UChicago.EDU (Matt Crawford) (09/11/87)

You don't say what system you're using, but since you say
"workstation", let's assume it's a sun.    :-)

Use:
	rdump 0uf dumphost.dumpuser:/dev/tapedev filesystem

to have the tape operations done as user "dumpuser" on host
"dumphost".  Then "yourhost root" just has to be in the .rhosts
file of "dumpuser".
________________________________________________________
Matt	     University		matt@oddjob.uchicago.edu
Crawford     of Chicago     {astrovax,ihnp4}!oddjob!matt

mkhaw@teknowledge-vaxc.ARPA (Mike Khaw) (09/14/87)

In article <13971@oddjob.UChicago.EDU> matt@oddjob.uchicago.edu (Stop calling me Fred) writes:
>"workstation", let's assume it's a sun.    :-)
>
>Use:
>	rdump 0uf dumphost.dumpuser:/dev/tapedev filesystem
>
>to have the tape operations done as user "dumpuser" on host
>"dumphost".  Then "yourhost root" just has to be in the .rhosts
>file of "dumpuser".

Matt,

You don't say which version of Sun Unix you have.  I tried this under
Release 3.2 and rdump complained about a "write error".  The tape was
online and NOT write-protected.

Also, neither the 3.2 nor 3.4 documentation on "rdump" says anything about
a username qualifier on the remote tape drive.

Mike Khaw
-- 
internet:  mkhaw@teknowledge-vaxc.arpa
usenet:	   {uunet|sun|ucbvax|decwrl|uw-beaver}!mkhaw%teknowledge-vaxc.arpa
USnail:	   Teknowledge Inc, 1850 Embarcadero Rd, POB 10119, Palo Alto, CA 94303

matt@oddjob.UChicago.EDU (Matt Crawford) (09/14/87)

I said:
) >Use:   rdump 0uf dumphost.dumpuser:/dev/tapedev filesystem

Mike Khaw writes:
) You don't say which version of Sun Unix you have.  I tried this under
) Release 3.2 and rdump complained about a "write error".
) Also, neither the 3.2 nor 3.4 documentation on "rdump" says anything about
) a username qualifier on the remote tape drive.

This works for me under 3.3 and 3.4.  It also worked for the person
who asked the original question.  True, the manual does not document
the ".username" part of the argument.  In fact, it even gets the
description wrong of what name has to be in which .rhosts file.
Unless this feature is new in 3.3, I don't know why it didn't work
for you.
			Matt Crawford

richl@penguin.USS.TEK.COM (Rick Lindsley) (09/18/87)

matt@oddjob.UChicago.EDU (Matt Crawford) wrote:
> ) >Use:   rdump 0uf dumphost.dumpuser:/dev/tapedev filesystem

Mike Khaw replied:
> ) You don't say which version of Sun Unix you have.  I tried this under
> ) Release 3.2 and rdump complained about a "write error".

matt@oddjob.UChicago.EDU (Matt Crawford) rereplied:
> Unless this feature is new in 3.3, I don't know why it didn't work
> for you.

Mike, it's possible that whatever non-root user you used couldn't open the
tape drive. Are your tape drives all world-writable, or could they have
been protected somehow?

Rick

mkhaw@teknowledge-vaxc.ARPA (Mike Khaw) (09/19/87)

in article <83@puffin.USS.TEK.COM>, richl@penguin.USS.TEK.COM (Rick Lindsley) says:
+--------------------
| matt@oddjob.UChicago.EDU (Matt Crawford) wrote:
|> ) >Use:   rdump 0uf dumphost.dumpuser:/dev/tapedev filesystem
| 
| Mike Khaw replied:
|> ) You don't say which version of Sun Unix you have.  I tried this under
|> ) Release 3.2 and rdump complained about a "write error".
| 
| matt@oddjob.UChicago.EDU (Matt Crawford) rereplied:
|> Unless this feature is new in 3.3, I don't know why it didn't work
|> for you.
| 
| Mike, it's possible that whatever non-root user you used couldn't open the
| tape drive. Are your tape drives all world-writable, or could they have
| been protected somehow?
| 
| Rick
+--------------------
Here's what I get from "ls -l /dev/*mt*':

brw-rw-rw-  1 root       8,   0 Jun 19 23:12 /dev/mt0
brw-rw-rw-  1 root       8,  12 Jun 19 23:12 /dev/mt12
brw-rw-rw-  1 root       8,   4 Jun 19 23:12 /dev/mt4
brw-rw-rw-  1 root       8,   8 Jun 19 23:12 /dev/mt8
brw-rw-rw-  1 root       8,   4 Jun 19 23:12 /dev/nmt0
brw-rw-rw-  1 root       8,  12 Jun 19 23:12 /dev/nmt8
crw-rw-rw-  1 root      30,   4 Jun 19 23:12 /dev/nrmt0
crw-rw-rw-  1 root      30,  12 Sep  1 14:19 /dev/nrmt8
crw-rw-rw-  1 root      30,   0 Jun 19 23:12 /dev/rmt0
crw-rw-rw-  1 root      30,  12 Aug 21 11:53 /dev/rmt12
crw-rw-rw-  1 root      30,   4 Jun 19 23:12 /dev/rmt4
crw-rw-rw-  1 root      30,   8 Aug  5 10:44 /dev/rmt8

(this is a 1/2" drive on a Pertec(?) VMEbus controller on a 3/160, and in
case anyone asks (again), yes, the tape had a write-enable ring in it, and
the front panel showed that it was at "load point" before I started rdump.)

Mike Khaw
-- 
internet:  mkhaw@teknowledge-vaxc.arpa
usenet:	   {uunet|sun|ucbvax|decwrl|uw-beaver}!mkhaw%teknowledge-vaxc.arpa
USnail:	   Teknowledge Inc, 1850 Embarcadero Rd, POB 10119, Palo Alto, CA 94303

mangler@cit-vax.Caltech.Edu (System Mangler) (09/21/87)

In article <13971@oddjob.UChicago.EDU>, matt@oddjob.UChicago.EDU (Matt Crawford) writes:
> Use:
>	rdump 0uf dumphost.dumpuser:/dev/tapedev filesystem

Try not to get too attached to this syntax; it is likely to change.
The "." separator makes it confusing to specify domain names.  In
4.3bsd, rcp changed its syntax to "user@host:file", and rdump is
likely to follow suit.

Don Speck   speck@vlsi.caltech.edu  {amdahl,rutgers}!cit-vax!speck