dan@rna.UUCP (Dan Ts'o) (06/22/84)
Hi, One reason I might do such a thing is to prevent passers-by from booting the system and getting a root shell. On my system, I replaced init's call to /bin/sh to /bin/login to achieve the same thing. I felt that the rare chance that /bin/login, /etc/passwd were corrupted but NOT /bin/sh was small compared to the value of not being able to get an easy root shell. Of course, if you are convinced that your computer room is absolutely safe from unauthorized access and that rebooting would be detected immediately, then this feature is less useful. Such is not the case in our environment, where persons knowledgible but NOT authorized to be root have access to the machine room. Making /bin/login the single-user command also aids in implementing an "operator" class of uids - people authorized to use certain commands such as fsck and dump but not become root. Cheers, Dan Ts'o ...cmcl2!rna!dan
guy@rlgvax.UUCP (Guy Harris) (06/23/84)
> Hi, > One reason I might do such a thing is to prevent passers-by from > booting the system and getting a root shell. On my system, I replaced > init's call to /bin/sh to /bin/login to achieve the same thing. I felt that > the rare chance that /bin/login, /etc/passwd were corrupted but NOT /bin/sh > was small compared to the value of not being able to get an easy root shell. Unfortunately, if the "su" process' UID is root, it won't ask for a password. This is nice in that it allows "root" to easily "su" to anybody, but it means that "/bin/su" won't ask for a password, so you'll still be able to boot the system and get a root shell. If I remember correctly, most PDP-11 and VAX-11 processors have keyswitches which can be put in a "disable" position that keeps anybody from rebooting them. If the key is left in the processor, a passerby can shut your machine down even if they can't reboot and get a root shell. Our micros have a keyswitch which controls the "boot" button, so again without a key a user can't do much. Guy Harris {seismo,ihnp4,allegra}!rlgvax!guy
wescott@ncrcae.UUCP (Mike Wescott) (06/25/84)
> If I remember correctly, most PDP-11 and VAX-11 processors have keyswitches > which can be put in a "disable" position that keeps anybody from rebooting > them. Nope, not really. On the VAX 11/750 one can reboot by putting the POWER ON ACTION switch to BOOT position and then power cycling the system using the brakers on the back of the cabinet. The keyswitch just disables the button. Mike Wescott NCR Corp. mcnc!ncsu!ncrcae!wescott
kae@ihuxl.UUCP (Alan Edwards) (06/26/84)
....
It seems to me that if you don't leave 'root' logged in on your console
terminal and you set your system's keylock switch (assuming you have one
as a VAX or similar hardware has) in the correct position and you TAKE THE
KEY, then you should not have problems? Of couse if you don't have and/or do
these, then I guess you do what you can. I'd hate to try to login as root
when /etc/passwd was trashed as was one of my experiences in the past. I
was glad single user came up as /bin/sh[root].
--
-Alan Edwards
IX 1C-423 x0879
(ihuxl!kae)mats@dual.UUCP (Mats Wichmann) (06/26/84)
> One reason I might do such a thing is to prevent passers-by from > booting the system and getting a root shell. But...., but....??? When rebooting, the system runs as superuser, so the `su' to `root' will always succeed - without asking for a password - so you get a superuser shell anyway. How does this make things any more secure? Incidentally, speaking of the S5 init, how many of you out there were aware of a neato init state executed BEFORE anything else is brought up, activated by the tag `sysinit' in your inittab? This one is real handy if there are commands that MUST be done before you even get a single-user shell - perhaps initializing some sort of user device or checking the root file system. I found this in the code while trying to solve a problem for someone here; turns out it exactly solved the problem - but I have not seen it documented anywhere (!surprise!). Mats Wichmann Dual Systems Corp. ...{ucbvax,amd70,ihnp4,cbosgd,decwrl,fortune}!dual!mats