[comp.sys.next] watch out

wytten@cs.umn.edu (Dale R. Wyttenbach) (03/20/90)

I just realized that I had a user '+' with uid 0 on each of my
machines, with no password.

This must be because I followed the example of the niload man page
and typed:

niload passwd . < /etc/passwd

The last line in /etc/passwd was '+', which is Sun for 'insert
data from yellow-pages database here'.

dale wyttenbach
reluctant NeXT administrator
wytten@cs.umn.edu

mark@Jhereg.Minnetech.MN.ORG (Mark H. Colburn) (03/20/90)

In article <1990Mar20.025019.6526@cs.umn.edu> wytten@cs.umn.edu (Dale R. Wyttenbach) writes:
>I just realized that I had a user '+' with uid 0 on each of my
>machines, with no password.
>This must be because I followed the example of the niload man page
>and typed:
>niload passwd . < /etc/passwd
>The last line in /etc/passwd was '+', which is Sun for 'insert
>data from yellow-pages database here'.

It is also quite possible that the line was inserted by vipw, if you
used it to edit the passwd file in the first place.  Vipw attempts to
be more careful about how it handles passwd file updates to assure
that the password information does not get lost, but it has some
pretty nasty bugs that actually do worse things than it saves you
from.  Few people actually use it in a production environment.

The symptom above is known to happen with some versions of vipw and
Yellow Pages.



-- 
Mark H. Colburn                     If you don't make money off of it,
Open Systems Architects, Inc.	    it had better be either a religious
mark@Minnetech.MN.ORG		    experience or a hobby. 
							- Lance Cooper