1 |
On 05/02/10 16:13, Stefan Behte wrote: |
2 |
> Hi, |
3 |
> |
4 |
> in some environments you have to rename "root" to something else, just |
5 |
> to be compliant to a (maybe dumb) security policy. This might be the |
6 |
> case for PCI, and as far as I remember, it is necessary (not just |
7 |
> "recommended") for a BSI Grundschutz certification (meaning something |
8 |
> like "basic security protection") [1]. Unfortunately I didn't find the |
9 |
> exact link. |
10 |
|
11 |
Interesting... to me that's not only stupid but also kinda useless - there's no |
12 |
difference between brute-forcing a password for user named 'foo' or 'root' - |
13 |
user name doesn't matter much. Actually according to my ssh logs attackers |
14 |
usually don't even try root, they try other user account names way more often. |
15 |
Keep in mind that most compromised systems are used to send spam, take part in |
16 |
DoS attacks, etc - you don't need root to do that. Breaking into root account |
17 |
may actually be harmful as it may trip some security measures. |
18 |
|
19 |
It's better to disable password-based remote login altogether in sshd_config. |
20 |
Security by obscurity is a nice way to make pseudo-sys-admins feel warm and fuzzy :] |
21 |
|
22 |
> This might prevent or make usage of gentoo more complicated in those |
23 |
> environments, but is only a problem for a small fraction of our user base. |
24 |
> |
25 |
> Best regards, |
26 |
> |
27 |
> Craig |
28 |
> |
29 |
> |
30 |
> [1] |
31 |
> https://www.bsi.bund.de/cln_183/ContentBSI/EN/Publications/Bsi_standards/standards.html |
32 |
> |
33 |
> 30.04.2010 20:07, Michał Górny wrote: |
34 |
>> Hello, |
35 |
>> |
36 |
>> I would like to put an emphasis on the fact that many eclasses |
37 |
>> and ebuilds in gx86 are relying on an assumption that the superuser |
38 |
>> account is always supposed to be named 'root'. |
39 |
>> |
40 |
>> In fact, no such constraint exists. Although most users will never even |
41 |
>> think of changing the superuser account name, it is perfectly legit |
42 |
>> to do so, and to use any name for that account. Moreover, it is |
43 |
>> perfectly legit to name an unprivileged user 'root' too. |
44 |
>> |
45 |
>> Thus, the above assumption is clearly incorrect and may result in many |
46 |
>> issues with ebuilds using it. These range from builds failing because |
47 |
>> of chown 'invalid user' error to packages being installed with |
48 |
>> incorrect file ownership. |
49 |
>> |
50 |
>> From what I've heard already, similar problem has hit Gentoo/*BSD users |
51 |
>> already, with superuser group not being named 'root'. Although some |
52 |
>> files were fixed to properly use numeric GID in the specific case, |
53 |
>> no UID-related changes were done. |
54 |
>> |
55 |
>> Moreover, not all developers agree with the case being an issue, |
56 |
>> and they even refuse patches clearly fixing it [1]. Thus, I guess that |
57 |
>> a clear policy regarding referencing the superuser account should be |
58 |
>> enforced. |
59 |
>> |
60 |
>> In my opinion, that policy should clearly indicate that the numeric |
61 |
>> UID/GID should be always used for referencing the superuser account |
62 |
>> as they are fixed unlike the names. |
63 |
>> |
64 |
>> [1] http://bugs.gentoo.org/show_bug.cgi?id=315779 |
65 |
>> |
66 |
> |
67 |
> |
68 |
> |
69 |
|
70 |
|
71 |
-- |
72 |
Krzysztof Pawlik <nelchael at gentoo.org> key id: 0xF6A80E46 |
73 |
desktop-misc, java, apache, ppc, vim, kernel, python... |