Colin Watson <[email protected]> writes: > It worries me a bit that this breaks amanda. I think this is the main > thing holding me back from closing #734946. Russ, you have more > experience of dealing with security audits that pick this up than I do; > what would you think of flipping the backup user's shell back to > /bin/sh? I don't see an obvious way to override this for amanda the way > we did for the various things that used su and broke with the change of > default shells.
It's not a good idea if we can avoid it. The problem from an audit perspective is that, to support a package that the vast majority of installations don't use, one is creating a valid account that an attacker could authenticate to. Yes, it has a locked password, but there are various ways that can be bypassed depending on what the local PAM configuration is. If Amanda needs a user with a valid shell, it should really be creating its own _amanda user and using that instead. I realize that may be easier said than done. That said, the new debconf prompting means that I can change the shell for the backup user (or, more likely, just delete that user entirely) on all of my systems and have upgrades of base-passwd not revert that change, so I at least now have a mechanism to avoid audit problems that isn't as annoying as it was previously. So I can cope with that. -- Russ Allbery ([email protected]) <http://www.eyrie.org/~eagle/> -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
