Jack Woehr wrote:
Alan Altmark wrote:
Marcy's question wasn't unreasonable and neither is the policy to remove
unnecessary account ...
But to implement the policy, *someone* has to be the
arbiter of "necessary", and I don't think it should be the system that's
being audited!
In the specific instance, most estimable Alan, your general guidance is
wrong.
Marcy was asking for help in deleting accounts she did not know the
purpose of,
/and/ the system /is/ the arbiter in that these system accounts own
system files
which are orphaned if the system accounts are deleted.
In a worst-case scenario (that's what security planning is about, right?)
1. ftp system files are orphaned by deleting the account
2. a user account re-using the uid number for the vanished ftp
account is accidentally created
3. Joe User gets control of FTP.
A user account will not be created with a defunct system account's UID.
What is more likely is that a new user account might get the UID of a
removed user account and so win some orphaned files.
I don't know whether it's defined behaviour, but on RHL and successors,
if I add a new user account (as I do) in kickstart with a specific UID
(as I do), then subsequent new accounts get ever-increasing UIDs.
Given that I remember when OS/VS and VSAM were new, and how
mind-bogglingly large VSAM files could be (4 Gbytes for those less
senior), I will not assume UIDs will never wrap again.
--
Cheers
John
-- spambait
[email protected] [email protected]
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
You cannot reply off-list:-)
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
