On Mon, May 15, 2000 at 06:34:25PM +0530, Kedar Patankar typed:
> > > ssh if you need security. get rid of securetty otherwise :)
>
> Well, securetty is still pretty much useless. It isn't necessary
> for the cracker to get a user login and then break root passwd. s/he can
> as well just sniff the n/w, to look for telnet packets containing the "su"
> command and the subsequent transactions to crack the root password.
Ahh.. now you're talking about crackers who have access to network
traffic.. ( In which case anyway the first 2 steps are compromised.. So
it doesn't make a difference. ) But I was talking about the majority of
crackers who can't get a sniff at network traffic that goes into your
box..
I agree that ssh is the way to go.. But I was comparing the *relative*
merits of allowing root login to disabling it..
Kala
-----------------------------------------------------------------------
LIH is all for free speech. But it was created for a purpose - to help
people discuss issues about installing and running Linux. If your
messages are counterproductive to this purpose, your privileges to
submit messages can and will be revoked.
