Re: setuid root hole... oops!

[Ken Williams]

John W Baxter <[EMAIL PROTECTED]> wrote:
> So far, I haven't found a need to "enable" root (I root about as a basic
> part of my job, on other machines).  So the only way for me to "be"
> root--as opposed to getting the power via sudo--is to exploit this
> really annoying hole.

There's not much distinction, since you can execute the command "sudo su" 
and get a root prompt.  The default setup might be a slight bit more 
secure than actually allowing root to log in directly, but not much.

A more secure situation would be to give only certain specific powers to 
each sudoer.  Personally I haven't cared enough to do this, since the 
hassle would outweigh the benefits in my case.  And if someone malicious 
gains physical access to my machine, I have bigger problems to worry 
about, like "how come I suddenly have enemies who are breaking into my 
apartment?" or "who stole my iBook?". =)

 -Ken