Bug#768020: [Pkg-shadow-devel] Bug#768020: Missing /dev/ttySC* entries in /etc/securetty
On Tue, Nov 4, 2014 at 6:31 PM, Mike Frysinger vap...@gentoo.org wrote:
On 04 Nov 2014 10:04, Geert Uytterhoeven wrote:
Package: login
Version: 1:4.2-2+b1
/etc/securetty contains the following /dev/ttySC* entries:
| # SCI serial port (SuperH) ports and SC26xx serial ports
| ttySC0
| ttySC1
| ttySC2
| ttySC3
Some Renesas ARM-based SH-Mobile development boards have the
serial console on ttySC4 or ttySC6, or a secondary console on ttySC7.
At least one SH-based board has its serial console on ttySC5.
Can you please add entries ttySC[4-9]?
there's a lot of boards with a lot of different serial devices. i'm not sure
every possibility should be hardcoded ? every distro is duplicating this work
too and maintaining their own random full list. can't we do better here ?
Unfortunately, due to the only real 16550 serial ports can be called ttyS%u
rule...
perhaps the default should be to not have an /etc/securetty at all ? if the
system is configured to launch getty on a tty, then in today's world, it means
it's a local device right ? if you have physical access to something, and
know
It may still be connected to a modem, waiting for incoming calls...
the root password, what exactly is this protecting the system from ?
/etc/securetty is not meant to prevent privileged people from getting in,
but to protect the system against eavesdropping on unsecure lines
(.e.g. out-of-the-building serial cables and modem lines).
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- ge...@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say programmer or something like that.
-- Linus Torvalds
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#768020: [Pkg-shadow-devel] Bug#768020: Missing /dev/ttySC* entries in /etc/securetty
On 05 Nov 2014 09:16, Geert Uytterhoeven wrote: On Tue, Nov 4, 2014 at 6:31 PM, Mike Frysinger vap...@gentoo.org wrote: On 04 Nov 2014 10:04, Geert Uytterhoeven wrote: Package: login Version: 1:4.2-2+b1 /etc/securetty contains the following /dev/ttySC* entries: | # SCI serial port (SuperH) ports and SC26xx serial ports | ttySC0 | ttySC1 | ttySC2 | ttySC3 Some Renesas ARM-based SH-Mobile development boards have the serial console on ttySC4 or ttySC6, or a secondary console on ttySC7. At least one SH-based board has its serial console on ttySC5. Can you please add entries ttySC[4-9]? there's a lot of boards with a lot of different serial devices. i'm not sure every possibility should be hardcoded ? every distro is duplicating this work too and maintaining their own random full list. can't we do better here ? Unfortunately, due to the only real 16550 serial ports can be called ttyS%u rule... i'm aware (having written merged some serial drivers myself). my point was to improve things by default in userland. perhaps the default should be to not have an /etc/securetty at all ? if the system is configured to launch getty on a tty, then in today's world, it means it's a local device right ? if you have physical access to something, and know It may still be connected to a modem, waiting for incoming calls... how many of these systems legitimately exist anymore ? we shouldn't be handicapping the majority of users for an extreme edge case. if those people want to set up securetty, they can create the file themselves. the root password, what exactly is this protecting the system from ? /etc/securetty is not meant to prevent privileged people from getting in, but to protect the system against eavesdropping on unsecure lines (.e.g. out-of-the-building serial cables and modem lines). how does securetty prevent that ? you can log in as non-root and then sudo. or try and leverage a known security vuln to escalate that non-root account. any perceived security provided by securetty is an illusion. -mike signature.asc Description: Digital signature
Bug#768020: [Pkg-shadow-devel] Bug#768020: Missing /dev/ttySC* entries in /etc/securetty
On Wed, Nov 5, 2014 at 4:49 PM, Mike Frysinger vap...@gentoo.org wrote:
perhaps the default should be to not have an /etc/securetty at all ? if
the
system is configured to launch getty on a tty, then in today's world, it
means
it's a local device right ? if you have physical access to something, and
know
It may still be connected to a modem, waiting for incoming calls...
how many of these systems legitimately exist anymore ? we shouldn't be
handicapping the majority of users for an extreme edge case. if those people
want to set up securetty, they can create the file themselves.
the root password, what exactly is this protecting the system from ?
/etc/securetty is not meant to prevent privileged people from getting in,
but to protect the system against eavesdropping on unsecure lines
(.e.g. out-of-the-building serial cables and modem lines).
how does securetty prevent that ? you can log in as non-root and then sudo.
or
try and leverage a known security vuln to escalate that non-root account. any
perceived security provided by securetty is an illusion.
Ah, sudo is a recent invention ;-)
But you're right, /etc/securetty has little value these days.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- ge...@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say programmer or something like that.
-- Linus Torvalds
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#768020: [Pkg-shadow-devel] Bug#768020: Missing /dev/ttySC* entries in /etc/securetty
On 05 Nov 2014 17:35, Geert Uytterhoeven wrote: On Wed, Nov 5, 2014 at 4:49 PM, Mike Frysinger wrote: perhaps the default should be to not have an /etc/securetty at all ? if the system is configured to launch getty on a tty, then in today's world, it means it's a local device right ? if you have physical access to something, and know It may still be connected to a modem, waiting for incoming calls... how many of these systems legitimately exist anymore ? we shouldn't be handicapping the majority of users for an extreme edge case. if those people want to set up securetty, they can create the file themselves. the root password, what exactly is this protecting the system from ? /etc/securetty is not meant to prevent privileged people from getting in, but to protect the system against eavesdropping on unsecure lines (.e.g. out-of-the-building serial cables and modem lines). how does securetty prevent that ? you can log in as non-root and then sudo. or try and leverage a known security vuln to escalate that non-root account. any perceived security provided by securetty is an illusion. Ah, sudo is a recent invention ;-) `su` isn't though, and i don't think `su` enforces securetty ? it's only at `login` time ? But you're right, /etc/securetty has little value these days. i guess this is something we need to encourage each distro to do as i don't think the upstream shadow package already ships this behavior by default. i'll update Gentoo after i double check the behavior and see if anyone notices :). -mike signature.asc Description: Digital signature
Bug#768020: Missing /dev/ttySC* entries in /etc/securetty
Package: login
Version: 1:4.2-2+b1
/etc/securetty contains the following /dev/ttySC* entries:
| # SCI serial port (SuperH) ports and SC26xx serial ports
| ttySC0
| ttySC1
| ttySC2
| ttySC3
Some Renesas ARM-based SH-Mobile development boards have the
serial console on ttySC4 or ttySC6, or a secondary console on ttySC7.
At least one SH-based board has its serial console on ttySC5.
Can you please add entries ttySC[4-9]?
Thanks!
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- ge...@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say programmer or something like that.
-- Linus Torvalds
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#768020: [Pkg-shadow-devel] Bug#768020: Missing /dev/ttySC* entries in /etc/securetty
On 04 Nov 2014 10:04, Geert Uytterhoeven wrote: Package: login Version: 1:4.2-2+b1 /etc/securetty contains the following /dev/ttySC* entries: | # SCI serial port (SuperH) ports and SC26xx serial ports | ttySC0 | ttySC1 | ttySC2 | ttySC3 Some Renesas ARM-based SH-Mobile development boards have the serial console on ttySC4 or ttySC6, or a secondary console on ttySC7. At least one SH-based board has its serial console on ttySC5. Can you please add entries ttySC[4-9]? there's a lot of boards with a lot of different serial devices. i'm not sure every possibility should be hardcoded ? every distro is duplicating this work too and maintaining their own random full list. can't we do better here ? perhaps the default should be to not have an /etc/securetty at all ? if the system is configured to launch getty on a tty, then in today's world, it means it's a local device right ? if you have physical access to something, and know the root password, what exactly is this protecting the system from ? no one uses telnet anymore. if you are, then you deserve to have your system owned :). are there any other services that go through `login` ? -mike signature.asc Description: Digital signature
