[Fink-devel] new user branch
I have started a new fink branch to auto add and remove users/groups. I'd like to vote on the field style for this. Type 1: User: Name: postfix Desc: Postfix User Pass: password Shell: /usr/bin/false Home: %p/var/mail Group: Name: postfix Desc: SMTP group Pass: password or type 2: User: postfix:Postfix User:password:/usr/bin/false:%p/var/mail Group: postfix:SMTP Group:password in both cases password can be left out to auto gen one. in the first case just leave the whole tag out in the second leave it blank so user would be name:desc::shell:home shell can also be left out and will default to /usr/bin/false --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel
Re: [Fink-devel] new user branch
What happens if two packages specify the same user? Even if this is OK, what happens if they give different info about that user? -- Dave --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel
Re: [Fink-devel] new user branch
Am I missing something? I don't understand why you have a Pass field at all. Default passwords are evil, and are an obvious route for attackers. Perhaps Pass should be a flag to indicate that Fink should prompt the user for a password? That's still rotten, IMHO, but infinitely better than having default passwords. The usual procedure is to use * as the crypted password for daemon accounts, indicating that nobody may log in using that account directly. IIRC, a blank password crypt usually means that no password is required for login, yes? That would be very bad. Chris On Monday, August 11, 2003, at 09:36 AM, TheSin wrote: I have started a new fink branch to auto add and remove users/groups. I'd like to vote on the field style for this. Type 1: User: Name: postfix Desc: Postfix User Pass: password Shell: /usr/bin/false Home: %p/var/mail Group: Name: postfix Desc: SMTP group Pass: password or type 2: User: postfix:Postfix User:password:/usr/bin/false:%p/var/mail Group: postfix:SMTP Group:password in both cases password can be left out to auto gen one. in the first case just leave the whole tag out in the second leave it blank so user would be name:desc::shell:home shell can also be left out and will default to /usr/bin/false --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/ direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel -- Chris Dolan, Software Developer, Clotho Advanced Media Inc. [EMAIL PROTECTED], 294-7900, 211 S Paterson, Madison WI 53703 --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel
Re: [Fink-devel] new user branch
I still haven't looked at how debian handles this problem either, and I agree that a default password in a public clear text file is a bad idea, specially if the user needs a valid shell. That is why i figure fink could build it's own pass but then there would be no way of knowing the pass which could be bad for a program where you need to know the pass. I could easily ask the user for a pass but that breaks fink goal of the least interaction possible. Thought it might be the only alternative, that or I run a 'passwd user' at the end of the postinst script? but this is why I'm posting the list, I need ideas for this sort of thing, I have most of the major stuff worked out, like not needed a db for uids, and keeping the debs identical, but some parts like the passwd field and how to modify, ie: two pkgs need the same user with different info. but I'm sure all this can be worked out. IMHO it'll be better then the current methode while has passwords and such in a file and all users are added whether you use them or not. Plus it's a pain for maintainers to add users/groups ATM. maybe making the passwd an MD5 field, so it's not clear text at least? On Monday, August 11, 2003, at 11:40 AM, Chris Dolan wrote: Am I missing something? I don't understand why you have a Pass field at all. Default passwords are evil, and are an obvious route for attackers. Perhaps Pass should be a flag to indicate that Fink should prompt the user for a password? That's still rotten, IMHO, but infinitely better than having default passwords. The usual procedure is to use * as the crypted password for daemon accounts, indicating that nobody may log in using that account directly. IIRC, a blank password crypt usually means that no password is required for login, yes? That would be very bad. Chris --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel
Re: [Fink-devel] new user branch
Sorry, i see your other messages now, I see you took the clue stick. :) -Ben On Tuesday, August 12, 2003, at 09:56 PM, Ben Hines wrote: On Monday, August 11, 2003, at 07:36 AM, TheSin wrote: I have started a new fink branch to auto add and remove users/groups. I'd like to vote on the field style for this. You are aware all fink installs need to have the same uids for the same users, yes? (because we support combining binary and source installs) Unless there is some dpkg way around it that you know of. There is really no getting around a central database of the needed users, maintained in one place.. I don't think it will be possible with package fields. And as others have stated, currently fink users can't log in and have no password, they are daemon accounts. They don't need passwords and aren't for logging in at all. -Ben --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/ direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel
Re: [Fink-devel] new user branch
On Monday, August 11, 2003, at 07:36 AM, TheSin wrote: I have started a new fink branch to auto add and remove users/groups. I'd like to vote on the field style for this. You are aware all fink installs need to have the same uids for the same users, yes? (because we support combining binary and source installs) Unless there is some dpkg way around it that you know of. There is really no getting around a central database of the needed users, maintained in one place.. I don't think it will be possible with package fields. And as others have stated, currently fink users can't log in and have no password, they are daemon accounts. They don't need passwords and aren't for logging in at all. -Ben --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel
Re: [Fink-devel] new user branch
TheSin wrote: name:desc::shell:home Why change the default order, name:pass:desc:home:shell? This leads to unnecessary confusion. And group:pass:members. I'll second Chris; Why a password field at all? All the users Fink defines so far are non-login users that have '*' as password. -- Martin --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel
Re: [Fink-devel] new user branch
TheSin said: but this is why I'm posting the list, I need ideas for this sort of thing, I have most of the major stuff worked out, like not needed a db for uids I must have missed this-- how does this work? (or do I have to UTSL?) On Monday, August 11, 2003, at 11:40 AM, Chris Dolan wrote: Am I missing something? I don't understand why you have a Pass field at all. Default passwords are evil, and are an obvious route for attackers. Perhaps Pass should be a flag to indicate that Fink should prompt the user for a password? That's still rotten, IMHO, but infinitely better than having default passwords. The usual procedure is to use * as the crypted password for daemon accounts, indicating that nobody may log in using that account directly. IIRC, a blank password crypt usually means that no password is required for login, yes? That would be very bad. I have to agree with Chris on this one. I can't think of a single fink package that would initially require a non-locked password. (Well, maybe some databases need one for initial access to their own access control lists-- I haven't checked-- but that's different than the system password database.) The pseudo-accounts required by these packages are only for separation of privileges, not for logins. Usually, the account is used by a process which starts off running as root, and immediately switches to an unprivileged pseudo-account to minimize potential damage. Locking the password (* in the crypt field-- no Unix crypt() function should ever return * for a hash) does not prevent privilege separation from working, and has the added benefit of keeping the account secure. -- Charles Lepple [EMAIL PROTECTED] http://www.ghz.cc/charles/ --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Fink-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-devel
