Re: Using etcupdate resolve, was Re: Surprise null root password

2023-06-15 Thread bob prohaska
I want to thank Patrick, Dmitry and Mark for providing orientation sufficient to make some headway. The Handbook simply says "If etcupdate(8) is not able to merge a file automatically, the merge conflicts can be resolved with manual interaction by issuing: # etcupdate resolve While not

RE: Using etcupdate resolve, was Re: Surprise null root password

2023-06-15 Thread Mark Millard
[Note: In this 2nd try, I've indented everything by a tab to help avoid reinterpretation/reformatting of some of the text.] I'm going to comment about the notations mean, not about that the specific type of file is not one you would be likely to have other than sn

Re: Using etcupdate resolve, was Re: Surprise null root password

2023-06-15 Thread Dimitry Andric
On 15 Jun 2023, at 19:26, bob prohaska wrote: > > Here's an example of the puzzles faced when using etcupdate > that have so far proved baffling: > > On running etcupdate resolve, the system reports > > Resolving conflict in '/etc/mtree/BSD.tests.dist': > Select: (p) postpone, (df) diff-full,

Re: Using etcupdate resolve, was Re: Surprise null root password

2023-06-15 Thread Patrick M. Hausen
Hi, > Am 15.06.2023 um 19:26 schrieb bob prohaska : > The puzzle at this point is what to do. It's looks like the > points of interest are the lines marked "yours" and "new", > but I'll admit to bafflement which to modify and whether > the modifications needed include the and >

Using etcupdate resolve, was Re: Surprise null root password

2023-06-15 Thread bob prohaska
Here's an example of the puzzles faced when using etcupdate that have so far proved baffling: On running etcupdate resolve, the system reports Resolving conflict in '/etc/mtree/BSD.tests.dist': Select: (p) postpone, (df) diff-full, (e) edit, (h) help for more options: df ---

Re: Surprise null root password

2023-05-31 Thread David Chisnall
On 30/05/2023 20:11, Dag-Erling Smørgrav wrote: David Chisnall writes: There was a very nasty POLA violation a release or two ago. OpenSSH defaults to disallowing empty passwords and so having a null password was a convenient way of allowing people to su or locally log into that user but

Re: Surprise null root password

2023-05-31 Thread Alexander Leidinger
Quoting bob prohaska (from Tue, 30 May 2023 08:36:21 -0700): I suggest to review changes ("df" instead of "tf" in etcupdate) to at least those files which you know you have modified, including the password/group stuff. After that you can decide if the diff which is shown with "df" can be

Re: Surprise null root password

2023-05-30 Thread Mark Millard
On May 30, 2023, at 18:39, bob prohaska wrote: > On Tue, May 30, 2023 at 11:02:13AM -0700, Mark Millard wrote: >> bob prohaska wrote on >> Date: Tue, 30 May 2023 15:36:21 UTC : >> >>> On Tue, May 30, 2023 at 08:41:33AM +0200, Alexander Leidinger wrote: Quoting bob prohaska (from

Re: Surprise null root password

2023-05-30 Thread bob prohaska
On Tue, May 30, 2023 at 11:02:13AM -0700, Mark Millard wrote: > bob prohaska wrote on > Date: Tue, 30 May 2023 15:36:21 UTC : > > > On Tue, May 30, 2023 at 08:41:33AM +0200, Alexander Leidinger wrote: > > > > > > Quoting bob prohaska (from Fri, 26 May 2023 16:26:06 > > > -0700): > > > > > > >

Re: Surprise null root password

2023-05-30 Thread Marek Zarychta
W dniu 26.05.2023 o 19:35, bob prohaska pisze: While going through normal security email from a Pi2 running -current I was disturbed to find: Checking for passwordless accounts: root::0:0::0:0:Charlie &:/root:/bin/sh This thread reminded me of another issue with passwords I encountered a few

Re: Surprise null root password

2023-05-30 Thread Dag-Erling Smørgrav
David Chisnall writes: > There was a very nasty POLA violation a release or two ago. OpenSSH > defaults to disallowing empty passwords and so having a null password > was a convenient way of allowing people to su or locally log into that > user but disallowing ssh. This option does not work in

Re: Surprise null root password

2023-05-30 Thread Mark Millard
bob prohaska wrote on Date: Tue, 30 May 2023 15:36:21 UTC : > On Tue, May 30, 2023 at 08:41:33AM +0200, Alexander Leidinger wrote: > > > > Quoting bob prohaska (from Fri, 26 May 2023 16:26:06 > > -0700): > > > > > On Fri, May 26, 2023 at 10:55:49PM +0200, Yuri wrote: > > > > > > > > The

Re: Surprise null root password

2023-05-30 Thread Yetoo
On Tue, May 30, 2023 at 8:36 AM bob prohaska wrote: > > On Tue, May 30, 2023 at 08:41:33AM +0200, Alexander Leidinger wrote: > > > > Quoting bob prohaska (from Fri, 26 May 2023 16:26:06 > > -0700): > > > > > On Fri, May 26, 2023 at 10:55:49PM +0200, Yuri wrote: > > > > > > > > The question is

Re: Surprise null root password

2023-05-30 Thread bob prohaska
On Tue, May 30, 2023 at 08:41:33AM +0200, Alexander Leidinger wrote: > > Quoting bob prohaska (from Fri, 26 May 2023 16:26:06 > -0700): > > > On Fri, May 26, 2023 at 10:55:49PM +0200, Yuri wrote: > > > > > > The question is how you update the configuration files, > > >

Re: Surprise null root password

2023-05-30 Thread Alexander Leidinger
Quoting bob prohaska (from Fri, 26 May 2023 16:26:06 -0700): On Fri, May 26, 2023 at 10:55:49PM +0200, Yuri wrote: The question is how you update the configuration files, mergemaster/etcupdate/something else? Via etcupdate after installworld. In the event the system requests manual

Re: Surprise null root password

2023-05-27 Thread Rodney W. Grimes
> It turns out all seven hosts in my cluster report > a null password for root in /usr/src/etc/master.passwd: > root::0:0::0:0:Charlie &:/root:/bin/sh > > Is that intentional? No, but I suspect your build/update procedures are infact telling the system to do this. Someone else pointed out

Re: Surprise null root password

2023-05-27 Thread Rodney W. Grimes
> On 26 May 2023, at 12:35, bob prohaska wrote: > > > While going through normal security email from a Pi2 > > running -current I was disturbed to find: > > > > Checking for passwordless accounts: > > root::0:0::0:0:Charlie &:/root:/bin/sh > > > > The machine had locked up on a -j4 buildworld

Re: Surprise null root password

2023-05-27 Thread David Chisnall
On 27 May 2023, at 03:52, Mike Karels wrote: > > On 26 May 2023, at 21:28, bob prohaska wrote: > >> It turns out all seven hosts in my cluster report >> a null password for root in /usr/src/etc/master.passwd: >> root::0:0::0:0:Charlie &:/root:/bin/sh >> >> Is that intentional? > > Well, it

Re: Surprise null root password

2023-05-26 Thread Mike Karels
On 26 May 2023, at 21:28, bob prohaska wrote: > It turns out all seven hosts in my cluster report > a null password for root in /usr/src/etc/master.passwd: > root::0:0::0:0:Charlie &:/root:/bin/sh > > Is that intentional? Well, it has been that way in FreeBSD since 1993, and in BSD since 1980

Re: Surprise null root password

2023-05-26 Thread bob prohaska
It turns out all seven hosts in my cluster report a null password for root in /usr/src/etc/master.passwd: root::0:0::0:0:Charlie &:/root:/bin/sh Is that intentional? Thanks for reading, bob prohaska

Re: Surprise null root password

2023-05-26 Thread Tomoaki AOKI
On Fri, 26 May 2023 16:26:06 -0700 bob prohaska wrote: > On Fri, May 26, 2023 at 10:55:49PM +0200, Yuri wrote: > > > > The question is how you update the configuration files, > > mergemaster/etcupdate/something else? > > > > Via etcupdate after installworld. In the event the system > requests

Re: Surprise null root password

2023-05-26 Thread bob prohaska
On Fri, May 26, 2023 at 10:55:49PM +0200, Yuri wrote: > > The question is how you update the configuration files, > mergemaster/etcupdate/something else? > Via etcupdate after installworld. In the event the system requests manual intervention I accept "theirs all". It seems odd if that can null

Re: Surprise null root password

2023-05-26 Thread Yuri
bob prohaska wrote: > On Fri, May 26, 2023 at 07:48:04PM +0100, Ben Laurie wrote: >> -T on ls will give you full time resolution... >> > More's the wonder: > root@www:/usr/src # ls -lT /etc/*p*wd* > -rw--- 1 root wheel 2099 May 10 17:20:33 2023 /etc/master.passwd > -rw-r--r-- 1 root

Re: Surprise null root password

2023-05-26 Thread bob prohaska
On Fri, May 26, 2023 at 07:48:04PM +0100, Ben Laurie wrote: > -T on ls will give you full time resolution... > More's the wonder: root@www:/usr/src # ls -lT /etc/*p*wd* -rw--- 1 root wheel 2099 May 10 17:20:33 2023 /etc/master.passwd -rw-r--r-- 1 root wheel 1831 May 10 17:20:33 2023

Re: Surprise null root password

2023-05-26 Thread Ben Laurie
-T on ls will give you full time resolution... On Fri, 26 May 2023 at 19:45, bob prohaska wrote: > On Fri, May 26, 2023 at 01:03:19PM -0500, Mike Karels wrote: > > On 26 May 2023, at 12:35, bob prohaska wrote: > > > > > While going through normal security email from a Pi2 > > > running -current

Re: Surprise null root password

2023-05-26 Thread bob prohaska
On Fri, May 26, 2023 at 01:03:19PM -0500, Mike Karels wrote: > On 26 May 2023, at 12:35, bob prohaska wrote: > > > While going through normal security email from a Pi2 > > running -current I was disturbed to find: > > > > Checking for passwordless accounts: > > root::0:0::0:0:Charlie

Re: Surprise null root password

2023-05-26 Thread Mike Karels
On 26 May 2023, at 12:35, bob prohaska wrote: > While going through normal security email from a Pi2 > running -current I was disturbed to find: > > Checking for passwordless accounts: > root::0:0::0:0:Charlie &:/root:/bin/sh > > The machine had locked up on a -j4 buildworld since > sending the

Surprise null root password

2023-05-26 Thread bob prohaska
While going through normal security email from a Pi2 running -current I was disturbed to find: Checking for passwordless accounts: root::0:0::0:0:Charlie &:/root:/bin/sh The machine had locked up on a -j4 buildworld since sending the mail, so it was taken off the net, power cycled and started