On Sat, 17 Nov 2001, Aaron Konstam wrote: > Another NIS mystery. We assume shadow passwds are more secure > because the shadow file containing them is not world readable. > However, it seems if this is an NIS system all one needs to do > is execute: ypcat passwd > capturepw > and the file capturepw will contain a complete passwd file with > passwds included. Any comments?
Containing the "encrypted" passwords which would still need to be cracked. Also "man rpc.yppassword" makes mention of the fact that it's a bit non-sensical to have an /etc/shadow in the context of NIS. But then again, one only uses NIS in a "trusted" environment,no? I saw an interesting tidbit awhile ago whose basic premise was replacing the user/password management of NIS with a ssh solution. Seems like the was document related to an University. MIT I believe. _______________________________________________ Seawolf-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/seawolf-list
