Response redirected to vox-tech ... please ask technical questions there. On Tue, 19 Nov 2002, karthikeyan wrote:
> Hi, > > Today morning when i was doing an ssh. I was surprised that normal user > can also do an SSH on our server if they know the port and can see all > files. Most, but not all, files on a *nix system are world-readable. Common exceptions are logfiles (/var/log/*). If they are able to read the system logfiles, confirm that the only username in your /etc/passwd file that has a UID of zero is "root", and check the permissions on the logfiles. > What am i missing here they dont belong to root group. Perhaps you should read the System Administrator's Guide about permissions. (http://www.tldp.org/guides.html) > With FTP login they cant see files but yes if they know the port and > can do a SSH files they are able to see everything. How do i fix this > issue. Change permissions on the files and directories you don't want them to be able to see, or don't give them SSH access. Be careful though... changing permissions globally without understanding the consequences can cause your system to stop functioning. FTP and HTTP servers are (supposed to be) designed to limit your access to files in certain directories. SSH is designed for allowing people to log in without disclosing the contents of their communications with the system to monitors along the way... logging in gives them much more access to the system, and the reason it is so important that their communications be private is that you don't want to expose that information to unknown people. That implies that you know the people you give SSH access to, and that you maintain permissions to limit their access appropriately. --------------------------------------------------------------------------- Jeff Newmiller The ..... ..... Go Live... DCN:<[EMAIL PROTECTED]> Basics: ##.#. ##.#. Live Go... Live: OO#.. Dead: OO#.. Playing Research Engineer (Solar/Batteries O.O#. #.O#. with /Software/Embedded Controllers) .OO#. .OO#. rocks...2k --------------------------------------------------------------------------- _______________________________________________ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
