Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!wuarchive!gem.mps.ohio-state.edu!ginosko!uunet!crdgw1!montnaro From: montnaro@sprite.crd.ge.com (Skip Montanaro) Newsgroups: comp.unix.wizards Subject: Re: What should go into a security-checking shell script? Message-ID: Date: 23 Oct 89 18:24:49 GMT References: <363@nisca.ircc.ohio-state.edu> Sender: news@crdgw1.crd.ge.com Reply-To: (Skip Montanaro) Distribution: usa Organization: GE Corporate Research & Development, Schenectady, NY Lines: 11 In-reply-to: bernstei@hpuxa.ircc.ohio-state.edu's message of 22 Oct 89 22:50:31 GMT I've been thinking about this topic recently. While I can't rattle off a list of shoulds and shouldn'ts, you might take a look at Bruce Spence's paper in the proceedings of latest USENIX workshop on administering large systems. He described a program (actually a shell script) called 'spy' which looked at a number of things, such as badly formatted /etc/passwd files, writable .rhost files, and so forth. I'd give you more details, but I can't find my copy of the proceedings at the moment. I'm sure others on the net can elaborate. -- Skip Montanaro (montanaro@crdgw1.ge.com)