Xref: utzoo alt.security:1518 alt.bbs:2907 comp.unix.sysv386:298 Path: utzoo!utgpu!cs.utexas.edu!usc!snorkelwacker!bloom-beacon!mcgill-vision!quiche!mikey From: mikey@quiche.cs.mcgill.ca (Michael GALLOP) Newsgroups: alt.security,alt.bbs,comp.unix.sysv386 Subject: Re: Protecting against downloads Message-ID: <3952@quiche.cs.mcgill.ca> Date: 13 Sep 90 04:08:58 GMT References: <22@tdw205.ed.ray.com> Followup-To: alt.security Organization: SOCS - Mcgill University, Montreal, Canada Lines: 45 In article ralphs@halcyon.wa.com (Ralph Sims) writes: >heiser@sud509.ed.ray.com (Bill Heiser - Unix Sys Admin) writes: > >> A *ix sysop I communite with recently told me that he'd caught one of >> his "shell-access" users downloading *ix binaries. Since I'm getting Fat lot of good that would do joe user. Remember, first off that this is not the DOS world. Those binaries aren't portable. What runs on a SUN has trouble running on other SUNs. So I don't think the kid who downloads /usr/bin is going to have much use for them. Now if it is and i386 UNIX maybe they might be useful >> As far as I can see, we either have to trust the users that we give >> shell access to, or make kermit/sz, etc unavailable to them. I guess >> we could just make downloads only available thru the "bbs", rather than >> from the shell ... > >How 'bout privileges on the files? If the user didn't have read permission, >then he wouldn't have got them (maybe? I don't speak unix, but I'm sure >someone will follow through on this. Exactly, what you can do is: chmod 711 /usr/bin/* Which produces (I think :-)) rwx--x--x on every file in /usr/bin >> Anyone else have any ideas on this? How do you all deal with this? Further, any file they may download is useless (see above :-)) But also the files they need to export them to another system, are, by default locked. I.e. /usr/sys/conf on SYSV and /usr/Sun4/sys/conf/MachineName on SunOs. Without those well... While I'm rambling, even if those directories are open, just about all machine these days is sold with UNIX Manuals and support so.... I guess to deal with this, you could hack a copy of rsh, make sure your users aren't root and put a filter in when you compile sz have it get the current directory and then if it is in /usr or /lib or /etc and not tmp then abort..... -- | mikey@quiche.cs.mcgill.ca | Mike Gallop | |"Stealing from one author is plagarism....Stealing from many is research" | I shall walk through the valley of Death and I shall fear no evil....... ..Except, perhaps, a sadistics assignment