Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!uunet!seismo!sundc!rlgvax!vrdxhq!umd5!mimsy!chris
From: chris@mimsy.UUCP (Chris Torek)
Newsgroups: comp.unix.wizards
Subject: Re: NFS and many thousands of user-id's
Message-ID: <9227@mimsy.UUCP>
Date: Thu, 5-Nov-87 21:35:48 EST
Article-I.D.: mimsy.9227
Posted: Thu Nov  5 21:35:48 1987
Date-Received: Sun, 8-Nov-87 10:49:11 EST
References: <7605@g.ms.uky.edu> <7623@e.ms.uky.edu>
Organization: U of Maryland, Dept. of Computer Science, Coll. Pk., MD 20742
Lines: 24

In article <7623@e.ms.uky.edu> david@ms.uky.edu (David Herron --
Resident E-mail Hack) writes:
>Many people have told me that root -> uid -2 across NFS. ... that is
>NOT what I had meant. ... You're root on a machine that serves part
>of it's filesystem.  You put a /bin/sh somewhere and make it setuid
>to root etc.  Then you go over to another machine and execute that
>/bin/sh.  Voila you're root over there.

It is worse than this: Even if you do not act as a server for any
other hosts, as root you have complete access to all non-root files
on every other machine on your NFS network---simply because as root
you can become any non-root person and then access NFS files as
that other person.

(Sun is working on a real authentication system.)

>I don't know if we'd do something so mundane as running out of user-id's.
>64000 is a large number still.

4BSD is headed towards 32 bit uid and gid values.  That was part of
the purpose behind adding `typedef u_short uid_t' to <sys/types.h>.
-- 
In-Real-Life: Chris Torek, Univ of MD Comp Sci Dept (+1 301 454 7690)
Domain:	chris@mimsy.umd.edu	Path:	uunet!mimsy!chris