becoming root via NFS

[Istvan Mohos]

From: lai at software.org (Kwo-Long Lai):
>istvan at hhb.UUCP (Istvan Mohos):
>> 
>> I've re-read "UNIX System Security" (by Wood and Kochan) recently
>> and jotted down a list of over 50 security risks, all the while
>> trying to banish the song "Fifty Ways To Leave Your Lover" recurring 
>
>I'm wondering whether you could send me that list?(If it is OK to you).  

Seing this newsgroup practically dried out for the holidays and my bluff
being called, here is my hand, with apologies for straying off the
"internals".  Please note that the list is far from being complete.


Bad Assumptions To Make About The Security Of Your Computer System
------------------------------------------------------------------
The only important data are sysfiles, company plans, personnel records, mail.
High level management is knowledgeable about security issues.
High level management encourages the enforcement of security guide lines.
Raising user awareness about security automatically tightens system security.
Everyone voluntarily chooses good (non-dictionary-derivative) passwords.
Everyone uses new passwords when forced to expire the old one.
All user records in /etc/passwd contain a non-null password.
Noone is ever obliged to tell her password to anyone else.
Noone is ever obliged to type her password while someone else is looking.
Group permissions and "newgrp" are used in a consistent and correct manner.
Noone installs the current directory as the first constituent of PATH.
Everyone always logs off or locks her office when leaving the terminal.
Noone ever writes down a password.
Each user chooses different passwords on different systems.
/etc/passwd logins of all ex-employees are promptly removed.
Everyone correctly sets "umask", doesn't create files writable by others.
Noone's HOME directory is readable by others.
Everyone has messages turned off (mesg n).
Everyone looks for, analyzes ./.exrc before vi in directory not owned.
Noone edits (or creates temporary files that shadow) sensitive information.
Everyone uses her own tmp directory exclusively for creating temporary files.
Everyone's own tmp directory is writable only by owner.
No ordinary user owns a disk partition.
Local disk devices in /dev are accessible only to owner.
Anyone who mounts remote file systems does so with the "nosuid" option.
A system is booted only when the owner is physically present.
/ doesn't contain a .rhosts, or at least .rhosts is "0600 root".
/dev/mem/kmem is acccessible only to owner.
/dev/swap is accessible only to root.
/etc/rc or /etc/inittab, associated files and dirs, are not writable.
/usr/lib/crontab, any programs called from it, are not writable.
Mode of /usr/lib/uucp/USERFILE is 0644.
Mode of /usr/lib/uucp/L.cmds is 0644, accessed only by rmail and rnews.
Mode of /usr/lib/uucp/L.sys is 0600.
uux only executes rmail and news.
uucp can only write to /usr/spool/uucppublic.
Permissions of all security audit programs are set to "execute only".
Backup tapes are under lock and key.
Sysadm can define and maintain security arrangements on a distributed network.
Sysadm continually runs acctcom or accton.
Sysadm performs regular "connect-time accounting", and cleans /usr/adm/wtmp.
Sysadm performs regular security audits, verifies integrity of suid programs.
Sysadm performs regular security audits specifically for uucp and sendmail.
Sysadm promptly and regularly analyzes and cleans uucp logs.
Sysadm checks "find" errors to detect excessive depth or dir size.
Sysadm keeps checksums of all system files, off-line.
Sysadm keeps checksums of files, generated by "secret algorithm".
Sysadm types "/bin/su" instead of "su" to avoid trojans.
Sysadm never lets the terminal out of her sight when root.
Sysadm is never obliged to let anyone else issue even a single command as root.
Sysadm becomes root, or performs root login, only from the console.
Sysadm analyzed all PD software in use (i.e. GNU Emacs), found no suid problems.

-- 
        Istvan Mohos
        ...uunet!pyrdc!pyrnj!hhb!istvan
        1000 Wyckoff Ave. Mahwah NJ 07430 201-848-8000
======================================================