patchTiger UNIX security tool - Patches: patch #2463, cleanup noise and add additional...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #2463: cleanup noise and add additional check to check_anonftp.

Submitter:  Ryan Bradetich <rbrad>
Submitted:  Mon 12 Jan 2004 06:58:01 AM UTC
   
 
Category:  Security test Priority:  5 - Normal
Status:  Done Privacy:  Public
Assigned to:  rbrad Open/Closed:  Closed

Wed 21 Jan 2004 09:09:11 PM UTC, comment #3: 

Notice that your definition of invalid shell is different from check_account (which includes /bin/false, /dev/null, and
/sbin/nologin). Also notice you just check the name, but the shell might be listed as valid in ETCSHELLS (and thus, it might  not necessarily be invalid)...

We probably need to standarise the "invalid shell" defintion so that it can be configured per system and it can be used by both check_anonftp and check_accounts

Javier Fernandez-Sanguino Peña <jfs>
Group administrator
Wed 14 Jan 2004 04:49:25 AM UTC, comment #2: 

Committed to CVS HEAD on Jan 13, 2004.

Ryan Bradetich <rbrad>
Group Member
Mon 12 Jan 2004 07:01:08 AM UTC, comment #1: 

Oops.  Forgot to add the documentation patch in the last diff.

Ryan Bradetich <rbrad>
Group Member
Mon 12 Jan 2004 06:58:01 AM UTC, original submission:  

This patch looks ugly but most of it is reformating (removes a layer of indention by exiting from the script instead going through an if/then/else statement).
 
This patch does the following:
 
        * Eliminate the noise side-effect noise from the
          $GREP ^ftp: from /etc/passwd by storing it in a  
          variable that can be reused.
 
        * Adds a check to see if the ftp user has an invalid
          shell.  (i.e. /bin/false, /usr/bin/false, or
          /sbin/nologin).
 
          This is a HP Requirement and also marked on the
          TODO list in other/cert-usc20.txt.

Ryan Bradetich <rbrad>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #6726:  anonftp.patch added by rbrad (402B - application/octet-stream - Documentation patch for the new check.)
file #6725:  check_anonftp.patch added by rbrad (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 4 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-01-14 rbrad StatusNone Done
    Open/ClosedOpen Closed
2004-01-12 rbrad Attached File- Added anonftp.patch, #2497
2004-01-12 rbrad Attached File- Added check_anonftp.patch, #2496

Back to the top

Powered by Savane 3.13-0329.
Corresponding source code