hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-12-29 06:47:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add -i (insecure) flag to rexecd, which allows uid == 0 logins

Browse Source 
(presuming that the user in question is not in /etc/ftpusers and
does not have a null password).
This commit is contained in:
Nick Sayer 2000-05-13 15:58:36 +00:00
parent 8bbd2c1e46
commit 0d9fb499eb
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=60507
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libexec/rexecd/rexecd.8
View File

@ -39,7 +39,7 @@
.Nm rexecd
.Nd remote execution server
.Sh SYNOPSIS
.Nm rexecd
.Nm rexecd [-i]
.Sh DESCRIPTION
.Nm Rexecd
is the server for the
@ -99,9 +99,11 @@ by
.El
.Sh CAVEATS
.Nm Rexecd
will no longer allow root logins, access for users listed in
will not allow root logins unless the -i option is given on
the command line (typically in inetd.conf). It will also
disallow access for users listed in
.Pa /etc/ftpusers ,
or access for users with no passwords, which were all serious security holes.
or users with no passwords, which were all serious security holes.
The entire concept of rexec/rexecd is a major security hole and an example
of how not to do things.
.Nm Rexecd

7
libexec/rexecd/rexecd.c
View File

@ -82,6 +82,8 @@ void getstr __P((char *, int, char *));
/*VARARGS1*/
void error __P(());
int no_uid_0 = 1;
/*
* remote execute server:
* username\0
@ -99,6 +101,9 @@ main(argc, argv)
int fromlen;
struct hostent *hp;
if (argc == 2 && !strcmp(argv[1], "-i"))
no_uid_0 = 0;
openlog(argv[0], LOG_PID, LOG_AUTH);
fromlen = sizeof (from);
if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0)
@ -191,7 +196,7 @@ doit(f, fromp)
}
}
if (pwd->pw_uid == 0 || *pwd->pw_passwd == '\0' ||
if ((pwd->pw_uid == 0 && no_uid_0) || *pwd->pw_passwd == '\0' ||
(pwd->pw_expire && time(NULL) >= pwd->pw_expire)) {
syslog(LOG_ERR, "%s LOGIN REFUSED from %s", user, remote);
error("Login incorrect.\n");