hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2025-01-01 00:18:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add -i (insecure) flag to rexecd, which allows uid == 0 logins

Browse Source 
(presuming that the user in question is not in /etc/ftpusers and
does not have a null password).
This commit is contained in:
Nick Sayer 2000-05-13 15:58:36 +00:00
parent 8bbd2c1e46
commit 0d9fb499eb
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=60507
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libexec/rexecd/rexecd.8
View File

@ -39,7 +39,7 @@
.Nm rexecd .Nm rexecd
.Nd remote execution server .Nd remote execution server
.Sh SYNOPSIS .Sh SYNOPSIS
.Nm rexecd .Nm rexecd [-i]
.Sh DESCRIPTION .Sh DESCRIPTION
.Nm Rexecd .Nm Rexecd
is the server for the is the server for the
@ -99,9 +99,11 @@ by
.El .El
.Sh CAVEATS .Sh CAVEATS
.Nm Rexecd .Nm Rexecd
will no longer allow root logins, access for users listed in will not allow root logins unless the -i option is given on
the command line (typically in inetd.conf). It will also
disallow access for users listed in
.Pa /etc/ftpusers , .Pa /etc/ftpusers ,
or access for users with no passwords, which were all serious security holes. or users with no passwords, which were all serious security holes.
The entire concept of rexec/rexecd is a major security hole and an example The entire concept of rexec/rexecd is a major security hole and an example
of how not to do things. of how not to do things.
.Nm Rexecd .Nm Rexecd

7
libexec/rexecd/rexecd.c
View File

@ -82,6 +82,8 @@ void getstr __P((char *, int, char *));
/*VARARGS1*/ /*VARARGS1*/
void error __P(()); void error __P(());
int no_uid_0 = 1;
/* /*
* remote execute server: * remote execute server:
* username\0 * username\0
@ -99,6 +101,9 @@ main(argc, argv)
int fromlen; int fromlen;
struct hostent *hp; struct hostent *hp;
if (argc == 2 && !strcmp(argv[1], "-i"))
no_uid_0 = 0;
openlog(argv[0], LOG_PID, LOG_AUTH); openlog(argv[0], LOG_PID, LOG_AUTH);
fromlen = sizeof (from); fromlen = sizeof (from);
if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0)
@ -191,7 +196,7 @@ doit(f, fromp)
} }
} }
if (pwd->pw_uid == 0 || *pwd->pw_passwd == '\0' || if ((pwd->pw_uid == 0 && no_uid_0) || *pwd->pw_passwd == '\0' ||
(pwd->pw_expire && time(NULL) >= pwd->pw_expire)) { (pwd->pw_expire && time(NULL) >= pwd->pw_expire)) {
syslog(LOG_ERR, "%s LOGIN REFUSED from %s", user, remote); syslog(LOG_ERR, "%s LOGIN REFUSED from %s", user, remote);
error("Login incorrect.\n"); error("Login incorrect.\n");