[techtalk] root passwd

[jenn at simegen.com]

Linda MacPhee-Cobb wrote:

> Hi,
> 
> I've been informed this is a 'feature' not a 'flaw'..... sound like MS?

> Well its a PC. So lets firstly look at this objectively
> Got a screwdriver. Then you have root access.
> Floppy driver and the machine boots floppy first. Then you have root access

Believe me, I've been in the situation where the ONLY thing that
let me get to business-critical data was the fact that Unix and
Unix-based systems allow you to boot into single user mode from
the console.

Physically secure your console. It has to be possible to get root
access from the console if you don't know the password, if you're
a sysadmin - otherwise the whole company is *screwed* when the-
only-person-who-knows-the-root-password goes into hospital with
a heart attack//takes off for Guatemala to live in a commune//
suddenly goes to work for the competition.

Besides, as Alan said, give me your hard drive and I can install
it on my machine and get all your data anyway.

You have to physically secure your machine to be secure anyway. So
why not physically locate console with the machine? Just leave
the console in the same room.. no big deal.
That's what professional sysadmins do.


Guess we should have asked what the exploit was, huh? Sorry..




Jenn V.
-- 
     "Do you ever wonder if there's a whole section of geek culture
             you miss out on by being a geek?" - Dancer.

jenn at simegen.com     Jenn Vesperman     http://www.simegen.com/~jenn/