/etc/suauth

[Sina Bahram]

So you have increased the chances from 1 out of 99, to 2 out of 99 ...
Actually you have doubled their chances ...

But, regardless of that, I have a question. You said it's harder to find the
password to a user account than to root. Please explain.

Take care,
Sina 

-----Original Message-----
From: speakup-bounces at braille.uwo.ca [mailto:speakup-bounces at braille.uwo.ca]
On Behalf Of Jude DaShiell
Sent: Saturday, December 17, 2005 4:00 PM
To: speakup at braille.uwo.ca
Subject: re: /etc/suauth

The analysis is flawed.  A machine with 99 user accounts on it and a root
account with only one line in /etc/suauth with one user account on it
presents a hacker with 98 decoys and one hackable account.  The hacker has
to go to the trouble of stealing a user account password not a root account
password and that is more difficult to do.  It never was only the
possibility of irreversible system damage that was the only reason not to
run as root on the internet with the security specialists in the first
place.  Now if on a 99 user account machine you insist on having 99 lines in
/etc/suauth, then a hacker would have 99 possible targets and would be more
likely to break into a machine.



_______________________________________________
Speakup mailing list
Speakup at braille.uwo.ca
http://speech.braille.uwo.ca/mailman/listinfo/speakup