pen-test
[Top] [All Lists]

Re: Unix Application,

To: "pen-test@securityfocus.com" <pen-test@securityfocus.com>
Subject: Re: Unix Application,
From: Claudio Broglia <xeon@sysroot.eu>
Date: Tue, 22 May 2007 15:34:04 +0200
Delivered-to: sp-com-lists@consult.net
Delivered-to: pentest-list2@consult.net
Delivered-to: mailing list pen-test@securityfocus.com
Delivered-to: moderator for pen-test@securityfocus.com
In-reply-to: <000001c79b90$314882a0$0200a8c0@master.manchester.com>
List-help: <mailto:pen-test-help@securityfocus.com>
List-id: <pen-test.list-id.securityfocus.com>
List-post: <mailto:pen-test@securityfocus.com>
List-subscribe: <mailto:pen-test-subscribe@securityfocus.com>
List-unsubscribe: <mailto:pen-test-unsubscribe@securityfocus.com>
Mailing-list: contact pen-test-help@securityfocus.com; run by ezmlm
References: <000001c79b90$314882a0$0200a8c0@master.manchester.com>
Resent-date: Tue, 22 May 2007 19:20:05 -0600 (MDT)
Resent-from: pen-test-return-1078484228@securityfocus.com
Resent-message-id: <20070523012005.63FB2143A54@outgoing2.securityfocus.com>
Resent-sender: listbounce@securityfocus.com
Sender: listbounce@securityfocus.com
User-agent: Internet Messaging Program (IMP) H3 (4.1.3)
Quoting IRM <irm@iinet.net.au>:

Dear all,

On my recent pen test, I have seen on Unix Apps (written in C) relies on
UNIX authentication (/etc/passwd and /etc/group) to determine which
functionalities the user can access to.
1) My first question would be what is the rationale of having such
design? Obviously the authentication design is open to not only the
application users but to the operating system users.

Yes, application's users would also access system shell. But the idea of having users managed by system, instead of a separate database, is that you can share them across multiple applications, managing centrally rights and permissions, or make them access other services (mail, ftp, etc.). I don't like this very much, but depending on the situation it could be the "right way to do it".


2) I know on some Unix/Linux flavors, the system could enforce the user
to change their password every X days. If I am not wrong this setting
can be set through "/etc/shadow" but what if the user never accesses
their Shell?
Would it still enforce the user to change their password?
(say on /etc/passwd;  username .......: :::::: /bin/apps - instead of
/bin/sh) - so when the user is actually connect to the terminal, its
automatically run the application and not a shell - if I am not wrong
.Profile is run after /bin/sh is called?

Cheers,
John,

Well, if the application checking for what groups the user belong to don't make the user validate, so doesn't check for account enabled/disabled/expired password/whatsoever, this setting would be obviously ignored.

bye
xeon

Attachment: pgpxWnO3hqTDV.pgp
Description: PGP Digital Signature

<Prev in Thread] Current Thread [Next in Thread>