[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

pam_rhosts question



While looking for a phantom bug in pam_rhosts, I found something that
bothers me a bit, and I'd like comment from the rest of the list.

Is it appropriate for pam_rhosts to interactively query for the remote
username and remote hostname?  Shouldn't it simply fail if the application
calling it doesn't set those items?  It's not an issue for applications
which are built to work with it, such as in.r*d, but when silly, uninformed
sysadmins just throw it in thinking "it's just another PAM module, no
problem" it presents a security hole by letting the user give what should
be independently-provided information -- kind of like the rlogin hole
with login -f of a few years back.

I'd like to propose that the rhosts module should simply fail if
either PAM_RUSER or PAM_RHOST is not set.

Any objections?

michaelkjohnson

"Ever wonder why the SAME PEOPLE make up ALL the conspiracy theories?"




[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index] []