Re: Re: Full-Disclosure Digest, Vol 17, Issue 31

["Eliah Kagan" <degeneracypressure () gmail com>]

On 7/17/06, Vidar Løkken wrote:
> On Sun, 16 Jul 2006, Jhou Shalnevarkno wrote:
>
> > I've come to the realisation that plain text can be entered to change
> > the root password in Slackware Linux. It doesn't check for the
> > original password.. Surely this isn't right, perhaps its my bit of
> > confusion but I think that its a minor case of stupidity that even
> > though the root user has rwx access to all filesystems, this shouldn't
> > be the case with passwords.
>
> Root can always change a password for a user or himself without knowledge
> of the old password. It has always been so, in any Linux and BSD I know
> of. And it is so by design, since a root console should not be left logged
> in anyway. And those who are root, can just edit the files, so what is the
> point in asking for the former password? It adds nothing in security...

Yes, root can, by definition, make any change to the state of the
system. Otherwise it wouldn't be root. If you changed the passwd
executable so that even root would have to enter a password, the only
impact on security would be that there would be another avenue for a
shoulder-surfing attack. A person logged in as root can, as Vidar
said, just manually change the contents of the shadow password file.
Or bring in a copy of the (current) passwd executable that lets root
change passwords without entering the root password, and run that...

Thus there would be no security benefit to making the suggested change.

-Eliah

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/