Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022

[Giacomo Catenazzi <cate () debian org>]

Hello,

Sorry, I never told you it is a feature. Please read better, and try to 
write better mails. if you had doubts, you could ask me, in the same tread.

And if you discover a vulnerability, you should disclose it. This is the 
standard way.


In any case:

No password should be stored in a world readable file. This is enforced 
e.g. in ssh.  This is a good security advice.

DO NOT PUT WordPress passwords (e.g. for database, or admin password) in 
world readable file (on multi-user machines).  This is in part a user error.

But PHP (as default LAMP) has this problem. I told you possible 
work-around. So no system administrator should allow untrusted 
multi-user with default LAMP setting.  This is fault of system 
administrator: he should know the security risk before setting up 
services. It is his job, and this is very well documented.

Then I told you various methods to improve the security.

But it seems you still do not understand "/home/loser is with 
permissions 755, default umask 0022". Note: this is also a question on 
installation. System administrator choose this setting.


Do you want PHP run by root? (required with umask 0000) Or tell me what 
should be the right setting? The error is simple: do not enable PHP in 
the simple LAMP way without considering the security implication. 
(suPHP, proxy, etc. are better ways).

Yes, Debian is not secure by default (if you install various packages), 
but it has a lot of documentation, to asses the risk, and how to setup 
things. But at the end, it is the system administrator job to check 
security implication before to install servers. This is true on most of 
professional distribution.  But look the Debian default of Apache: it is 
still strict. WordPress installations (and so configuration snippet) are 
just for single-user machine (and they have extensive documentation 
about security).


If a official Debian mirror has such problem, it is worrying. OTOH all 
Debian files are static files (so no passwords), and Debian sign all 
files: we do not trust mirrors.


If you had some doubt on my answer, you could have reach me, and ask me 
what you do not understand, or to continue the discussion. Your way to 
ridicule Debian just ridicule yourself.

And if you want to continue, check my mails: they are long: please write 
more complete mails: it helps you to order your ideas, and find flaws.

ciao
        cate



On 07.10.2020 20:00, Georgi Guninski wrote:
> https://lists.debian.org/debian-security/2020/10/msg00000.html
>
> ===
> /home/loser is with permissions 755, default umask 0022
>
> on multiuser machines this sucks much.
>
> on a multiuser debian mirror we found a lot of data,
> including the wordpress password of the admin.
> ===
>
> Then in the thread someone with @debian.org email explains
> to me it is a feature, not a bug.
>
> In a addition, they suggest to tell them the mirror, lol.
>
> Are debian detached from reality?