Penetration Testing mailing list archives
Unix Application,
From: "IRM" <irm () iinet net au>
Date: Mon, 21 May 2007 20:09:59 +1000
Dear all, On my recent pen test, I have seen on Unix Apps (written in C) relies on UNIX authentication (/etc/passwd and /etc/group) to determine which functionalities the user can access to. 1) My first question would be what is the rationale of having such design? Obviously the authentication design is open to not only the application users but to the operating system users. 2) I know on some Unix/Linux flavors, the system could enforce the user to change their password every X days. If I am not wrong this setting can be set through "/etc/shadow" but what if the user never accesses their Shell? Would it still enforce the user to change their password? (say on /etc/passwd; username .......: :::::: /bin/apps - instead of /bin/sh) - so when the user is actually connect to the terminal, its automatically run the application and not a shell - if I am not wrong .Profile is run after /bin/sh is called? Cheers, John, ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------
Current thread:
- Wireless penetration testing spencerforhire (May 20)
- Unix Application, IRM (May 21)
- Re: Unix Application, Pranay Kanwar (May 21)
- Re: Unix Application, R. DuFresne (May 21)
- Re: Unix Application, Claudio Broglia (May 22)
- Re: Wireless penetration testing Matt Ahrens (May 21)
- Unix Application, IRM (May 21)