diff options
| author | pst <pst@FreeBSD.org> | 1996-11-22 08:59:07 +0000 |
|---|---|---|
| committer | pst <pst@FreeBSD.org> | 1996-11-22 08:59:07 +0000 |
| commit | f802c9787d3218fbc623bb2a74f3c5c430094dfb (patch) | |
| tree | e65ab53e32993fd712bc0e7f930d9ff6916114c6 /libexec/rexecd/rexecd.8 | |
| parent | a8c2478d1d280d99d12fc655de3f105d17d8da42 (diff) | |
| download | FreeBSD-src-f802c9787d3218fbc623bb2a74f3c5c430094dfb.zip FreeBSD-src-f802c9787d3218fbc623bb2a74f3c5c430094dfb.tar.gz | |
Back out recent security patch for rexecd. After more careful analysis,
it is both uneeded and breaks certain lock-step timing in the rexec
protocol.
Yes, an attacker can "relay" connections using this trick, but a properly
configured firewall that would make this sort of subterfuge necessary in the
first place (instead of direct packet spoofing) would also thwart useful
attacks based on this.
Diffstat (limited to 'libexec/rexecd/rexecd.8')
| -rw-r--r-- | libexec/rexecd/rexecd.8 | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/libexec/rexecd/rexecd.8 b/libexec/rexecd/rexecd.8 index 5103465..babaf89 100644 --- a/libexec/rexecd/rexecd.8 +++ b/libexec/rexecd/rexecd.8 @@ -99,11 +99,8 @@ by .El .Sh CAVEATS .Nm Rexecd -will no longer allow root logins, -access for users listed in /etc/ftpusers, -access for users with no passwords, -or reverse connections to privileged ports, -which were all serious security holes. +will no longer allow root logins, access for users listed in /etc/ftpusers, +or access for users with no passwords, which were all serious security holes. The entire concept of rexec/rexecd is a major security hole and an example of how not to do things. .Nm Rexecd |
