topic Re: password changes in Operating System - HP-UX

password changes

Jason Berendsen — Wed, 10 Jul 2002 12:38:29 GMT

I wanted an easy way to change passwords across 17 different servers without setting up NIS. I created a script that utilizes sed to change the password field in the /etc/passwd file to the same encrypted password across all servers. What kind of security problems would this open up? It is still using the encrypted password it is just the same encrytion on each server.

Re: password changes

steven Burgess_2 — Wed, 10 Jul 2002 12:47:29 GMT

Hi

If you manage to get access to one server , you have access to them all via that specific id. Not that the intruder would now that the passwd's are the same. It wouldn't be hard to work out though

I take it that you have .rhosts set up on each server as well ?

HTH

Steve

Re: password changes

Jason Berendsen — Wed, 10 Jul 2002 12:51:39 GMT

Yes we do have an .rhosts set up. I am aware that this is a security risk.

Jason

Re: password changes

R.Mielen — Wed, 10 Jul 2002 12:52:02 GMT

allo,

I'v tried it before also with sed and aslong
as your hosts.equiv & .rhosts are set up well
then there will be no problems.
Atleast not for me a couple of month ago.

GrtZZ

R.Mielen

Re: password changes

A. Clay Stephenson — Wed, 10 Jul 2002 12:52:31 GMT

The passwd file itself is probably no less secure. In fact, it's about at the level NIS would leave it since a 'ypcat passwd' would reveal the hashed passwd's to anyone. Your real security risk is the .rhosts and hosts.equiv that allow your remsh'ed sed commands to work. Theother risk is that your script probably create a temp file before moving back to /etc/passwd. Someone might be able to write a daemon to look for the existence of that temp file and subvert it before it is moved into final position.

You should really give NIS a try. It's very easy to set up. You can even use SAM.

Re: password changes

PIYUSH D. PATEL — Wed, 10 Jul 2002 12:59:05 GMT

Hi,

To increase your security further, you should go for the NIS or convert your system to a trusted system using SAM.

.rhosts, hosts.equiv files are security loopholes.

Piyush

Re: password changes

steven Burgess_2 — Wed, 10 Jul 2002 14:34:22 GMT

Hi

Here is the doc for setting up nis

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B1031-90048/B1031-90048_top.html&con=/hpux/onlinedocs/B1031-90048/00/00/20-con.html&toc=/hpux/onlinedocs/B1031-90048/00/00/20-toc.html&searchterms=nis&queryid=20020710-084235

HTH

Steve