.login, .profile and .rhost

[Joyce Suganthy]

Hi ,

Could you all please help me out here.

The three files above currently have the file permisson as rwxrwxrwx for all the user id as well as root, can i change the file permission to rw------- for all the above files.

Would this disturb the server at any way?

[Rodney Hills · Accepted solution]

Absolutelly correct the permissions!! Your system can be easily compromised!!

You may want to check the permissions of other files and directories since they may be used to damage your system.

HTH

-- Rod Hills

[Michael Tully]

Having the permission set this way is asking for trouble. I don't want to panic anyone, but anyone can get full use of your system.
Definitely change them, but to:

-rw-r----- which relates to 640

Also have a look at the systems umask setting it may need changing.
# umask

To fix this add two line to your /etc/profile file:

# umask setting
umask 022

You will most likely find quite a number of files that have inappropriate permissions. Here is hwo to find them, particularly for the operating system filesystems.
# find / /opt /usr -xdev -type f -perm 666
# find / /opt /usr -xdev -type f -perm 777
# find / /opt /usr -xdev -type d -perm 777

I would also change the root password as well, just to be on the safe side.

Regards
Michael

[Steven E. Protter]

You have either been hacked or someone made a mistake.

I would change the permissions on the above files to r for the owner of the files. I would not let users change the contents of these files.

The can be owned by root and still sourced by users.

.login is the startup source for the c shell, csh

.profile is the startup for posix and korn shell.

.rhost is most distrubing of all in this case. This lets users or bad people change who can remotely log onto your system from other systems.

Even with proper permissions remote login is a security hazard. I'd shut it down in /etc/inetd.conf and use the following secure substitute.

Root priviledges on all your servers were endangered.

It's call secure shell, its free. Here is a link and I'm attaching Chris Vail's cookbook for secure passing of public keys and such to enable secure remote functions.

Secure Shell: a replacement for rcp ftp and telnet that encrypts passwords

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA


SEP

[Bill Douglass]

check the permissions on the files in /etc/skel as well.

[Ramkumar Devanathan]

Suganthy,

Looking at this question and the other question on umask, some compromise has gone on with the unix machines and access permissions... What happened?

Just out of curiosity.

- ramd

[Tim Sanko]

Before you start resecuring the world, please check with your application vendors.

On rare occasion, an application will have to have access to .rhosts in particular. I learned by changing its permissions. OUCH!

Tim

[Zafar A. Mohammed_1]

Its seems somebody change or maybe application require it. Its good to look first at .rhost entry also.

Thanks
Zafar

[Joyce Suganthy]

Hi,

Actually I am new to this company, the server been there for long, I am asked to look into this matter by the audit department, so that was why I enquired.

Thanks