password changes

[Jason Berendsen]

I wanted an easy way to change passwords across 17 different servers without setting up NIS. I created a script that utilizes sed to change the password field in the /etc/passwd file to the same encrypted password across all servers. What kind of security problems would this open up? It is still using the encrypted password it is just the same encrytion on each server.

[steven Burgess_2 · Accepted solution]

Hi

If you manage to get access to one server , you have access to them all via that specific id. Not that the intruder would now that the passwd's are the same. It wouldn't be hard to work out though

I take it that you have .rhosts set up on each server as well ?

HTH

Steve

[Jason Berendsen]

Yes we do have an .rhosts set up. I am aware that this is a security risk.

Jason

[R.Mielen]

allo,

I'v tried it before also with sed and aslong
as your hosts.equiv & .rhosts are set up well
then there will be no problems.
Atleast not for me a couple of month ago.

GrtZZ

R.Mielen

[A. Clay Stephenson]

The passwd file itself is probably no less secure. In fact, it's about at the level NIS would leave it since a 'ypcat passwd' would reveal the hashed passwd's to anyone. Your real security risk is the .rhosts and hosts.equiv that allow your remsh'ed sed commands to work. Theother risk is that your script probably create a temp file before moving back to /etc/passwd. Someone might be able to write a daemon to look for the existence of that temp file and subvert it before it is moved into final position.

You should really give NIS a try. It's very easy to set up. You can even use SAM.

[PIYUSH D. PATEL]

Hi,

To increase your security further, you should go for the NIS or convert your system to a trusted system using SAM.

.rhosts, hosts.equiv files are security loopholes.

Piyush

[steven Burgess_2]

Hi

Here is the doc for setting up nis

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B1031-90048/B1031-90048_top.html&con=/hpux/onlinedocs/B1031-90048/00/00/20-con.html&toc=/hpux/onlinedocs/B1031-90048/00/00/20-toc.html&searchterms=nis&queryid=20020710-084235

HTH

Steve