some sentences need to be explain

[Victor_5]

I am going through a security policy, there are some sentences I don't understand, who can give me more detail info about them and tell me why?

1. User TTYs must not be world writable.
2. The /etc/passwd file cannot contain any blank fields. The only exception to this is the comment field that is sometimes left blank in system-supplied user ids.
3. The portmon variable must be set so that NFS requests that are not received from privileged ports will be ignored.

Thanks,
Shawn

[harry d brown jr]

Are these your policies, or are you getting these from some book?

No modems, mux's, or terminal servers, then no worries about tty's.

no blanks in passwd file makes a little sense, especially shell and home fields, but comment filed - who cares.

portmon? Well if security is an issue, you don't run NFS!

live free or die
harry

[Mark Greene_1 · Accepted solution]

1. User TTYs must not be world writable.

the permissions on /dev/tty* should *not* be write-enabled for other. If they look like this:

crw--w--w-

change them to look like this:

crw--w----

by executing as root "chmod 620 /dev/tty*"
best to do this when the system is not being used.

2. The /etc/passwd file cannot contain any blank fields. The only exception to this is the comment field that is sometimes left blank in system-supplied user ids.

This is arguably overkill. You should make sure every login ID has a password, a default shell account, and a home directory. Exceptions to this are the ID's nobody, sys, and www.

3. The portmon variable must be set so that NFS requests that are not received from privileged ports will be ignored

This is specific to your application. Check the man page for rpcgen for more info

HTH
mark