System users restriction

[Bruno Bossier]

Where can I find some documentation about the risks when some normal user could switch to one of the system users (root excluded). I'm talking about the following users : daemon, bin, sys, adm, uucp, nuucp, lp, hpdb, www and nobody.

I'm trying to limit the access to these users as much as possible, but have to explain why I want to do that and what the security risks are if someone has access to one of these users.

Bruno

[Darren Prior]

Hi Bruno,

I'd imagine it to be a minor risk because the account you mentioned are configured witha an asterisk in the password field of /etc/passwd hence they are disabled. The only person that could su to them is root. Anyone who has root capabilities should be educated to not login as these users.

regards,

Darren.

[Bruno Bossier]

Well, all users have an * in /etc/passwd as all our nodes are trusted hosts. This means that the passwords are kept under the /tcb structure where the trusted database is kept.

Educating is not an option as I work for a very big company.

I'm sure there must be some documentation somewhere. User bin is e.g. very dangerous as all users belonging to the bin group (like user bin itself) are allowed to shutdown the box.

[Darren Prior]

Hi Bruno,

Thanks for mentioning that it's a trusted system. If you look at eg, the bin account on a trusted system (/tcb/files/auth/b/bin) you'll see that it is disabled too; ie u_pwd is an asterisk. As with a non-trusted system, only root (or someone with root priviliges) can then su to bin.

My point here is that the vast majority of users won't even be able to either login or su to these system users; hence there shouldn't be a problem.

You also mentioned that anyone in the group bin can shutdown the box; this is true - but the default situation is for only root and the bin user to be in group bin.

So, I'd be interested to hear how many other users are in group bin, and how many people have the root password.

I don't believe there'll be any documentation advising users not to login as bin or another system user as HP has done a large amount to prevent this from happening!

regards,

Darren.

[Tim Maletic]

The security risks are high if unprivileged users can access system accounts. Breaching a system account is often one step along the way to root access. For one simple example, if you can become bin, then you own /etc (and therefore can trivially become root by creating a new /etc/passwd) on default HP-UX systems. Unfortunately, I know of no index of similar examples. If you troll back through the history of local root vulnerabilities (like at http://securityfocus.com/cgi-bin/sfonline/vulns.pl), you'll find others.