news account in RH linux

[K.C. Chan]

All I am not sure if this was intentional or not, But it appears that the news account could be a backdoor into your linux server, here's what I have on my server:
"news:x:9:13:news:/etc/news: ", noticed the last field is blank. You could login with passwords "news". Here's my fixed for it:
"news:x:9:13:news:/etc/news:/sbin/nologin". If anyone experiencing the same or similar issue with news account, please post so I know I am not going crazy. Thanks.

[Kodjo Agbenu]

Hi,

I'm using RH9 and there is no way to login using password "news".

Kodjo

[K.C. Chan]

not sure about rh9, but the servers I am seeing this is on RH7.2; Does any one know the affect of leaving shell blank in passwd file?

[Stuart Browne · Accepted solution]

Whilst the lack of 'shell' for a given user is a stupid mistake, it is by no means a security hole. By default, the shell will be '/bin/sh'.

The 'x' in the 2nd field says that it uses the shadow password system. If you look in the /etc/shadow file, you'll see an '*' in the 2nd field.

This states that there is no valid password for user 'news', i.e. no matter what you type, it won't work.

This is not a security 'hole', just a dumb mistake, with no real issues.

Incidentally, '/bin/false' would be a better idea, as it isn't a shell, and thus would also deny FTP login attempts (regardless of password).

[Mark Grant]

Just out of historical interest, this DID used to be a security hole.

There used to be a program that came with most unix's that allowed a user to change their default shell (it might still be around for all I know). This utility would change the last field in the passwd file to whatever shell the user specified. The "login" or "passwd" command (I can't remember which), rather inconveniently, had a feature that meant it would assume a maximum length for a passwd entry. All you had to do was to change your shell to something that would make your passwd entry one character too long and you would "push" the last character of your shell name onto the next line. If this was an "h" for example, the resulting extra line would be an "h" with nothing after it. This would be interpreted by "login" as "h::0:0:::". Login as "h" and instant root access was yours.

It doesn't work any more though :)

[Claudio Cilloni]

I'm using RH73, I have this line in /etc/passwd:

news:x:9:13:news:/var/spool/news:

but it isn't possible to telnet or ftp with this user.

ciao
Claudio

[K.C. Chan]

Thanks all for your input; There are other admin within my group. If this is by default locked down, then some one within my group have turned it on w/o my knowledge. I will look into it further and try to find out if some one had made a back door for himselves w/o my knowledge.

[Stuart Browne]

On a RH system by default, any UID (other than 0) less than 500 has no valid password.

If it does, then yea, someone's been playing.