<div dir="ltr"><br><br><div class="gmail_quote">On Mon, Sep 26, 2011 at 3:28 PM, Bear Giles <span dir="ltr"><<a href="mailto:bgiles@coyotesong.com">bgiles@coyotesong.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<font color="#000000"><font face="tahoma,sans-serif">Matt, why not create a hardening package? Just write a script that scrubs /etc/passwd and /etc/group and then create a small package that runs it once (in postinst). I would also install it in, e.g., /etc/cron.daily so it's rerun periodically. </font></font><span style="font-family:tahoma, sans-serif">I haven't kept track of existing hardening packages but I wouldn't be surprised if somebody else has already done this.</span></blockquote>
<div><br>I've used Bastille in the past, for example, but I think most users would prefer that Ubuntu is already hardened by default.<br><br> </div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div>
<div><font face="tahoma, sans-serif"><br></font></div><div><font face="tahoma, sans-serif">P.S., if you want to have fun with package installation failing try mounting /tmp as noexec. It's easy to fix - if you know how to do it. If not you'll bang your head against the wall for hours while you're trying to figure out why installations are failing.</font></div>
<div><font face="tahoma, sans-serif"><br></font></div><div><font face="tahoma, sans-serif">bear</font></div><div><div></div><div class="h5"><div><font face="tahoma, sans-serif"><br>
</font></div><div><font face="tahoma, sans-serif"><br></font><div class="gmail_quote">On Mon, Sep 26, 2011 at 4:05 PM, Matt Alexander <span dir="ltr"><<a href="mailto:ubuntu.com@mattalexander.com" target="_blank">ubuntu.com@mattalexander.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_quote">On Sat, Sep 24, 2011 at 9:48 AM, Colin Watson <span dir="ltr"><<a href="mailto:cjwatson@ubuntu.com" target="_blank">cjwatson@ubuntu.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>On Thu, Sep 22, 2011 at 04:33:00PM -0700, Matt Alexander wrote:<br>
> Would it be possible to remove the vast majority of users from /etc/passwd<br>
> and instead rely on the application being installed to create the specific<br>
> user if needed? Most of the users appear to be historical remnants that<br>
> have been carried over from release to release.<br>
<br>
</div>For almost everything, and certainly for the overwhelming majority of<br>
new entries, we do exactly as you say. However, I (as base-passwd<br>
maintainer) will not remove entries from the global static list unless<br>
there is a very compelling reason to do so beyond cleaning up cruft;<br>
packages are entitled to assume that they are present without declaring<br>
any particular dependency and there's no reasonable way to know what<br>
removing such entries would break.<br></blockquote><div><br>I end up modifying the passwd/group files on my computers for auditing purposes and to ensure that the only accounts on the system are required accounts. Removing cruft seems like a perfectly valid reason. In 10 years will Ubuntu still have a uucp user and a news user and an irc user? Seems silly. Let's clean things up and keep it to just the accounts that must be there. We can then easily fix packages that wrongly assumed that their particular user would be always be there.<br>
<br> </div><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204, 204, 204);padding-left:1ex">
<br>
In any case, there are only 18 entries in the global static list<br>
(/usr/share/base-passwd/passwd.master), and even without thinking about<br>
it too hard I know that at least four or five are still in use and<br>
probably more, so there's not that much to be gained. All other system<br>
entries in the passwd file are created dynamically by applications.<br>
<br>
Since I took over base-passwd in 2002, I have added no new global static<br>
users and only two new global static groups, the last of which was in<br>
2004.<br>
<div><br>
> In addition, for users in the passwd file that must be there, could you<br>
> please set their shell to /usr/sbin/nologin?<br>
<br>
</div>Yes, I would like to do this eventually<br>
(<a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=274229" target="_blank">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=274229</a>). However,<br>
<a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=184979" target="_blank">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=184979</a> has to be fixed<br>
first, otherwise everyone will have their upgrades interrupted by a<br>
non-debconf prompt. I haven't had time to work on #184979 in quite a<br>
number of years, and to the best of my knowledge nobody has ever<br>
contributed a patch for it; I'd be happy to review one if somebody did<br>
so.<br>
<br>
The one wart here is that using /usr/sbin/nologin will break anything<br>
that runs commands as one of those users using the 'su' command. This<br>
isn't theoretical; one of my packages used to do so some years ago,<br>
although it now uses start-stop-daemon instead. The breakage is<br>
probably worthwhile, I'll admit, but I can't say that there would be no<br>
problems with changing those users' shell since there's been such a long<br>
time for packages to get used to it being /bin/sh.<br>
<br>
Cheers,<br>
<br>
--<br>
Colin Watson [<a href="mailto:cjwatson@ubuntu.com" target="_blank">cjwatson@ubuntu.com</a>]<br>
<font color="#888888"><br>
--<br>
Ubuntu-devel-discuss mailing list<br>
<a href="mailto:Ubuntu-devel-discuss@lists.ubuntu.com" target="_blank">Ubuntu-devel-discuss@lists.ubuntu.com</a><br>
Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss</a><br>
</font></blockquote></div><br></div>
<br>--<br>
Ubuntu-devel-discuss mailing list<br>
<a href="mailto:Ubuntu-devel-discuss@lists.ubuntu.com" target="_blank">Ubuntu-devel-discuss@lists.ubuntu.com</a><br>
Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss</a><br>
<br></blockquote></div><br></div></div></div></div>
</blockquote></div><br></div>