also sprach Adam Warner <[EMAIL PROTECTED]> [2002.01.19.2304 +0100]: > Firstly the servers are physically secure and there is no relevant issue > about having a local root console open for administration purposes.
mh. no comment. sure, if physical access would be available, no box is secure. but having a root login right there only means that an intruder wouldn't have to reboot the box (which is noticeable), he could just leave a backdoor in as little as 30 seconds. don't do it. > The question I have is if I "su - username" and then browse the web, > etc. is it impossible for a remote user who managed to gain access to > that user session to become root by exiting out of the user account? > > I'm almost certain the answer should be no. But I'd just like > confirmation. no. he'd have to steal your actual tty session, and if all you are doing is surfing the web, then he can't really do that. however, which browser are you using? are you running X? why not use tty2-tty6 for a separate user login? -- martin; (greetings from the heart of the sun.) \____ echo mailto: !#^."<*>"|tr "<*> mailto:"; [EMAIL PROTECTED] "in the stage of grand illusion you walked into my life out of my dreams." -- david bowie
pgpstnAXAa1Yw.pgp
Description: PGP signature
