Re: DNS and cats: Password leaks are security holes

2008-08-28 Thread Simon Valiquette
W. Martin Borgert un jour écrivit: On 2008-08-28 20:40, Simon Valiquette wrote: That's obviously true, but that doesn't cover the case when logs are copied to a second system with sysadmins that doesn't have access to the first server. And if someone use the standard 514 syslog port instead

DNS and cats: Password leaks are security holes

2008-08-28 Thread W. Martin Borgert
On 2008-08-28 20:40, Simon Valiquette wrote: > That's obviously true, but that doesn't cover the case when logs are > copied to a second system with sysadmins that doesn't have access to the > first server. And if someone use the standard 514 syslog port instead of > using an SSL tunnel or th

Please add Debian Security Advisory info for CVE-2008-2812

2008-08-28 Thread Hideki Yamane
Hi, Please add Debian Security Advisory info for CVE-2008-2812. http://www.debian.org/security/2008/dsa-1630 and if there is no page for the vulnerability, please check http://lists.debian.org/debian-security-announce/ , then link to mail archive. Thanks. -- Regards, Hideki Yamane

Re: Password leaks are security holes

2008-08-28 Thread Simon Valiquette
A. Dreyer un jour écrivit: On Thu, 28 Aug 2008, Johan Walles wrote: Anyway root already has the capability to view passwords (i.e. by installing alternate login programs, sniffing tty, ...) That's obviously true, but that doesn't cover the case when logs are copied to a second system with

Re: Password leaks are security holes

2008-08-28 Thread Giles Barford
Hi, It is not often that I post but 1) Logging invalid usernames which can be used to detect all manor of attacks including dictionary username attacks and password brute force attacks. 2) As pointed out earlier the file is root only access. The argument that can be read if you physical ac

Re: Bug#311772: Fwd: Password leaks are security holes

2008-08-28 Thread Mark van Walraven
On Thu, Aug 28, 2008 at 02:37:37PM -0700, Steve Langasek wrote: > On Thu, Aug 28, 2008 at 09:36:41AM +0200, Giacomo A. Catenazzi wrote: > > auth.log was invented for this reason, and separated to standard log: > > it should be readable only by root, > > Then there is a bug in another package if th

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Simon Valiquette
Nico Golde un jour écrivit: Hi Johan, * Johan Walles <[EMAIL PROTECTED]> [2008-08-28 13:14]: 2008/8/28 Giacomo A. Catenazzi <[EMAIL PROTECTED]>: [...] So auth.log should log usernames, so that users don't do wrong assumption that password are not accessible by root! I can see a point in loggi

Re: Bug#311772: Fwd: Password leaks are security holes

2008-08-28 Thread Michael Stone
On Thu, Aug 28, 2008 at 02:37:37PM -0700, Steve Langasek wrote: On Thu, Aug 28, 2008 at 09:36:41AM +0200, Giacomo A. Catenazzi wrote: auth.log was invented for this reason, and separated to standard log: it should be readable only by root, Then there is a bug in another package if this is what

Re: Bug#311772: Fwd: Password leaks are security holes

2008-08-28 Thread Steve Langasek
On Thu, Aug 28, 2008 at 09:36:41AM +0200, Giacomo A. Catenazzi wrote: > auth.log was invented for this reason, and separated to standard log: > it should be readable only by root, Then there is a bug in another package if this is what "should" be, because /var/log/auth.log is readable by group adm

Re: Fwd: Password leaks are security holes

2008-08-28 Thread W. Martin Borgert
On 2008-08-28 13:05, Johan Walles wrote: > It's readable by anybody with physical access to the hardware. If their have physical access to the hardware, auth.log would be my least worry. > That doesn't mean Debian should *help* root doing that in a default > install. Security by default, anybody

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Mark Brown
On Thu, Aug 28, 2008 at 01:05:19PM +0200, Johan Walles wrote: > 2008/8/28 Giacomo A. Catenazzi <[EMAIL PROTECTED]>: > > auth.log was invented for this reason, and separated to standard log: > > it should be readable only by root, because users do errors. > It's readable by anybody with physical a

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Stephen Gran
This one time, at band camp, Johan Walles said: > 2008/8/28 Giacomo A. Catenazzi <[EMAIL PROTECTED]>: > > Johan Walles wrote: > >> Security shouldn't be based on nobody ever doing more or less common > >> mistakes. > > > > auth.log was invented for this reason, and separated to standard log: > > it

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Giacomo A. Catenazzi
Mark Brown wrote: On Thu, Aug 28, 2008 at 01:05:19PM +0200, Johan Walles wrote: 2008/8/28 Giacomo A. Catenazzi <[EMAIL PROTECTED]>: auth.log was invented for this reason, and separated to standard log: it should be readable only by root, because users do errors. It's readable by anybody wi

Re: Fwd: Password leaks are security holes

2008-08-28 Thread A. Dreyer
On Thu, 28 Aug 2008, Johan Walles wrote: > 2008/8/28 Giacomo A. Catenazzi <[EMAIL PROTECTED]>: > > Johan Walles wrote: > >> Security shouldn't be based on nobody ever doing more or less common > >> mistakes. > > > > auth.log was invented for this reason, and separated to standard log: > > it shoul

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Nico Golde
Hi Johan, * Johan Walles <[EMAIL PROTECTED]> [2008-08-28 13:14]: > 2008/8/28 Giacomo A. Catenazzi <[EMAIL PROTECTED]>: [...] > > So auth.log should log usernames, so that users don't do > > wrong assumption that password are not accessible by root! > > I can see a point in logging *valid* usernam

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Johan Walles
2008/8/28 Giacomo A. Catenazzi <[EMAIL PROTECTED]>: > Johan Walles wrote: >> Security shouldn't be based on nobody ever doing more or less common >> mistakes. > > auth.log was invented for this reason, and separated to standard log: > it should be readable only by root, because users do errors. It

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Nico Golde
Hi Johan, * Johan Walles <[EMAIL PROTECTED]> [2008-08-28 11:46]: > Let's keep debian-security in the discussion to see what others have > to say about this. > > Technically I agree with you when you say that people shouldn't enter > anything but their usernames at the login prompt, but the fact is

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Dirk Hartmann
--On Thursday, August 28, 2008 09:03:05 +0200 Johan Walles <[EMAIL PROTECTED]> wrote: Let's keep debian-security in the discussion to see what others have to say about this. you try to solve a non-technical problem in a technical way. Dirk -- [EMAIL PROTECTED] -- To UNSUBSCRIBE, email

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Giacomo A. Catenazzi
Johan Walles wrote: Hi Nico! Let's keep debian-security in the discussion to see what others have to say about this. Technically I agree with you when you say that people shouldn't enter anything but their usernames at the login prompt, but the fact is that people (like me and the bug submitter

Fwd: Password leaks are security holes

2008-08-28 Thread Johan Walles
Hi Nico! Let's keep debian-security in the discussion to see what others have to say about this. Technically I agree with you when you say that people shouldn't enter anything but their usernames at the login prompt, but the fact is that people (like me and the bug submitter for example) *do* ent