panther security hole???

feetyouwell · 04-13-2004, 08:55 AM

In the default setting of apple os 10.3, at the start up, if you press command + s, then it login you into a terminal session automatically as ROOT!!!!!!!!!! (just let you know, when i was in the netinfo, it tells me the root is DISABLED)
How do you fix that?
Also, in the netinfo, you can't see people's encrypted passwd, where can you go and get that?
thanks

Jim.DiGriz · 04-13-2004, 12:00 PM

http://www.macosxhints.com/article.p...01217230925152

See the discussion in this thread about the difficulties of securing a box an attacker has extended physical access to.

What they suggest is use the Open firmware password utility found at Apple's site to disable booting in single user mode, which is what you're doing with the command-s. However as they state, if you forget THAT password you're screwed, as of course, you won't be able to zap the PRAM anymore, or boot in single user mode, or any number of other things, which could be problematic.

See also some of the links like Open Firmware: Password Not Recognized When It Contains the Letter "U"

and Open Firmware: Password Not Recognized When Using Keyboard Layout Other Than U.S.

feetyouwell · 04-13-2004, 03:50 PM

uh-ha, apple should fix this, in my opinion. Otherwise, whoever has to maintain a mac lab with several "smart" students is going to have heck of a time to keep the machines up.

Question

o you know any command line tools to create / manage users in panther?

Also an interesting phoenomena,

When i first using panther (with root disabled by default), i can't do ">console" at login window, after i enabled root, ">console" is enabled as well.

mcleodnine · 04-13-2004, 04:52 PM

moved to the General forum.

witeshark · 04-13-2004, 06:15 PM

It would be weird if the last security updates didn't cover that

Jim.DiGriz · 04-19-2004, 10:03 AM

For those command line tools for OSX see http://www.osxgnu.org.

And best of luck, because Windows Mac or Linux, maintaining a lab for a group of motivated "smart" students is going to be a security challenge deluxe. I definitely recommend bios passwords, bootloader passwords, and ready-to-go system images all around.