LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-31-2003, 06:48 PM   #1
hotrodowner
Member
 
Registered: Mar 2002
Distribution: Too many to count
Posts: 368

Rep: Reputation: 30
Built in accounts a threat?


Could the built in accounts that come with Red Hat linux and other distros be used to gain access to a system <such as ssh>?
The built in accounts I refer to are:
bin, daemon, lp, games, rpm, ftp, squid, gopher, etc.
 
Old 05-31-2003, 07:09 PM   #2
fancypiper
LQ Guru
 
Registered: Feb 2003
Location: Sparta, NC USA
Distribution: Ubuntu 10.04
Posts: 5,141

Rep: Reputation: 60
Not the accounts as they are set up to provide security

The servers you have running can be used, however if you are running them and they aren't needed. Don't run an ftp server, for example, unless you know exactly what you are doing.
 
Old 05-31-2003, 07:31 PM   #3
hotrodowner
Member
 
Registered: Mar 2002
Distribution: Too many to count
Posts: 368

Original Poster
Rep: Reputation: 30
well, I'm using squid, ssh, vsftpd, apache, samba and I want to use postfix (I havn't got it working yet though, see: my other post I dont know exactly what I'm doing on any of these, but I like the functionality they give me. I have a dsl-modem between my computer and the internet, so I dont think samba will be a problem. Are the default users and settings for vsftpd, apache, ssh, and postfix a security risk?
 
Old 05-31-2003, 11:40 PM   #4
fancypiper
LQ Guru
 
Registered: Feb 2003
Location: Sparta, NC USA
Distribution: Ubuntu 10.04
Posts: 5,141

Rep: Reputation: 60
Here are some good security guides.

# Basic security
Linux Questions Security references
Security Help Files
Firewalls and Security

Last edited by fancypiper; 05-31-2003 at 11:46 PM.
 
Old 06-01-2003, 05:49 AM   #5
jdc2048
Member
 
Registered: Jul 2002
Distribution: Redhat, Gentoo, Solaris, HP-UX, etc...
Posts: 391

Rep: Reputation: 30
Quote:
Originally posted by hotrodowner
... I have a dsl-modem between my computer and the internet, so I dont think samba will be a problem. ...
I am kinda curious as to your reasoning here. What kind of protections does a dsl-modem offer?

I personally would not put up any kind of file-sharing server without a solid firewall between the internet and my file-server. My current setup involves a dsl-modem connected to a Cable/DSL router doing NAT to my computers. I know the NAT provides some security-by-obscurity for me, but I still don't trust that and turn off all unnecessary services. Why risk it, you know.
 
Old 06-01-2003, 06:12 AM   #6
Proud
Senior Member
 
Registered: Dec 2002
Location: England
Distribution: Used to use Mandrake/Mandriva
Posts: 2,794

Rep: Reputation: 116Reputation: 116
Quote:
Originally posted by hotrodowner
well, I'm using squid, ssh, vsftpd, apache, samba and I want to use postfix (I havn't got it working yet though, see: my other post I dont know exactly what I'm doing on any of these, but I like the functionality they give me. I have a dsl-modem between my computer and the internet, so I dont think samba will be a problem. Are the default users and settings for vsftpd, apache, ssh, and postfix a security risk?
Squid is a web cache-ing system, unlikely that you need it with a cable connection for yourself.
SSH would allow remove users to securely log in to your machine, again very unlikely you need this.
vsftpd sounds like an ftp deamon, allowing others to browse files on your machine.
apache is the best web server, but do you have a site?
samba allows windows and linux machines to share files and things like printers. Yet again, do you need to allow another machine to use these things?
postfix is a Mail Transfer Agent iirc. If you use web based email (hotmail) or download your email via a POP3 account or something, you dont need to run your own email server.

It's great to learn how to set up and run each of these, but at least ensure you have a very secure firewall system running and you're using the latest bugfixed and updated versions of each piece of software before connecting it to the internet. Testing them on an isolated home network might be a better and safer plan.
 
Old 06-01-2003, 09:08 AM   #7
markus1982
Senior Member
 
Registered: Aug 2002
Location: Stuttgart (Germany)
Distribution: Debian/GNU Linux
Posts: 1,467

Rep: Reputation: 46
Well if you do NOT require the account you can also delete it. I've deleted a couple of users/group I will NOT require. Like games, etc. Well at a Linux system that will act a server ...
 
Old 06-01-2003, 02:31 PM   #8
hotrodowner
Member
 
Registered: Mar 2002
Distribution: Too many to count
Posts: 368

Original Poster
Rep: Reputation: 30
1) the DSL modem only forwards ip addresses <or in my case port connections> that I want forwarded. (only ports 21, 22 and 80 are forwarded right now.)
2) I DO need most of those services. I need vsftpd so I can download my WinSCP and windows version of ssh on any computer I use. I need SSH so I can download and upload files from any computer I use <IE: college campus ones>. I need samba so I can use my files on this one computer from my windows machines. I need apache so I can have my own web site <used for later>. I need postfix to learn how to configure an email server (which I have YET to learn!!).
3) I dont know which accounts I need running, I though I didn't need the lp user, till I tried to print!!

Last edited by hotrodowner; 06-01-2003 at 02:32 PM.
 
Old 06-02-2003, 04:24 AM   #9
Robert0380
LQ Guru
 
Registered: Apr 2002
Location: Atlanta
Distribution: Gentoo
Posts: 1,280

Rep: Reputation: 47
to answer your original question: the answer for now is NO, those built in accounts dont have the ability to "log in". You cant ssh to your box and put in user: rpm and a password and expect to get in. I'd leave em alone unless you just dont like it.
 
Old 06-02-2003, 06:38 AM   #10
hotrodowner
Member
 
Registered: Mar 2002
Distribution: Too many to count
Posts: 368

Original Poster
Rep: Reputation: 30
Thankyou, that was my worry; was that someone would be able to login to my compuer as a built in account, and then take advantage of a local security flaw and become root. Thank you for your simple answer!!
 
Old 06-02-2003, 08:20 AM   #11
frieza
Senior Member
 
Registered: Feb 2002
Location: harvard, il
Distribution: Ubuntu 11.4,DD-WRT micro plus ssh,lfs-6.6,Fedora 15,Fedora 16
Posts: 3,233

Rep: Reputation: 406Reputation: 406Reputation: 406Reputation: 406Reputation: 406
actually, as they have said, you can't log in as them,they are pseudo accounts, not real users, they have a good purpose, which i havn't seen mentioned in this trhead and that purpose is to minimize the number of root processes that can be hijacked by malicious users, so i would leave them there.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
samba accounts/ unix accounts Buzz88 Linux - Newbie 3 09-25-2005 08:16 AM
corba threat rohit-sk Programming 2 07-28-2005 06:02 AM
qmail -- new accounts can't receive mail, but old accounts can b:z *BSD 1 07-13-2005 12:42 AM
built-to-order PC or ready-built PC from well-known companies? kpachopoulos General 6 11-03-2004 03:14 PM
if i get an nforce mobo with built-in VGA... will the built in vga work in linux? kublador Linux - Hardware 2 11-10-2003 08:26 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:13 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration