Ada yg tahu ini?



  • cb check di mesin om" skalian ya :D

    punyaku begini

    /root(1): cat /etc/passwd

    $FreeBSD: src/etc/master.passwd,v 1.39 2004/08/01 21:33:47 markm Exp $

    root::0:0:Charlie &:/root:/bin/sh
    toor:
    :0:0:Bourne-again Superuser:/root:
    daemon::1:1:Owner of many system processes:/root:/usr/sbin/nologin
    operator:
    :2:5:System &:/:/usr/sbin/nologin
    bin::3:7:Binaries Commands and Source:/:/usr/sbin/nologin
    tty:
    :4:65533:Tty Sandbox:/:/usr/sbin/nologin
    kmem::5:65533:KMem Sandbox:/:/usr/sbin/nologin
    games:
    :7:13:Games pseudo-user:/usr/games:/usr/sbin/nologin
    news::8:8:News Subsystem:/:/usr/sbin/nologin
    man:
    :9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin
    sshd::22:22:Secure Shell Daemon:/var/empty:/usr/sbin/nologin
    smmsp:
    :25:25:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin
    mailnull::26:26:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin
    bind:
    :53:53:Bind Sandbox:/:/usr/sbin/nologin
    proxy::62:62:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin
    _pflogd:
    :64:64:pflogd privsep user:/var/empty:/usr/sbin/nologin
    www::80:80:World Wide Web Owner:/nonexistent:/usr/sbin/nologin
    nobody:
    :65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin
    dhcpd::1002:1002:DHCP Daemon:/nonexistent:/sbin/nologin
    admin:
    :0:0:System Administrator:/root:/etc/rc.initial
    _dhcp::65:65:dhcp programs:/var/empty:/usr/sbin/nologin
    _isakmpd:
    :68:68:isakmpd privsep:/var/empty:/sbin/nologin
    uucp::66:66:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico
    pop:
    :68:6:Post Office Owner:/nonexistent:/usr/sbin/nologin
    _ntp::123:123:NTP daemon:/var/empty:/sbin/nologin
    _relayd:
    :913:913:Relay Daemon:/var/empty:/usr/sbin/nologin
    squid:💯100:Squid caching-proxy pseudo user:/usr/local/squid:/usr/sbin/nologin
    unbound:
    :59:1:unbound dns resolver:/nonexistent:/usr/sbin/nologin

    itu user root ada charlie na mungkin itu cmn description aja tp bagaimana dgn user "toor" ? user yg handle bash ato apa ya ini?



  • Threat ini sdh di jawab di general discusion. 
    http://forum.pfsense.org/index.php?topic=53429.msg285675#new

    Gampangnya ngomong lihat lagi dasar2 Unix



  • yup bener pak dhe, sy biasana di linux yg notabene unix-like dan jelas bukan unix, harus banyak belajar nih saya :D

    kira" apakah semua derivative unix melakukan hal yg sama untuk alternate login toor jika akun root ter-locked ya pakdhe?



  • Ya, krna toor sepertinya sengaja dibuat sbgai login alternatif.
    Slah satunya pertibangan keamanan.

    Nah ini artikel menarik :

    Toor, the word "root" spelled backwards, is an alternative superuser account in Unix-like operating systems, particularly BSD and variants.

    Purpose

    In Unix, it is traditional to keep the root filesystem as small as reasonably possible, moving larger programs and rapidly-changing data to other, optional parts of the system. This increases the likelihood that the system can be brought to a semi-usable state in the case of a partial system failure. It also means that the superuser account, necessary for repairing a broken system, should not depend on any programs outside of this small core. To this end, the root account is often configured with a shell which is small, efficient, and dependable, but awkward for daily use.

    The toor account is intended as a solution to this problem. It is identical to root, but is configured to use a different, more featureful shell.

    Alternately, toor may be configured with the emergency shell, allowing root the freedom to use the featureful one.

    Implementation

    In a Unix-like system, each user has a user ID number, which is what the kernel uses to distinguish users and to manage user permissions. User ID #0 is reserved as the superuser account, and is given permission to do anything on the system.

    Users log in by username, not by ID number, and a user's choice of login shell is also managed by name. This separation between name and number allows a given user ID to be associated with more than one username, each having its own shell.

    Security considerations

    The presence of a 'toor' account (or the presence of more than one account with a user ID of 0) triggers a warning in many security auditing systems. This is valuable, since if the system administrator did not intend for a second superuser account, then it may mean that the system has been compromised.

    It may be argued that even an intentional 'toor' account is a security risk, since it provides a second point of attack for someone trying to illicitly gain superuser privileges on the system. However, if passwords are chosen and guarded carefully, the risk increase is minimal.

    For example, NetBSD ships with a disabled 'toor' account, meaning that there is no password with which one can log into the system as 'toor'. This is not a security risk in itself, though it may generate security warnings as previously described. However, if the system is compromised, an administrator may be less likely to notice the enabling of a disabled account than the creation of a new one, especially if he has become accustomed to ignoring warnings about 'toor' from his (arguably misconfigured) security program.
    (http://en.m.wikipedia.org/wiki/Toor_(Unix))


Log in to reply