Re: Bug#4673: ppp insecure
On Fri, 25 Oct 1996, Bruce Perens wrote:
bruce >Can the user change what connect script is used using command-line
bruce >arguments? The man page seems to state this. If you can do that without
bruce >being root, the program should not be setuid.
You cannot change a connect script specified in /etc/ppp/options from the
commandline.
The trouble with specifying a connect script in /etc/ppp/options is that
it cannot be overridden at all. An incoming call will fail because it
tries to run the connect script. Thus my package has moved calling the
connect script into a separate location. That should not be a problem if
the /etc/ppp/options.ttySx is correctly setup or another security option
has been given in /etc/ppp/options to enforce authentication though
pap-secrets or chap-secrets.
--- +++ --- +++ --- +++ --- +++ --- +++ --- +++ --- +++
--- PGP Public Key = FB 9B 31 21 04 1E 3A 33 C7 62 2F C0 CD 81 CA B5
--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-devel-REQUEST@lists.debian.org . Trouble? e-mail to Bruce@Pixar.com
Reply to: