Re: Excessive root usage in Debian
On 30 Oct 1999, John Goerzen wrote:
> Bjoern Brill <brill@samson.math.uni-frankfurt.de> writes:
>
> > > I don't understand why that would be more secure than giving them root
> > > access. Even giving them access to /etc/vimrc would be a security loophole
> > > if root ran vim. Many - maybe most - config files let you run an arbitrary
> > > program at some point.
> > >
> > There are at least three different aspects to consider:
> >
> > 1. protection against security compromises:
> > For this, giving anyone but root administrative power tends to open
> > security leaks. As you said, everybody who can alter config files (or
> > write to raw devices to run fsck or...) can compromise the whole system.
> > So everything you get are more accounts that have to be safeguarded at any
> > price.
>
> This is a logically silly point, since with our existing system this
> people have to be given full root access anyway. How is giving them
> access to a particular user or group less secure, given that the worst
> that could happen is that they could obtain the same access that they
> must have now?
>
No it isn't, but perhaps I haven't expressed it as clearly as possible:
access rights are given to *accounts*, not *people*. The point is that you
get more accounts that could be hacked (by 'third parties') to the effect
that the whole system is compromised.
Your point is rather similar to the item 'social organization' in my
original message and I agree with you there.
Bj"orn Brill <brill@fs.math.uni-frankfurt.de>
Frankfurt am Main, Germany
Reply to: