Re: Open then gates
* Christoph Anton Mitterer <calestyo@scientia.net> [100515 12:53]:
> > If regular users can add other people to groups on your system, you have
> > way more serious security problems than user-private groups, and those
> > security problems are not created by Debian.
> Of course I talk about having this done by root.
> It seems you do not have experience with systems with several thousands
> of users, do you?
> If I'm e.g. a root user at my university, or an empowered registration
> authority for CERN,... I really cannot check whether what my users ask
> is sane.
> If user B says, please add user A to my group... I'll do it as long as
> no system user/group is involved.
Sorry, adding one user to the group of another is almost as stupid as
adding a script in /etc/cron.daily writeable by some user.
> > But that's your misconfiguration, not
> > something Debian did.
> Honestly,... real world is different... see my example above in big
> organisations, consider the fact that users have typically no idea what
> they doing...
Especially in large organisations all that "umask 022" is an extreme
pain. Finally having a sane default umask will help things here, though
I fear there are still enough other programs hardcoding 022 as if there
still were the 80ties of the last century...
Having a sane working configuration in which things that should work
work and things that should not work do not work is the best security.
Especially in large installations just having everything work and people
can just collaborate and write to the project directories and what
people write into project directories is project-writeable is the best
security: Remember that not-tech-savy users also do not know how to
properly give permissions. So if you lock things down more than needed,
all you get is people doing chmod 777 file, because that is what
obviously works...
Hochachtungsvoll,
Bernhard R. Link
Reply to: