Re: user for getting files
On Fri, 22 Nov 2002 23:06, John H. Robinson, IV wrote:
> you never want a file owned by nobody. services that do not need any
> elevated privedges should run as nobody, so if they are compromised,
> then can do nothing. if you download a file as nobody, then a
> compromised nobudy-running daemon can then trojan that file. bad.
Daemons should not run as nobody, they should run as their own unique UID.
A daemon running as nobody can ptrace any other daemon running as nobody and
do other interesting things too, unless of course you are running grsec, SE
Linux, or some other system for advanced security.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
Reply to: