also sprach Adam Warner <lists@consulting.net.nz> [2002.01.19.2304 +0100]:
> Firstly the servers are physically secure and there is no relevant issue
> about having a local root console open for administration purposes.
mh. no comment. sure, if physical access would be available, no box is
secure. but having a root login right there only means that an intruder
wouldn't have to reboot the box (which is noticeable), he could just
leave a backdoor in as little as 30 seconds.
don't do it.
> The question I have is if I "su - username" and then browse the web,
> etc. is it impossible for a remote user who managed to gain access to
> that user session to become root by exiting out of the user account?
>
> I'm almost certain the answer should be no. But I'd just like
> confirmation.
no. he'd have to steal your actual tty session, and if all you are doing
is surfing the web, then he can't really do that. however, which browser
are you using? are you running X? why not use tty2-tty6 for a separate
user login?
--
martin; (greetings from the heart of the sun.)
\____ echo mailto: !#^."<*>"|tr "<*> mailto:"; net@madduck
"in the stage of grand illusion
you walked into my life
out of my dreams."
-- david bowie
Attachment:
pgpryRcZTIl9q.pgp
Description: PGP signature