> There's a possible security problem using auto idle logout programs and vt > lockers. > Try the following: > get the pid of your shell, > (sleep 10s ; kill -HUP <pid-of-your-shell) & > vlock -a > > after vlock -a, you can't change the virtual console on a Linux terminal. > But if you log in, start vlock -a, enter your password you can change > vt... > > The same happens when an auto idle logout program logs you off. The vlock > (maybe lockvt also) program doesn't terminate itself after a SIGHUP, > which is ok, but after this, anyone can log in, start vlock -a, enters > his/her password, and get full access to the console. > > Possible solutions: > - don't use vlock/lockvt > - don't use auto idle logout program > - as root, never leave your terminal. log off. > if you want to leave, use screen, detach it and log out. Are there any known security issues with 'screen'? I personally suggest patching the sources to force it to put its socket (unix domain) in ~/tmp/.screen --- so users can make sure that the directory has appropriate permissions. Has anyone vette'd the code? -- Jim Dennis (800) 938-4078 consultingat_private Proprietor, Starshine Technical Services: http://www.starshine.org
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:55:56 PDT