Hello, This issue has been already discuted, and Apple is aware of the problem. In fact, you can read from NetInfo using ni-commands, like: Niutil -read . /users/targetuser and it will give you the crypted password (OSX is using crypt()!) or you can nidump . Passwd Somewhat an "exploit" (realbasic app, that just type the command for you via GUI in fact) also exists - see www.securemac.com. The FTP problem (you can access the whole filesystem with any account) is another thing Apple should fix too. (You can configure the FTP by hand too..) Hopes it helps kang On 3/09/01 4:22, "Benjamin Gardiner" <cvisors@off-fw.tved.net.au> wrote: > Hi, > I have been using Mac OS X for quite a while now, and I have just > found something that concerns me a little. > As you probably know Mac OS X is based on BSD and by default does > not have any services running (though it is not hard to turn these on) > thefore is reasonably secure out of the box. > Now as you may be aware one of the major differnces in the way Mac > OS X deals with some information, for example the password file in /etc is > there but not used. Such things are taken care of via netinfo. > Anyway to get to the core of the matter, I was looking through the > file structure, looking at some of the config files, and such, when I > happened to look in /var/backups in var/backups there was one file called: > "local.nidump" > > This is a file which contains from what I can tell a fair part if not all > of the information stored in the netinfo database, including users and > passwords. > > Here is the information for a user I created for this purpose: > > "_shadow_passwd" = ( "" ); > "_writers_passwd" = ( "test" ); > "hint" = ( "" ); > "uid" = ( "502" ); > "_writers_hint" = ( "test" ); > "gid" = ( "20" ); > "realname" = ( "test" ); > "name" = ( "test" ); > "passwd" = ( "Fnh1eLU0U6o12" ); > "shell" = ( "/bin/tcsh" ); > "home" = ( "/Users/test" ); > "sharedDir" = ( "Public" ); > > > The issue is that my user "test" was created without the option to > administer the system (by default root isn't enabled in Mac OS X.) This > user though could access and copy and read this file, via a shell and also > via ftp (please note again things like ssh and ftp are not started by > default they have to be enabled in sharing under system preferences. > > As I see it and please correct me if I am wrong here, it is a bad idea to > have such a file acessable to any user of the system, especially since the > average mac user most likley doesn't understand things as permisions and > the dangers of having things like ssh, telnet, and ftp open and giving > people access to such things, also when a user does enable these services > there are no warnings that mention the security issues whith said > services. > > Anyway, I hope I am not reading too much into this. > > Regards, > > Benjamin Gardiner > > > >
This archive was generated by hypermail 2b30 : Mon Sep 03 2001 - 21:44:37 PDT