Sponsored Content
Top Forums UNIX for Dummies Questions & Answers Security issue and temp files Post 302358277 by pludi on Friday 2nd of October 2009 01:55:55 AM
Old 10-02-2009
Consider this: Your program uses a temporary file with a predictable name, to be used as a log. To this log, you write any input that isn't acceptable. A black-hat hacker now creates a symlink to /etc/passwd, and inputs this to your program:
Code:
toor:aaQSqAReePlq6:0:0::/tmp:/bin/sh

If everything goes well he has now access to a user called "toor" with an empty password and full administration rights. Not good, wouldn't you say?
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Tidying up temp files on exit of script

Hi I believe there is a method to remove all temporary files when a KSH script terminates (either expectedly or unexpectedly). I think is some sort of subroutine you can create that runs when the script exits. Can anyone help me with this please? Many thanks Helen :confused: (2 Replies)
Discussion started by: Bab00shka
2 Replies

2. Shell Programming and Scripting

Script to Delete temp files and check file system

Hi all, new to the threads as well as Unix/Linux. I need to create a script that will delete any temporary files as well as check the files on the system for errors or corruption. This is what I have so far and I'm sure that I'm missing things or have the wrong commands. I'm not sure where to go... (3 Replies)
Discussion started by: Bwood1377
3 Replies

3. Shell Programming and Scripting

Joining 3 AWK scripts to avoid use "temp" files

Hi everyone, Looking for a suggestion to improve the below script in which I´ve been working. The thing is I have 3 separated AWK scripts that I need to apply over the inputfile, and for scripts (2) and (3) I have to use a "temp" file as their inputfile (inputfile_temp and inputfile_temp1... (2 Replies)
Discussion started by: cgkmal
2 Replies

4. UNIX for Dummies Questions & Answers

Temp mysql files jamming CPU resources

Hello Friends I am currently facing high CPU usage problem which is making my site extremely slow. Currently I am using a 8GB RAM with 8 cores but, the creation of temporary files is eating away a lot of the CPU resource making the site very slow. The normal CPU load average remains below 2-3... (5 Replies)
Discussion started by: egully
5 Replies

5. Shell Programming and Scripting

temp files

Hi there, As a regular unix user I am forever programming on the command line or writing scripts so that I first write a load of data to a file to read from. In the end I am always left with a bundle of .txt, .tmp which is what I usually call them. As a basic programmmer I was wondering is... (6 Replies)
Discussion started by: cyberfrog
6 Replies

6. Shell Programming and Scripting

Script to temp create files more than inode limit

HI, I am from testing background. I have a scenario of a file generation, through cronjob, on a defined path. After I fill the data as 100 % utilized, my application is generating an empty file on the defined path. # df -kh Filesystem Size Used Avail Use% Mounted on... (3 Replies)
Discussion started by: atulbassi83
3 Replies

7. OS X (Apple)

Safari Temp Internet Files Location

I'm looking for help with finding where plugin data and other page resources are stored on the hard disk in safari 6.0. With the new update, the activity window has been merged into the develop menu under "show page resources" and one cannot access them directly. I tried running opensnoop to see... (3 Replies)
Discussion started by: sakurashinken
3 Replies

8. Shell Programming and Scripting

Backup shell script created temp files .

Hi, I've a script which creates a temp flat file for storing all business dates received on a single day from diff control files sent by source system on that day. e.g on 12th april I receive txns for business day 8,9,10,11 april. I capture this business day and append to a flat file from... (1 Reply)
Discussion started by: manojg9
1 Replies

9. Shell Programming and Scripting

RMTF (ReMove Temp Files)

Heyas As some applications (sed,grep,vi, etc) create some tempfiles, i'd changed a script to this: (sadly i cant find the original post (code) anymore (which just removed 2 'diffrent kinds'), just similar ones - forgot that as i was new to all this) :) ~ $ cat $(which rmtf) #!/bin/sh #... (1 Reply)
Discussion started by: sea
1 Replies

10. Shell Programming and Scripting

Removing large number of temp files

Hi All, I am having a situation now to delete a huge number of temp files created during run times approx. 16700+ files. We have never imagined that we will get this this much big list of files during run time. It worked fine for lesser no of files in the list. But when list is huge we are... (7 Replies)
Discussion started by: mad man
7 Replies
d_passwd(4)							   File Formats 						       d_passwd(4)

NAME
d_passwd - dial-up password file SYNOPSIS
/etc/d_passwd DESCRIPTION
A dial-up password is an additional password required of users who access the computer through a modem or dial-up port. The correct pass- word must be entered before the user is granted access to the computer. d_passwd is an ASCII file which contains a list of executable programs (typically shells) that require a dial-up password and the associ- ated encrypted passwords. When a user attempts to log in on any of the ports listed in the dialups file (see dialups(4)), the login program looks at the user's login entry stored in the passwd file (see passwd(4)), and compares the login shell field to the entries in d_passwd. These entries determine whether the user will be required to supply a dial-up password. Each entry in d_passwd is a single line of the form: login-shell:password: where login-shell The name of the login program that will require an additional dial-up password. password An encrypted password. Users accessing the computer through a dial-up port or modem using login-shell will be required to enter this password before gaining access to the computer. d_passwd should be owned by the root user and the root group. The file should have read and write permissions for the owner (root) only. If the user's login program in the passwd file is not found in d_passwd or if the login shell field in passwd is empty, the user must sup- ply the default password. The default password is the entry for /usr/bin/sh. If d_passwd has no entry for /usr/bin/sh, then those users whose login shell field in passwd is empty or does not match any entry in d_passwd will not be prompted for a dial-up password. Dial-up logins are disabled if d_passwd has only the following entry: /usr/bin/sh:*: EXAMPLES
Example 1: Sample d_passwd file. Here is a sample d_passwd file: /usr/lib/uucp/uucico:q.mJzTnu8icF0: /usr/bin/csh:6k/7KCFRPNVXg: /usr/bin/ksh:9df/FDf.4jkRt: /usr/bin/sh:41FuGVzGcDJlw: Generating An Encrypted Password The passwd (see passwd(1)) utility can be used to generate the encrypted password for each login program. passwd generates encrypted pass- words for users and places the password in the shadow (see shadow(4)) file. Passwords for the d_passwd file will need to be generated by first adding a temporary user id using useradd (see useradd(1M)), and then using passwd(1) to generate the desired password in the shadow file. Once the encrypted version of the password has been created, it can be copied to the d_passwd file. For example: 1. Type useradd tempuser and press Return. This creates a user named tempuser. 2. Type passwd tempuser and press Return. This creates an encrypted password for tempuser and places it in the shadow file. 3. Find the entry for tempuser in the shadow file and copy the encrypted password to the desired entry in the d_passwd file. 4. Type userdel tempuser and press Return to delete tempuser. These steps must be executed as the root user. FILES
/etc/d_passwd dial-up password file /etc/dialups list of dial-up ports requiring dial-up passwords /etc/passwd password file /etc/shadow shadow password file SEE ALSO
passwd(1), useradd(1M), dialups(4), passwd(4), shadow(4) WARNINGS
When creating a new dial-up password, be sure to remain logged in on at least one terminal while testing the new password. This ensures that there is an available terminal from which you can correct any mistakes that were made when the new password was added. SunOS 5.10 2 Sep 2004 d_passwd(4)
All times are GMT -4. The time now is 11:11 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy