UNIX for Beginners Questions & Answers

Code:

$ finger yeti                                      
Login: yeti                             Name: yeti
Directory: /arpa/tz/y/yeti              Shell: /bin/ksh
On since Wed Apr  2 15:24 (UTC) on pts/149
Mail last read Mon Mar 31 11:08 2014 (UTC)
No Plan.

Hi there,

I am trying to understand how does the finger dameon derives the information it returns and how it can be abused.

Moderator's Comments:

Please wrap all code, files, input & output/errors in CODE tags. It makes is far easier to read a preserves leading/multiple spaces for indenting or fixed width data.

finger/fingerd gives away information about users that it retrieves from a local or remote system, from the passwd file, home directory, login information. Information like name, login name, possibly even an email address and when a user recently logged in. It can be used to check if a user exists and can be a source for social engineering. There were also some security holes in the past.

The service fingerd offers the connection when querying across the network. I'm not aware of any requirement to authenticate, but I'm sure I will be corrected if I'm wrong. This might pass some information (userids) that you do not wish to share in plain text. It would be more secure to have the service disabled and get the information (if you require it) with an ssh based command, such as:-

Code:

ssh ServerB finger > /tmp/ServerB.finger-output

I hope that this helps,
Robin