Re: Possible Issue with Netinfo and Mac OS X

[Marukka <Marukka () msec net>]

Other issues for OS X is that anyone could boot into single user mode and
have root with out any authentication. Although this usually isn't a problem
for servers, it is for computers used in K12 and higher education along with
kiosks. Also any malicious user could get the password file by making
repeated calls to getpwent(). Im sure apple is aware of issues like this but
they prefer to sell a product that is easy to use instead of a more limited
but secure OS.

On 9/2/01 9:22 PM, "Benjamin Gardiner" <cvisors () off-fw tved net au> wrote:

> I have been using Mac OS X for quite a while now, and I have just
> found something that concerns me a little.
> As you probably know Mac OS X is based on BSD and by default does
> not have any services running (though it is not hard to turn these on)
> thefore is reasonably secure out of the box.
> Now as you may be aware one of the major differnces in the way Mac
> OS X deals with some information, for example the password file in /etc is
> there but not used.  Such things are taken care of via netinfo.
> Anyway to get to the core of the matter, I was looking through the
> file structure, looking at some of the config files, and such, when I
> happened to look in /var/backups in var/backups there was one file called:
> "local.nidump"
>
> This is a file which contains from what I can tell a fair part if not all
> of the information stored in the netinfo database, including users and
> passwords.
>
> Here is the information for a user I created for this purpose:
>
>         "_shadow_passwd" = ( "" );
>         "_writers_passwd" = ( "test" );
>         "hint" = ( "" );
>         "uid" = ( "502" );
>         "_writers_hint" = ( "test" );
>         "gid" = ( "20" );
>         "realname" = ( "test" );
>         "name" = ( "test" );
>         "passwd" = ( "Fnh1eLU0U6o12" );
>         "shell" = ( "/bin/tcsh" );
>         "home" = ( "/Users/test" );
>         "sharedDir" = ( "Public" );
>
>
> The issue is that my user "test" was created without the option to
> administer the system (by default root isn't enabled in Mac OS X.)  This
> user though could access and copy and read this file, via a shell and also
> via ftp (please note again things like ssh and ftp are not started by
> default they have to be enabled in sharing under system preferences.
>
> As I see it and please correct me if I am wrong here, it is a bad idea to
> have such a file acessable to any user of the system, especially since the
> average mac user most likley doesn't understand things as permisions and
> the dangers of having things like ssh, telnet, and ftp  open and giving
> people access to such things, also when a user does enable these services
> there are no warnings that mention the security issues whith said
> services.
>
> Anyway, I hope I am not reading too much into this.
>
> Regards,
>
> Benjamin Gardiner