Thanks for fixing my error. (It is nice when people understand you when you
type silly things :-)
I found the same info as you on chattr (well, use ext2 LOL). But there has to
be a way to protect that file from modification.
Shirkdog
-----Original Message-----
From: atossava@cc.helsinki.fi [mailto:atossava@cc.helsinki.fi]
Sent: Wednesday, September 29, 2004 2:30 AM
To: secureshell@securityfocus.com
Subject: Re: Locking down ssh config in large env
Importance: Low
Michael Shirk (Shirkdog) wrote:
What about the immutable bit "chmod +i .ssh".
If it is root owned, and the immutable bit set, no one can change it.
Root has to unset the bit first. However, it will not be able to update
for new sshd hosts, but that it is a security feature.
Atro, test this on your box and let me know.
root@thisbox /home/username 4 # uname -a
Linux thisbox 2.4.27 #1 Mon Aug 16 15:45:29 EEST 2004 i686 unknown
root@thisbox /home/username 5 # mount
/dev/hda7 on / type reiserfs (rw)
...
root@thisbox /home/username 2 # mkdir pelle
root@thisbox /home/username 3 # chmod +i pelle
chmod: invalid mode
You mean chattr, and according to its manual page, it only works on ext2.
The attribute is set and recorded on reiserfs too (can be viewed with
lsattr), but does not prevent the user from renaming the root-owned
supposedly immutable directory "pelle" in the user's home directory.
Even if it worked across all Linux file systems, which it seems not to
be doing, it is at any rate not portable across UNIX systems and there-
fore not a solution either. I couldn't find anything on Solaris 8 or
HP-UX 10.20 that would do the same (but maybe I wasn't looking hard
enough). IRIX 6.5 has the capabilities system and OSF1 (Tru64) has
the Extended File Attributes which might be applicable.
--
Atro Tossavainen (Mr.) / The Institute of Biotechnology at
Systems Analyst, Techno-Amish & / the University of Helsinki, Finland,
+358-9-19158939 UNIX Dinosaur / employs me, but my opinions are my own.
< URL : http : / / www . helsinki . fi / %7E atossava / > NO FILE ATTACHMENTS
!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+
CryptoMail provides free end-to-end message encryption.
http://www.cryptomail.org/ Ensure your right to privacy.
Traditional email messages are not secure. They are sent as
clear-text and thus are readable by anyone with the motivation
to acquire a copy.
!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+
