Bug 2797

Summary:	talkd, ntalkd incorrectly run as root
Product:	[Retired] Red Hat Linux	Reporter:	Chris Evans <chris>
Component:	netkit-base	Assignee:	Jay Turner <jturner>
Status:	CLOSED NEXTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.0	CC:	notting, srevivo
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	1999-08-09 20:15:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Chris Evans 1999-05-13 21:01:07 UTC

Hi

in.ntalkd and in.talkd are launched from inetd.conf with
user field set to "root".

A very simple and obviously correct change can limit the
security damage a hole in either of these daemons will
cause.

In RedHat6.1, please change the "root" field to "talkd.tty".
Group tty is the only special privilege required. "talkd"
should be a new user who owns no files and has a null shell
in /etc/passwd. Don't use the overloaded user "nobody".

This should take someone about, ooh, 10 minutes :-)

Chris

------- Additional Comments From   06/17/99 21:28 -------
i believe theres also a spelling error. waut instead of wait.

Comment 1 Jeff Johnson 1999-08-09 20:09:59 UTC

Fixed in netkit-base-0.10-33.

Comment 2 Jeff Johnson 1999-08-09 20:15:59 UTC

Um, using the overloaded nobody.