Bug 9803

Summary: Sulogin bypass
Product: [Retired] Red Hat Linux Reporter: Panos Kavalagios <p.kavalagios>
Component: SysVinitAssignee: Bill Nottingham <notting>
Status: CLOSED RAWHIDE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 6.1CC: p.kavalagios, rvokal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2000-04-18 17:17:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Panos Kavalagios 2000-02-26 10:47:53 UTC 
Hello,

   When you start all Red Hat Linux versions with "linux single" or "linux
S" or "linux S" or "linux 1" to boot into a single user mode, you get a
nice root prompt. I used to overcome this security issue, with the
following line in /etc/inittab:

lS:Ss:wait:/sbin/sulogin

and every time the system entered in single user mode (except runlevel 1,
which I had to put the sulogin as the last command in
/etc/rc.d/init.d/single) it prompted for a root password or <ctrl>-D for a
normal startup. To my surprise, I discovered that pressing a simple
<ctrl>-C in the password prompt of sulogin program, it gives you a root
prompt again! This is an undesirable result and I would suggest to be
fixed as soon as possible.

   Thank you very much in advance.

King Regards,
Panos Kavalagios

P.S. According to /etc/rc.d/rc.sysinit, sulogin runs after an fsck failure,
which is really no need since a root bash prompt can be obtained so easily.
Comment 1 Bill Nottingham 2000-04-18 17:17:59 UTC 
Fixed in SysVinit-2.78-6 - thanks for the bug report.