Bug 8127
| Summary: | Any user can shutdown RH 6.x boxen | ||
|---|---|---|---|
| Product: | [Retired] Red Hat Linux | Reporter: | preed |
| Component: | usermode | Assignee: | Michael K. Johnson <johnsonm> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.0 | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2000-01-04 14:13:26 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
preed
2000-01-03 04:20:41 UTC
This is a feature of PAM console. Any user who has access to the console and knows the password of the logged in user can shutdown a Red Hat 6.1 box. I just tested this by logging in remotely through an ssh session, and executing the same string of commands as shown above; the same result occured (a shutdown commenced). I also tested this through an xterm, NOT on the console. I will be testing this more thoroughly on someone else's box tonight, but I wouldn't call something where any Joe Blow user who has access to a RHAT 6.x box can shut it down a "feature." If it is indeed a "feature," how do I turn said "feature" off? it works on rh 6.2 beta too .. usermode-1.19-2 ... i fix this by editing files in /etc/security/console.apps, for example: $ cat halt USER=root PROGRAM=/sbin/halt it works ... i thing that will be more secure distribute package usermode with these fixes ... please ... Are you sure you are not also logged in at the console? The definition of "console" pam_console uses is the physical screen/keyboard combination. If you are logged in on a VT and then start X, you are still logged in at the console. That you are executing the halt command from an xterm is immaterial. The same applies for situations where you log in remotely. If you happen to be logged in at the workstation at the same time, you will be able to execute commands that require access to the console. I just tested this in my RHAT 6.1 box (usermode-1.18-1) where I was ONLY logged in through X (i.e. runlevel 5), and it prompted me for my password, and executed the halt. So, for clarification, I was NOT logged in to a VT. Immaterial of all of this, assuming that because someone is logged in on the console, they should have the right to shut down the machine with their own password is not a "feature." It's a bug, and RHAT should just admit it, and fix it. |