O'Reilly - Practical UNIX & Internet Sec... 7015KB

Chapter 15
UUCP
15.6 Additional Security Concerns
UUCP is often set up by UNIX vendors in ways that compromise security. In addition to the concerns
mentioned in earlier sections, there are a number of other things to check on your UUCP system.
15.6.1 Mail Forwarding for UUCP
Be sure when electronic mail is sent to the uucp user that it is actually delivered to the people who are
responsible for administering your system. That is, there should be a mail alias for uucp that redirects
mail to another account. Do not use a .forward file to do this. If the file is owned by uucp, the file could
be altered to subvert the UUCP system. Instead, use whatever other alias mechanism is supported by
your mailer.
15.6.2 Automatic Execution of Cleanup Scripts
The UUCP system has a number of shell files that are run on a periodic basis to attempt to redeliver old
mail and delete junk files that sometimes accumulate in the UUCP directories.
On many systems, these shell files are run automatically by the crontab daemon as user root, rather than
user uucp. On these systems, if an attacker can take over the uucp account and modify these shell scripts,
then the attacker has effectively taken over control of the entire system; the next time crontab runs these
cleanup files, it will be executing the attacker's shell scripts as root!
You should be sure that crontab runs all uucp scripts as the user uucp, rather than as the user root.
However, the scripts themselves should be owned by root, not uucp, so that they can't be modified by
people using the uucp programs.
If you are running an ancient version of cron that doesn't support separate files for each account, or that
doesn't have an explicit user ID field in the crontab file, you should use a su command in the crontab file
to set the UID of the cleanup process to that of the UUCP login. Change:
0 2 * * * /usr/lib/uucp/daily
to:
[Chapter 15] 15.6 Additional Security Concerns
0 2 * * * su uucp -c /usr/lib/uucp/daily
On somewhat newer crontab systems that still don't support a separate crontab file for each user, change
this:
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch15_06.htm (1 of 2) [2002-04-12 10:45:00]