From 84862aaf07d9f4adeb22f902d62e226b90c4fdfd Mon Sep 17 00:00:00 2001 From: Valentino Vaschetto Date: Wed, 12 Sep 2001 21:51:14 +0000 Subject: [PATCH] Whitespace only commit. Let Emacs rewrap the paragraphs after adding tags in the previous commit. Reviewed by: chern --- .../books/handbook/security/chapter.sgml | 67 ++++++++++--------- 1 file changed, 36 insertions(+), 31 deletions(-) diff --git a/en_US.ISO8859-1/books/handbook/security/chapter.sgml b/en_US.ISO8859-1/books/handbook/security/chapter.sgml index f41a708139..dd9497d317 100644 --- a/en_US.ISO8859-1/books/handbook/security/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/security/chapter.sgml @@ -1,7 +1,7 @@ @@ -378,28 +378,30 @@ The prudent sysadmin only runs the servers he needs to, no more, no less. Be aware that third party servers are often the - most bug-prone. For example, running an old version of + most bug-prone. For example, running an old version of imapd or - popper is like giving a universal root ticket out to the entire - world. Never run a server that you have not checked out - carefully. Many servers do not need to be run as root. For - example, the ntalk, + popper is like giving a universal + root ticket out to the entire world. Never run a server that + you have not checked out carefully. Many servers do not need to + be run as root. For example, the + ntalk, comsat, and finger daemons can be run in special - user sandboxes. A sandbox is not perfect, unless - you go through a large amount of trouble, but the onion approach to - security still stands: If someone is able to break in through - a server running in a sandbox, they still have to break out of the - sandbox. The more layers the attacker must break through, the - lower the likelihood of his success. Root holes have historically - been found in virtually every server ever run as root, including - basic system servers. If you are running a machine through which - people only login via sshd and never - login via telnetd or + user sandboxes. A sandbox is not perfect, + unless you go through a large amount of trouble, but the onion + approach to security still stands: If someone is able to break + in through a server running in a sandbox, they still have to + break out of the sandbox. The more layers the attacker must + break through, the lower the likelihood of his success. Root + holes have historically been found in virtually every server + ever run as root, including basic system servers. If you are + running a machine through which people only login via + sshd and never login via + telnetd or rshd or rlogind, then turn off those services! - + FreeBSD now defaults to running ntalkd, comsat, and @@ -1472,12 +1474,14 @@ Edit O.K. Creating the Server File - We now have to extract all the instances which define the services - on each machine. For this we use the ext_srvtab - command. This will create a file which must be copied or moved - by secure means to each Kerberos client's - /etc/kerberosIV directory. This file must be present on each server - and client, and is crucial to the operation of Kerberos. + We now have to extract all the instances which define the + services on each machine. For this we use the + ext_srvtab command. This will create a file + which must be copied or moved by secure + means to each Kerberos client's + /etc/kerberosIV directory. This file must + be present on each server and client, and is crucial to the + operation of Kerberos. &prompt.root; ext_srvtab grunt @@ -1607,14 +1611,15 @@ Password changed. Adding <command>su</command> Privileges - Kerberos allows us to give each user who - needs root privileges their own separate - su password. We could now add an id which is - authorized to su to root. - This is controlled by having an instance of root - associated with a principal. Using kdb_edit we can - create the entry jane.root in the Kerberos - database: + Kerberos allows us to give each user + who needs root privileges their own + separate su password. + We could now add an id which is authorized to + su to root. This is + controlled by having an instance of root + associated with a principal. Using kdb_edit + we can create the entry jane.root in the + Kerberos database: &prompt.root; kdb_edit Opening database...