Date: Mon, 10 May 1999 22:26:19 +0200 >From: "GWDVMS::MOELLER" Subject: Risks of upgrading a UNIX system When was the last time you rebuilt all privileged (`suid root') applications when upgrading a unix system, just in case? I'm pretty sure one can find `small print' that demands this, however I'm equally sure that hardly any system manager does so, since problems seem to occur _very_ rarely. Here's a neat one: Some time prior to the upgrade, system manager (S.M.) was asked to install `sshd' on a not-so-common platform (nothing really security-relevant, machine used for raw speed only, users just being accustomed to that sort of login). Said platform (featuring a particularly elaborate user data base) requires some special calls (simple calling sequences) to be done during `login' - no problem, `sshd' knows about them, although not explicitly aware of the particular hardware. Cautiously, S.M. configures `sshd' to not allow `root' logins from the outside. What other harm could it possibly do? Upgrade has to occur somewhat in a hurry, release documentation isn't on-site, but procedures are known well enough. S.M. asks the manufacturer's support representative if special precautions have to be taken, "errr, not that I'd think so". S.M. installs new version, all fine & dandy, even remembers to check out `sshd' afterwards and finds it to work the same as before. A couple of days later, S.M. logs in via `sshd' himself, and for the first time enters `su'. Gets very amazed at the new system's intelligence, as it knows to not ask him for a password. Minutes later, S.M. recognizes that `su' would never ask for a password, when the parent process had been created via `sshd' ... in spite of no other visible peculiarities with that process. A re-build (pretty likely boiling down to nothing but a re-link) of `sshd' fixed the problem. Quite a few years ago, when I saw the first mention of `ssh', I commented "If you're a bank, you don't buy your safe at a flea market; if you're not, you might be better off without a safe". Maybe there's _some_ truth in it, after all. Dr. Wolfgang J. "s."Moeller, Tel. +49 551 2011510, GWDG, D-37077 Goettingen, F.R.Germany P.S. re "software bloat": Imagine uSoft going open source, and no-one going to have a look at it... [from Risks Digest 20.39]