Re: [cobalt-users] Bug,- Security Risk, or May Bad?

["Robert G. Fisher" <rfisher@xxxxxxxxxxxxxxx>]

On Mon, Mar 27, 2000 at 10:46:08PM -0600, Sonny Kupka wrote:
> I have not given any rights to this domain or this user for Telnet access, 
> but it seems as though the account I gave Admin rights w/o Telnet access to 
> a Domain I didn't give telnet rights too, can add users and give them 
> telnet rights.

The security risks in this scenario come largely from giving
out multiple admin passwords.  The telnet access checks are
done by setting the user's shell to either a valid or invalid
shell.  

Furthermore, you need to keep in mind that a user's initial
preferences are set up by the administrator and that the
administrator generally has the ability to change a user's
password and shell.  

So not giving an Administrator telnet acces...is not going to
stop them from creating an account with telnet access or
even changing their own account to allow telnet access.

The Cobalt UI does have one major advantage though, because
it wraps these common functions in a UI that they access
through other accounts besides root, they are limited to
what types of changes they can make.  However, the old
addage still holds true that you should not give out 
administrative accounts and/or passwords to people you
can not trust.

-- 
Robert G. Fisher		     NEOCOM Microspecialists Inc. 
System Administrator/Programmer      (540) 666-9533 x 116