Re: [cobalt-users] Cleartext Root Password

[Kris Dahl <krislists@xxxxxxxxxxxxx>]

> Btw I do not think just SUing is a safer thing to do - passwords are
> transmitted
> in clear text, and sniffing them is in no way harder to do - su does not
> provide
> for security, just for obscurity, which is worth exactly nothing. Secure shell
> (SSH) is the only (closely, because there still is the regular shell risks)
> safe
> way to permit interactive use.

Its not just about clear-text passwords.  It means you have to compromise
two accounts to gain root access.  First you need a user account and then
the root account.  Its one more thing.  And you should really be using SSH
anyway.

But there is indeed no reason why the root PW should be in clear text...
there are a number of ways that file can be illegitimately accessed
(especially if it is 644).  This should probably be posted on BugTraq.

-k