Subject: Re: [vserver] Guest root passwords
From: "John A. Sullivan III" <jsullivan@opensourcedevel.com>
Date: Tue, 27 Jan 2009 13:12:43 -0500

On Tue, 2009-01-27 at 18:34 +0100, Guenther Fuchs wrote:
> Hi there,
> 
> on Tuesday, January 27, 2009 at 6:11:19 PM there was posted:
> 
> JASI> It appears not setting it disables root access other than via the host
> JASI> but this is only our casual observation.  What really happens if we do
> JASI> not set the root password upon guest creation? Thanks - John
> 
> "Root" rights are not only granted by login/ssh login but also by suid
> on programs etc. Some progrems need to have "root" (uid 0) privileges
> on startup (httpd for example) and later then drops these rights. But
> there's always the opposite way round as well - so there may still
> programs exist which may gain "root" (uid 0) privileges within the
> vserver guest context. That should not bother you too much i think, as
> the guest context "root" process still will not be able to access
> other context's or the host system itself unless you add further then
> default capacities to your guest.
> 
> To get back to what I guess you want: For your wishes and goals I
> think removing the root encrypted password from guest's /etc/passwd
> and guests /etc/shadow (second portion of "root" lines) as well as
> removing /root/.ssh directory and contents (if exists) should fullfill
> your needs. 
> 

Thanks.  I am assuming not setting the password only disables use of
login for root and processes will still be able to use it.  Please let
me know if that is an invalid assumption - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society