4 ms·
As others have noted - this allows user enumeration. Which can be very useful: Does a system appear to run one of the many horribly insecure "enterprise" backu
by e12e 8y ago
As others have noted - this allows user enumeration. Which can be very useful:
Does a system appear to run one of the many horribly insecure "enterprise" backup solutions? Or some other horrible, ancient system?
Does $person from orgchart appear to have a $user? (target for spear phising, compromise of laptop).
Information hinting at distribution (eg: Ubuntu).
Is there a jboss user? Etc.
- acdha 8y agoHow much of a difference does this really make? Most attacks which I’ve seen simply launched the attack immediately so if you have enterprise software using the vendor’s configuration you’re screwed anyway, and both options are quickly blocked by fail2ban after splatting off the public key-only setup of any security conscious server.
- e12e 8y agoMaybe knowing software a is likely running and managed by user b helps constructing a targeted attack.
- acdha 8y agoPerhaps but it’s a limited change from what’s already possible. Spending time on basic best practice stuff securing those accounts will pay a lot more dividends in more scenarios than adding a minor impediment to finding them.
- e12e 8y agoFwiw I mostly agree - reading /etc/passwd shouldn't be able to help compromise your system. But it's also an error for sshd or any daemon to allow the enumeration of your list of users. I mean when we get to read /etc/passwd via httpd we call it an exploit... (even if we don't get shadow too).