3 ms·
Maybe knowing software a is likely running and managed by user b helps constructing a targeted attack.
by e12e 8y ago
Maybe knowing software a is likely running and managed by user b helps constructing a targeted attack.
- acdha 8y agoPerhaps but it’s a limited change from what’s already possible. Spending time on basic best practice stuff securing those accounts will pay a lot more dividends in more scenarios than adding a minor impediment to finding them.
- e12e 8y agoFwiw I mostly agree - reading /etc/passwd shouldn't be able to help compromise your system. But it's also an error for sshd or any daemon to allow the enumeration of your list of users. I mean when we get to read /etc/passwd via httpd we call it an exploit... (even if we don't get shadow too).