32 ms·
Seriously, if an attacker is in a position to exploit this, hasn’t everything already failed? Or to put another way, under what condition is this actually help
by zaroth 8y ago
Seriously, if an attacker is in a position to exploit this, hasn’t everything already failed?
Or to put another way, under what condition is this actually helpful defense in depth?
Nothing should be able to login locally to an Alpine container. All authentication should be public key based to begin with.
What would the root password be if not null?
- detaro 8y ago> What would the root password be if not null? Deactivated, allowing no root login. EDIT: > Seriously, if an attacker is in a position to exploit this, hasn’t everything already failed? Not necessarily I think. Something might support PAM auth (by accident or intentionally) and it wouldn't allow anything if no/only accounts with strong passwords can be logged into, but obviously breaks once root is available for login.