Hi Xin, Personally, I'd be opposed to this idea, for a couple of reasons: 1. The impact is too narrow. There are many, many files in /etc/ (and elsewhere, for that matter) that are also currently set world- readable by default. Patching the perms of just one file creates inconsistency, and, without a more general policy on this sort of thing, we're likely to hear whining about "everything *else* is world-readable. What's so special about /etc/crontab?" 2. Even if there *is* some small security benefit to be gained through obscurity (see #3), it's probably outweighed by the convenience of the matter in this case, and that has some real security implications. We'd be asking admins to su everytime they want to look at /etc/crontab. For most of us, we consider our systems more secure the more we can do without a superuser shell. 3. You're not really gaining much by making /etc/crontab only readable by the superuser. It's currently trivial for regular users to view process information, and most cron jobs run on predictable boundaries (since per-minute timings are the most granular scheduling allowed). We don't want admins thinking, "nobody else can read this file, so anything I put in here must be top secret", because that's *not* the case. Just my CA$0.10. :-) - Ryan Xin LI wrote to [email protected]: > Hi folks, > > While investigating OpenBSD's cron implementation, I found that they set > the systemwide crontab (a.k.a. /etc/crontab) to be readable by the > superuser only. The attached patch will bring this to FreeBSD by moving > crontab out from BIN1 group and install it along with master.passwd. > > This change should not affect the current cron(1) behavior. > > Cheers, > -- > Xin LI <delphij frontfree net> http://www.delphij.net/ > See complete headers for GPG key and other information. > > -- Ryan Thompson <[email protected]> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"