--hYooF8G/hrfVAmum Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Aug 11, 2004 at 03:29:30PM +0200, Thomas Quinot wrote: > * Doug Barton, 2004-08-10 : >=20 > > Do you have a reason for wanting to do this other than, "OpenBSD does i= t=20 > > this way?" I personally see no problems, and some benefit for users=20 > > being able to see the system crontab. If the superuser needs to run=20 > > "secret" cron jobs, then there is root's crontab that can be used for= =20 > > this purpose. >=20 > Seconded. I would find it a nuisance to have to chmod a+r /etc/crontab > on all systems I set up. People who need tightened security against > hostile local users can use tools such as security/lockdown that will, > among many other things, remove world-read permissions from a bunch of > systemwide configuration files, including /etc/crontab. I think I would want to compromise at this point ;) In addition of this, personally I suggest the following changes to be made: - Provide an option in sysinstall so users will be instructed to choose whether to ``lockdown'' their systems as soon as the configuration is completed. Also, include this utility in the installation disc. - Add a new security audit script which will tell admins that the permission of "watched" configurations was altered. This might be turned off by default, or even a depency port of lockdown, to provide a mechanism to detect potential break-ins earlier, and to notice users when something like mergemaster or manual etc/ upgrades has reverted the permissions. What do you think about this? Actually the FreeBSD Simplified Chinese project is recently coordinating an effort of making an Internationalized FreeBSD Installer, I think we will try to implement these things if they looks better. Cheers, --=20 Xin LI <delphij frontfree net> http://www.delphij.net/ See complete headers for GPG key and other information. --hYooF8G/hrfVAmum Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (FreeBSD) iD8DBQFBGuykOfuToMruuMARAm5tAJ437PcJgS+ducDSxcUY3KyARjIZlQCfXe3f i9Xw2EJxrbJ2jJec37c6Mwc= =NNky -----END PGP SIGNATURE----- --hYooF8G/hrfVAmum--