Re: NIS with local root

> but surely in such a situation where NIS and NFS is employed -- you won't be
> giving out root passwords to normal untrusted users anyway?!

I dissagree. Every place I've worked that had NIS and NFS would allow the developers to have root on their machine for administration purposes. In my opinion all other admins and developers are untrusted users. But they never thought through the home directory ramifications.

I always kept a skeleton home directory on my machine and exported it read only to the other boxes, and had my real home directory only available from my machine.

A heck of a lot more work to maintain it that way, but that's the price of security in that kind of environment.

--
Brian Hatch                  Why are a 'wise man'
   Systems and                and a 'wise guy'
   Security Engineer          opposites?
http://www.ifokr.org/bri/

Every message PGP signed