Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Full Disclosure: Full-Disclosure
Ubuntu, Linux Mint, and the Guest Account
 

Index | Next | Previous | View Flat


noloader at gmail

May 5, 2012, 4:42 PM


Views: 399
Permalink
Ubuntu, Linux Mint, and the Guest Account

I know there's not much new here, but I am amazed that Ubuntu, Linux
Mint and friends ship with a Guest account present and enabled.

The Guest account is surreptitiously added through a lightdm
configuration file, and is not part of the standard user database.
Because its not part of the standard user database, it can't be
disabled through /etc/shadow, nor disable it through familiar tools
such as userdel and usermod. Additionally, the damn account does not
show up in distribution provided tools such as User Accounts applet.

To make matters worse, grepping for guest returns 0 results because
lightdm.conf does not mention one must add the following to disable
the guest account (nothing is required to enable the account):

allow-guest=false

To add insult to injury, the Guest account is not sandboxed and user
home directories lack sufficient ACLs, so the guest account is able to
wander through user's home directories:

guest-dojMxl [at] vb-mint-12-x6 ~ $ pwd
/tmp/guest-dojMxl
guest-dojMxl [at] vb-mint-12-x6 ~ $ whoami
guest-dojMxl
guest-dojMxl [at] vb-mint-12-x6 /home/jwalton $ cd /home/
guest-dojMxl [at] vb-mint-12-x6 /home $ ls -al
total 12
drwxr-xr-x 3 root root 4096 2012-05-05 16:29 .
drwxr-xr-x 23 root root 4096 2012-05-05 16:32 ..
drwxr-xr-x 5 jwalton jwalton 4096 2012-05-05 16:35 jwalton
guest-dojMxl [at] vb-mint-12-x6 ~ $ cd /home/jwalton/
guest-dojMxl [at] vb-mint-12-x6 /home/jwalton $ ls -al
total 28
drwxr-xr-x 5 jwalton jwalton 4096 2012-05-05 16:35 .
drwxr-xr-x 3 root root 4096 2012-05-05 16:29 ..
-rw-r--r-- 1 jwalton jwalton 220 2012-05-05 16:29 .bash_logout
drwx------ 3 jwalton jwalton 4096 2012-05-05 16:35 .cache
drwxr-xr-x 3 jwalton jwalton 4096 2012-05-05 16:29 .config
drwxr-xr-x 4 jwalton jwalton 4096 2012-05-05 16:29 .mozilla
-rw-r--r-- 1 jwalton jwalton 675 2012-05-05 16:29 .profile
...

Is there any reason a KIOSK-like account is enabled by default? Do
KIOSKs really dominate the desktop market to warrant the account out
of the box?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Subject User Time
Ubuntu, Linux Mint, and the Guest Account noloader at gmail May 5, 2012, 4:42 PM
    Re: Ubuntu, Linux Mint, and the Guest Account marcdeslauriers at videotron May 5, 2012, 4:51 PM
    Re: Ubuntu, Linux Mint, and the Guest Account marc.deslauriers at canonical May 5, 2012, 4:52 PM
        Re: Ubuntu, Linux Mint, and the Guest Account guninski at guninski May 7, 2012, 1:40 AM
    Re: Ubuntu, Linux Mint, and the Guest Account noloader at gmail Jan 26, 2013, 11:44 AM

  Index | Next | Previous | View Flat
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.