Hi, Thomas Goirand <tho...@goirand.fr> writes: >> dtc saves the administrator password in plain text in >> /var/lib/dtc/saved_install_config under the variable name conf_adm_pass. >> It remains there even after initial configuration. > > This file is owned by root, and readable by root only. Do you think this > is still a security risk? What's wrong in doing this?
Yes, it still is a security risk. It escalates any security problem where the attacker can (only) read arbitrary files into one where the attacker has administrative access to dtc. (cf. /etc/shadow which does not store passwords in a form that allows to easily retrieve the original passwords) Regards, Ansgar -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
