COMMAND
ffingerd
SYSTEMS AFFECTED
Systems running ffingerd
PROBLEM
Eilon Gishri found following. He found a couple of bugs in
ffingerd 1.19 which are related to privacy. The permission on
root's home directory are now 700 (/home/root):
(aristo)/cc/eilon>finger root@host.domain
[host.domain]
Login: root Name: #6
No project.
No plan.
No public key.
A lesson in how not to be seen. On host.domain, the user doesn't
want to be seen. Too bad, his/her home directory's permissions
(which says 'I want some privacy') makes ffingerd state otherwise.
Ffingerd looks for the file .nofinger in the user's home directory
but due to the current state of permissions on it, it can't be
accessed thus "there is no such file" and there for is happy to
supply us with the user's information.
# cd ~root
# ls -l .nofinger
-rw-r--r-- 1 root system 0 Apr 23 18:01 .nofinger
# ls -ld .
drwx------ 5 root system 512 Apr 23 18:01 .
# chmod 755 .
Now lets try again.
(aristo)/cc/eilon>finger root@host.domain
[host.domain]
That user does not want to be fingered
Hmmm, now for an unknown user.
(aristo)/cc/eilon>finger root1@host.domain
[host.domain]
That user does not want to be fingered.
Oops. Notice the dot ('.') at the end of the sentence. A very
simple and efficient way to find whether the user exists on the
remote host or not (taking into account the fact that ffingerd has
been installed on the remote host).
SOLUTION
This is documented in ffingerd. If you want ffingerd to look into
protected homes, run it as root. Second bug has been fixed and
announced version 1.20 on Freshmeat pointing out this fixed
problem. Dagmar d'Surreal posted following patch. Below is a
patch which applies to the 1.20 version of Fefe's Finger Daemon,
which includes both Eilon Gishri's patches to deal with paranoid
users whose home directories are mode 700 (the punctuation problem
had already been fixed in 1.20), and his misdirection patches
that add the .fakefinger (lets users controly exactly what will be
returned when they are fingered) file use, and the
/etc/ffingerd.empty and /etc/ffingerd.indirect files which allow
a sysadmin to change what kind of message is sent to people when
they try indirect or empty finger queries without having to edit
the source and recompile the daemon.
---
Content-Type: application/octet-stream; name="ffingerd.20p"
Content-Transfer-Encoding: base64
Content-Disposition: inline; filename="ffingerd.20p"
Content-MD5: 88RL3tW4HYA235zCOmrcWA==
H4sICLTAIDcCA2ZmaW5nZXJkLTEuMjBwMi5wYXRjaACdVm1z0zgQ/ox/xU5ujrQ4ceOkpSRQ
Jr3SltxwaacpwzCU6Si2XOtqW0aSyWWA++23KzuvJBSuHxprZe3L8zy7ciiiCJqFGkIUieyO
q7Dpe+3W3vD03WjVlLet0Wk2mxvefXSmBBznCtodaB322u3evg9+t9t1XNfd6Gj5hN/p7Xd6
/tPyRL8PTb/RAddvdKHfd1w85UOkZAp03nEBTkUiMzgXOkYnLzit+kwJbaRnWOGxwBPJS1A8
l8rwEBjkSo4TngKwLIScmSCGSCpylTPFMilCKDRXGibCxBDLlEMoFA+MVIJrSGXI4bDVgjHH
SqDIGHoDI+kQmJiTIy+TZZkQiYR7AK/YXcoUhPVRoRRnCbwIraUf6tLgSXX3ElgYYoozJxG7
55UbSnWGnMfT3Ez35kuRlemBzI2QmfYc17HozHDyuw4AXGMlTMNrNuZGwwtjl/3YLr089zRf
QclMcwkio2TmkckNV0oqSLnW7A7RmMRccXw9FVoTHKE0MJFFEoIuxiaZwp34jPsTNgUR4XuE
rBNuUdq8pGffyWSxtUF1i81H13EBf7IMoAttv3ew3/NbpKTDjdpbOreqwM7BigL3/YaPGsQf
FB+qEDyd478schBVZmxRWDnCkVH5LDOkhzECZ/3z0HG90Wv4azB6Nbg6PbkeXAwd91IJFIBA
iFB9wDPDlWEiS/EJPrOk4I1KhilixxItIS8MIrgsC1IXkuS4yJJQVqsNqxWBFAcSfWaGdJwk
lI2O5SSjzIhTxVNpeJk60pwnLOAgo1J8hS5QoyLDzFJGovJIP+hhqg12DgtTkWGHKWZIC7P8
gphhVtb7XB8aM3BcDEDSyrRtlLlgKVMrZpjJ3BhaaxhPIcC2MCQpKhKRZSnhuMdNsLfaCdbN
qn0WoUxb88rHTTRIC21uoiuEw3ExQGibF6Mty5xynEh17wGSjLydDd6cjvDx8tJp/rs37+0G
4AJxy8oHJf/GiOVzMb7nU8ddf3nB3ENnG1sKWrdbAMos/3h7jkm+i3m2KERoUEWWEYqMxDmW
YQkXW9NszLBLseYEe5z/w4MCpZFzZbsap6vmxqo0RoelyMxKnAA7jtwEMQ/uaSbgtnKaZt4c
MYZnhP8cECLByteUE4SS0rpA4aB462VWdssjdf+Sn5neMeOAWzZLz+gYpahnbi1qx2+vX19c
UTOzsqMfnE3B9jES/Gg2BWv3ot/tdbrb78XN53A2tQ56+92l27Gz3zjE+9H+0GwCYutOhDv5
JGy+zCe3+Lz7vLIXS/Zibs+VyEy0QzBSmzVqv2MOLb1Qb60xO4QyxENNoGm+k2jDzOLYY1re
jotodxe+0A1G72x/CY6OMP1dePwYdvBWySQZTocXp8Nr6wB+E1EW8giGF7ej96M3F+fWRJaz
49HJYHR9i7bzwfCcigAaP/OL6cOB3/74vATooAQIf55VAAGERZrfUk5LRV8W40QEgN3XqzVq
Q5q3M4NXK5H6BjzBafJla8Am2XFO653az90M1rMLP2RhMTbWeXC31YIF/EL8TUgvp1TV2KhV
85l8VBP7psryplZ+bVSrbJGpTai8bUoQga6RRN7tYJzbs+OTwZvB9XusVtcaVaDdkrm2/5SY
a/uHc2nT3xjn9n3l6Vv5Q0L7VHA1/YAAfCQd1ft10lCzPFIyMpJK4WSd4PectHjoIqfvncWF
VBVFrvBTb8HNMsi1zZO5ZkH/XyG2wb+BgHU3M0KQ6hL5dRYsKo2rFfh/noBOyxLQ8ecEENJP
PuVGHR3V9+q2d5/s0Nr1d9H0rg5fv8KyZVLHZrbLo/bzdQ9Qr/bc9a3WnL0HuFv5fviOuK20
2WMPcLbV9U/3y6aPm4ohy87Vr7bFf8DAXnmkDQAA
-----