Check root password changes done via single user mode

[Polytropon]

On Tue, 03 Mar 2015 12:55:01 +0000, Arthur Chance wrote:
> As Bruce Schneier says, there's no such thing as perfect security, it 
> all depends on what costs (in money, time, or effort) attacker and 
> defender are prepared to pay.

Also consider non-OS security in this context: A CCTV camera
monitoring the console, or a hardware keylogger that can be
examined for SUM logins and "passwd" command calls. This is
relatively easy with physical servers, but those which are
being accessed via network (and with some management solution
that let's you, for example, access the serial console via
IP) could benefit from a mechanism examining the network
traffic; but as soon as you have end-to-end encryption in
such a setup, it won't work... except it's weak crypto and
you have the sufficient means...

FreeBSD can only offer a specific subset of solutions "out
of the box", and a versatile attacker will always find a way
to avoid those obstacles.


-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...