tlug: /home ownership

[Jim Schweizer <schweiz@example.com>]

Hi all,

I've had a really interesting night. I was reading the Sams.net
Maximum Security book and it described an obscure scanner called
NSS (Network Security Scanner) which scans ports on a host and
reports any possible holes. Thinking I would run this against my
JALT server I downloaded the script (perl) and read that you
needed ypx.tar.Z compiled and installed.

So I compiled ypx and the sh*t hit the fan. Probably my mistake
was compiling it su'd to root, but as soon as it compiled I
tried it to see what it would do - it trashed my /home
directory. It took me a while to figure out, but somehow the
permissions and ownership of /home were changed.

Now I'm left with some really wierd permissions on /home. If I
ls -la from / I get 

wormhole:/> ls -la
drwxr-xr-x  10 root     users        1024 Mar 14 21:21 home/

The users group instead of root is my doing - now I can log back
in as a user. But if I ls -la from /home I get 

wormhole:/home> ls -la
total 15
drwxr-xr-x  10 root     users        1024 Mar 14 21:21 ./
drwxrwxr-x  21 jim      man          1024 Mar 14 22:10 ../
     ^       ^^^^^^^   ^^^^^^

Obviously, these don't match, but they are the same directory
and I had to change the permissions so that I could log in as a
user other than jim or root. I tried changing the owner and group
back to root but have had no luck.

Any suggestions would be appreciated...

BTW the Maximum Security - A Hacker's Guide to Protecting Your
Internet Site and Network is a really good read. It descibes in
great detail the tools that crackers are using and how to defeat
them. It also has an excellent appendix on how to get more
information about protecting your site.

----------------------------------
Jim Schweizer <schweiz@example.com>
#include <disclaimer.h>
"I am not an Economist.  I am an honest man!"
                -- Paul McCracken
http://www1.harenet.or.jp/~schweiz/
----------------------------------
---------------------------------------------------------------
Next TLUG Meeting: 11 April Sat, Tokyo Station Yaesu gate 12:30
Featuring Tague Griffith of Netscape i18n talking on source code
---------------------------------------------------------------
a word from the sponsor:
TWICS - Japan's First Public-Access Internet System
www.twics.com  info@example.com  Tel:03-3351-5977  Fax:03-3353-6096