[linux-security] Re: interactions between OPIE-ftpd and RH5.2

[Tony Nugent <Tony Nugent usq edu au>]

On Fri Dec 04 1998 at 09:16, Truckstop Psychic wrote:

> > Any change to /etc/shells after the upgrade?
> As it turns out... Yes.
> Discovered this last night, and should have caught it sooner -- it's a
> pretty distinct error condition.
> Now, why a package upgrade would change /etc/shells and *not* leave a
> distinct .rpmsave file behind it, I'm not certain -- but that's more a
> problem/misunderstanding with rpm than an honest to pete security issue,
> I'm guessing.

/etc/shells can be very tricky as so many "unlikely" programs use it - ftpd
is a classic example... we were having all sort of hassles with it until,
of all things, /etc/shells was tweaked to reflect the "non-standard"
location of the login shells of users on a box yp'ing and nfs'ing off a
server.

If this is happening with the OPIE-ftpd package (I don't know it myself),
then it is an rpm package problem and the person who maintains this package
should be told about this.

There is a way in the %files section of the .spec file to specify files
that should be .rpmsave'd  --  from (my rusty) memory, I think they should
be specified as %config files - I don't have my copy of MaximumRPM with me
at the moment.

Cheers
Tony