Bugtraq: Re: Fingerd Summary

[adam () bwh harvard edu (Adam Shostack)]

| Here's another feature we'd like to see: allowing fingering specific
| people, but not a generic finger of a machine, which could be used to
| learn login ids.  Which of the fingerds you looked at had that feature?

        rfingerd could be made to do that with a little input
filtering.  Its perl, so the input filter should be pretty simple--if
anyone writes one, please pass it on to me.  No need to reinvent the
wheel.:)

        fingerd-1.0 has the ability built in.

        sfinger provides it by only allowing certain finger targets,
defined by the existance of a file in its directory (which is the
output of finger.)

        Both rfingerd & fingerd-1.0 call /usr/ucb finger.  If you
replace that with gnu finger, gnu finger allows you to define
arbitrary actions, including a 'default' target if no argument is
given.  If this default target is site info, you get the effect of not
allowing 'generic' fingers.



        Also, don't forget to turn off rusers.  :)

Adam