A general comment on virus problems
Lets analyse the problem on a basic level, as four statements:
1. You have a complicated device that has the ability to execute programs. You want this device to execute programs, that is why you have it in the first place.
2. You want this device to communicate with the world, making a communications device out of it. It is therefore connected to a big network called "the internet".
3. You want information to flow freely between your communications device (also called a computer) and the big network (also called the internet). This is why many people have a computer in the first place. It does not matter if the information is pictures of kittens or a physics phd thesis.
4. You do NOT (or rather should not) want programs to flow freely between your communications device and the big network.
Up steps the problems (or what I see as the problem):
The lines between information and programs has been blurred though. I blame much of this on Microsoft, example: MS word macro viruses. Ordinary Joe Bloggs does not know the difference. Attachments are things you can look at, pictures 'n stuff, animated birthday cards and Powerpoint make me feel good's, right?
Joe runs an OS that supports some sort of remote procedure call. Joe never uses this and is blissfully unaware of it.
These two general "vulnerabilities" makes it simple to get a program onto Joe's communications device. If we mail it to him, he will run it for us! Or we can just look for a nice big hole in that RPC server and install it ourselves. This in itself violates my statement 4.
Up steps the solution providers:
Lets put in a firewall to stop someone from acccessing Joe's RPC ports. We can make some bucks along the way too...
And lets get him an antivirus to help him distinguish between the good and bad attachments.
My problems with this:
I don't see why a firewall is needed to protect vulnerable RPC ports that should not be there in the first place. I know many of the Microsoft tools use them, but for crying out loud they can listen on 127.0.0.1 by default and spare as a whole bunch of problems. Granted, by not opening up your ports for all the world you are running an implicit sort of firewall, my point is just that you don't need an EXTRA product to make it work.
An antivirus will never be good enough to detect all problems out there. A couple of people have to be infected before it is detected, reported and an update pushed out. If my statement 4 above is observed, none of this would be necessary.
Executable content should not pass between the two, period. Not where our mythical Joe is concerned.
A couple of analogies come to mind:
George Orwell, 1984: Make it impossible to say anything bad...
Foolproof is often equivalent to "No provision for adjustment".
Basically Windows tries to be everything to everybody causing a LOT of problems. What we need is less unsecured over-powerful under-admined windows PC's and more set-top boxes (or their equivalents). In this sense Opensource might even save us, as it is a lot simpler to build such a no-nonsense tool that fit the Bloggs' lifestyle.
But that is just me... I've been harping on this "no executable content" thing for way too long now...
Re: I hacked mine to run both login and logout scripts...
> I hacked my pam_script module to have
> both a login and a logout script,
I've been thinking of doing this for a while, but it is very simple to implement and so far I have no need for that, as /etc/X11/Xsession is usually sufficient. But it might be useful for other uses, such as on pam aware ftp servers.
Anyway, if you want to send me a patch I'll incorporate it into the main source in some way, or at least include the patch in the tarball.