sux, an enhancer for su

[Tom Christiansen]

>From the keyboard of kyle at uunet.uu.net (Kyle Jones):
:Tom Christiansen writes:
: > As it is, the program is undesirable from a security standpoint.  It would
: > be less so if the user were at least prompted for his own password.
:
:Which kills the basic usefulness of the command!  The whole point
:was to avoid typing a password.  The idea behind this easy su
:seems to be to let the right users _conveniently_ become root, so
:they can do so often for short periods--- instead of creating one
:root shell and using it all day, eventually forgetting that they
:are root and destroying something.

And this is a feature???  If there are users who can become root
without a password, then it's MUCH easier to subvert the system.
You walk into their office when they're not there and do something.
Or you TIOCSTIO them to do what you want.  Or you plant a trojan horse
for them to trigger, usually easier done to joe random user than for
the superuser.  If there are N users who are root w/o a passwd,
it's really much worse.  

Passwordless root accounts: Just say NO!!

--tom

ps: Now I know how the command got its name. :-)