Holes in the Armor 255any per-user CPU time quotas. With a per-user process limit set at 50,
those 50 processes from the attacking the user will quickly swamp the
computer and stop all useful work on the system.)
System Usage Is Not Monitored
Ever have a Unix computer inexplicably slow down? You complain to the
resident Unix guru (assuming you haven’t been jaded enough to accept this
behavior), he’ll type some magic commands, then issue some cryptic state-
ment such as: “Sendmail ran away. I had to kill it. Things should be fine
now.”
Sendmail ran away? He’s got to be kidding, you think. Sadly, though, he’s
not. Unix doesn’t always wait for an attack of the type described above;
sometimes it launches one itself, like firemen who set fires during the slow
season. Sendmail is among the worst offenders: sometimes, for no reason
at all, a sendmail process will begin consuming large amounts of CPU
time. The only action that a hapless sysadmin can take is to kill the offend-
ing process and hope for better “luck” the next time.
Not exciting enough? Well, thanks to the design of the Unix network sys-
tem, you can paralyze any Unix computer on the network by remote con-
trol, without even logging in. Simply write a program to open 50
connections to the sendmail daemon on a remote computer and send ran-
dom garbage down these pipes. Users of the remote machine will experi-
ence a sudden, unexplained slowdown. If the random data cause the remote
sendmail program to crash and dump core, the target machine will run
even slower.
Disk Overload
Another attack brings Unix to its knees without even using up the CPU,
thanks to Unix’s primitive approach to disk and network activity. It’s easy:
just start four or five find jobs streaming through the file system with the
command:
% repeat 4 find / -exec wc {} \;Each find process reads the contents of every readable file on the file sys-
tem, which flushes all of the operating system’s disk buffers. Almost
immediately, Unix grinds to a halt. It’s simple, neat, and there is no effec-
tive prophylactic against users who get their jollies in strange ways.