[ILUG] debian boxes rooted.

[Rick Moen]

Quoting Greg Farrell (greg at gregfarrell.org):

> In support of the idea that is was a password/key stolen or key logged
> somewhere both boxes had normal users cracked. Users who don't run any
> services.

At the risk of belabouring a point you already realise:  An intruder who
enters using a stolen security token (e.g., SSH password captured on a
remote, compromised machine), masquerading as a legitimate user, can
then work at his leisure at escalating[1] to root authority by searching
the system for vulnerable, privileged executables or libraries.

So, in that sense, normal user accounts are threat vectors, despite
their not running services.

[1] http://linuxmafia.com/~rick/lexicon.html#moenslaw-security1

-- 
Cheers,                Linux:  It is now safe to turn on your computer.
Rick Moen
rick at linuxmafia.com