Re: improved (?) security by requiring full path for commands issued by root?

Article View: comp.security.unix

Article #126

Back to comp.security.unix Previous Next

#126

From: Casper H.S. Dik - Network Securi...
Date: Thu, 08 Feb 2001 08:54

26 lines
1987 bytes

[[ PLEASE DON'T SEND ME EMAIL COPIES OF POSTINGS ]]

bob <bob@none.for.me.com> writes:

>2) The root user should issue ALL commands with the full path, eg.
>'/bin/ls' instead of 'ls'

That's only a valid policy when executing from under a user's
environmetn (something policy should actually prohibit because users
have so many ways to trick you).

And it doesn't help:

alias /bin/su my-tricky-su

works fine in /bin/csh and derivatives.

Perhaps you should require full pathname and a preceding
backslash?

Casper
--
Expressed in this posting are my opinions.  They are in no way related
to opinions held by my employer, Sun Microsystems.
Statements on Sun products included here are not gospel and may
be fiction rather than truth.

Technical Details

Message-ID: <95tms0$9a0$1@new-usenet.uk.sun.com>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.gv.tsc.tdk.com!falcon.america.net!sunqbc.risq.qc.ca!newsfeeds.belnet.be!news.belnet.be!btnet-peer1!btnet-feed5!btnet!carbon.eu.sun.com!new-usenet.uk.sun.com!not-for-mail

References: <3A822606.E06E411E@none.for.me.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10952f,2a5221006d4e0ad9
X-Google-Attributes: gid10952f,public
X-Google-Thread: 1133d0,2a5221006d4e0ad9
X-Google-Attributes: gid1133d0,public
X-Google-Thread: 10e732,2a5221006d4e0ad9
X-Google-Attributes: gid10e732,public
X-Google-ArrivalTime: 2001-02-08 01:04:56 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.gv.tsc.tdk.com!falcon.america.net!sunqbc.risq.qc.ca!newsfeeds.belnet.be!news.belnet.be!btnet-peer1!btnet-feed5!btnet!carbon.eu.sun.com!new-usenet.uk.sun.com!not-for-mail
From: Casper.Dik@Holland.Sun.Com (Casper H.S. Dik - Network Security Engineer)
Newsgroups: comp.security.unix,alt.os.security,cern.security.unix
Subject: Re: improved (?) security by requiring full path for commands issued by root?
Date: 8 Feb 2001 08:54:24 GMT
Organization: Sun Microsystems, Netherlands
Lines: 26
Message-ID: <95tms0$9a0$1@new-usenet.uk.sun.com>
References: <3A822606.E06E411E@none.for.me.com>
NNTP-Posting-Host: room101.holland.sun.com
X-Trace: new-usenet.uk.sun.com 981622464 9536 129.159.201.52 (8 Feb 2001 08:54:24 GMT)
X-Complaints-To: usenet@new-usenet.uk.sun.com
NNTP-Posting-Date: 8 Feb 2001 08:54:24 GMT
Mail-Copies-To: never

Reply to Parent Message