Article View: comp.security.unix
Article #127Re: improved (?) security by requiring full path for commands issued by root?
From: Christer Palm
Date: Thu, 08 Feb 2001 17:25
Date: Thu, 08 Feb 2001 17:25
48 lines
2685 bytes
2685 bytes
This is a multi-part message in MIME format. --------------758876F3A56C5783A26AE0B1 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit bob wrote: > > 2) The root user should issue ALL commands with the full path, eg. > '/bin/ls' instead of 'ls' > It's probably easier to make sure that you have a "secure" PATH before starting to execute commands. At this level, you should also probably check the following before running a command: - That the command is in fact owned by root - That the command itself and each directory in the command path is writable only by root And, hey - there are shells that, AFAIK, do this for you, since this is a requirement in C2 environments. In AIX, for example, you have the restricted shell. --------------758876F3A56C5783A26AE0B1 Content-Type: text/x-vcard; charset=us-ascii; name="palm.vcf" Content-Transfer-Encoding: 7bit Content-Description: Card for Christer Palm Content-Disposition: attachment; filename="palm.vcf" begin:vcard n:Palm;Christer tel;cell:+46 (70) 327 30 23 tel;fax:+46 (8) 23 49 01 tel;work:+46 (8) 23 49 00 x-mozilla-html:FALSE url:http://www.nogui.se org:NOGUI AB adr:;;Palmfeltsv�gen 21;JOHANNESHOV;;SE-121 62;SWEDEN version:2.1 email;internet:palm@nogui.se title:UNIX-Specialist note:OBS! Ny adress!! x-mozilla-cpt:;-31296 fn:Christer Palm end:vcard --------------758876F3A56C5783A26AE0B1--
Technical Details
Message-ID:
<3A82E4A9.AE6F278B@nogui.se>Path:
arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.tele.dk!62.112.0.25!newsfeed.online.be!news1.carrier1.net!amsnews01.chello.com!nntp1.chello.se!not-for-mailReferences:
<3A822606.E06E411E@none.for.me.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10e732,2a5221006d4e0ad9 X-Google-Attributes: gid10e732,public X-Google-Thread: 10952f,2a5221006d4e0ad9 X-Google-Attributes: gid10952f,public X-Google-Thread: 1133d0,2a5221006d4e0ad9 X-Google-Attributes: gid1133d0,public X-Google-ArrivalTime: 2001-02-08 09:23:31 PST Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.tele.dk!62.112.0.25!newsfeed.online.be!news1.carrier1.net!amsnews01.chello.com!nntp1.chello.se!not-for-mail Message-ID: <3A82E4A9.AE6F278B@nogui.se> From: Christer Palm <palm@nogui.se> X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.2.14-12 i686) X-Accept-Language: en MIME-Version: 1.0 Newsgroups: comp.security.unix,alt.os.security,cern.security.unix Subject: Re: improved (?) security by requiring full path for commands issued by root? References: <3A822606.E06E411E@none.for.me.com> Content-Type: multipart/mixed; boundary="------------758876F3A56C5783A26AE0B1" Lines: 49 Date: Thu, 08 Feb 2001 17:25:42 GMT NNTP-Posting-Host: 213.200.128.10 X-Complaints-To: abuse@chello.se X-Trace: nntp1.chello.se 981653142 213.200.128.10 (Thu, 08 Feb 2001 18:25:42 MET) NNTP-Posting-Date: Thu, 08 Feb 2001 18:25:42 MET Organization: chello broadband