Re: improved (?) security by requiring full path for commands issued by root?

Article View: comp.security.unix

Article #136

Back to comp.security.unix Previous Next

#136

From: bob
Date: Thu, 15 Feb 2001 18:12

34 lines
2457 bytes

Christer Palm wrote:
> 
> It's probably easier to make sure that you have a "secure" PATH before
> starting to execute commands.
> At this level, you should also probably check the following before
> running a command:
> 
>  - That the command is in fact owned by root
>  - That the command itself and each directory in the command path is
> writable only by root
> 

Well, I wrote a nice little perl script to do this, thinking the script
would be simple (which it was, actually), with the following results
(which aren't simple):

Many commands on both linux and solaris are owned by other than root,
users such as news, uucp, bin to name a few.  And on solaris many are
writable by group, groups being similar to the preceding.

I suspect that these users cannot login (second field in /etc/shadow
entry is '*') but I'm not sure of this.  So is this safe or what?  Where
do I go from here?

> And, hey - there are shells that, AFAIK, do this for you, since this is
> a requirement in C2 environments. In AIX, for example, you have the
> restricted shell.

Know of any likje this for linux or solaris?

Thanx for the help.

- Bob

Technical Details

Message-ID: <3A8C1C0A.CAB78DC1@none.for.me.com>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!sn-xit-04!supernews.com!216.227.56.88.MISMATCH!telocity-west!TELOCITY!newsrump.sjc.telocity.net!not-for-mail

References: <3A822606.E06E411E@none.for.me.com> <3A82E4A9.AE6F278B@nogui.se>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10952f,2a5221006d4e0ad9
X-Google-Attributes: gid10952f,public
X-Google-Thread: 10e732,2a5221006d4e0ad9
X-Google-Attributes: gid10e732,public
X-Google-Thread: 1133d0,2a5221006d4e0ad9
X-Google-Attributes: gid1133d0,public
X-Google-ArrivalTime: 2001-02-15 10:12:28 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!sn-xit-04!supernews.com!216.227.56.88.MISMATCH!telocity-west!TELOCITY!newsrump.sjc.telocity.net!not-for-mail
Message-ID: <3A8C1C0A.CAB78DC1@none.for.me.com>
From: bob <bob@none.for.me.com>
X-Mailer: Mozilla 4.74 [en] (X11; U; Linux 2.2.16 i686)
X-Accept-Language: en
MIME-Version: 1.0
Newsgroups: comp.security.unix,alt.os.security,cern.security.unix
Subject: Re: improved (?) security by requiring full path for commands issued by 
 root?
References: <3A822606.E06E411E@none.for.me.com> <3A82E4A9.AE6F278B@nogui.se>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 34
X-Trace: MzQgTm9BdWhoVXNlciBURVBPQ0lUWS1SWUFEWVJTIDIxNi4yMjcuMTIuMTkzICBUaHUsIDE1IEZ5!YiAyLDAxIDEwOjEyOi43IFBPVA==
X-Abuse-Info: Please forward ALL headers when reporting abuse.
X-Complaints-To: abuse@telocity.net
NNTP-Posting-Date: Thu, 15 Feb 2001 10:12:27 PST
Date: Thu, 15 Feb 2001 12:12:26 -0600

Reply to Parent Message