Re: improved (?) security by requiring full path for commands issued by root?

Article View: comp.security.unix

Article #149

Back to comp.security.unix Previous Next

#149

From: bob
Date: Sun, 25 Feb 2001 00:31

31 lines
2722 bytes

Christer Palm wrote:
> 
> bob wrote:
> >
> > Well, I wrote a nice little perl script to do this, thinking the script
> > would be simple (which it was, actually), with the following results
> > (which aren't simple):
> >
> > Many commands on both linux and solaris are owned by other than root,
> > users such as news, uucp, bin to name a few.  And on solaris many are
> > writable by group, groups being similar to the preceding.
> >
> > I suspect that these users cannot login (second field in /etc/shadow
> > entry is '*') but I'm not sure of this.  So is this safe or what?  Where
> > do I go from here?
> >
> Right - more specifically the executable and the directories in its path
> should only be writable by "trusted" users and groups. This also goes
> for any shared libraries referenced by the executable. A user that
> cannot log in can be considered trusted, as well as groups in which only
> root or trusted users are members. 

This is more or less what I thought - check /etc/shadow for users tahat
can't login and consider them trusted.  Still haven't worked out the
libraries yet, though.

> You should be able to put this check
> into your perl program as well fairly easily.
> 
> It would be nice to be able to have the kernel check this for you in
> exec()...

Technical Details

Message-ID: <3A98524E.22BFB0A9@none.for.me.com>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.gv.tsc.tdk.com!newsfeed.berkeley.edu!news-hog.berkeley.edu!ucberkeley!enews.sgi.com!telocity-west!TELOCITY!newsrump.sjc.telocity.net!not-for-mail

References:

<3A822606.E06E411E@none.for.me.com> <3A82E4A9.AE6F278B@nogui.se> <3A8C1C0A.CAB78DC1@none.for.me.com> <3A8D886F.7FC03E1E@nogui.se>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10952f,2a5221006d4e0ad9
X-Google-Attributes: gid10952f,public
X-Google-Thread: 10e732,2a5221006d4e0ad9
X-Google-Attributes: gid10e732,public
X-Google-Thread: 1133d0,2a5221006d4e0ad9
X-Google-Attributes: gid1133d0,public
X-Google-ArrivalTime: 2001-02-24 16:35:38 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.gv.tsc.tdk.com!newsfeed.berkeley.edu!news-hog.berkeley.edu!ucberkeley!enews.sgi.com!telocity-west!TELOCITY!newsrump.sjc.telocity.net!not-for-mail
Message-ID: <3A98524E.22BFB0A9@none.for.me.com>
From: bob <bob@none.for.me.com>
X-Mailer: Mozilla 4.74 [en] (X11; U; Linux 2.2.16 i686)
X-Accept-Language: en
MIME-Version: 1.0
Newsgroups: comp.security.unix,alt.os.security,cern.security.unix
Subject: Re: improved (?) security by requiring full path for commands issued by 
 root?
References: <3A822606.E06E411E@none.for.me.com> <3A82E4A9.AE6F278B@nogui.se> <3A8C1C0A.CAB78DC1@none.for.me.com> <3A8D886F.7FC03E1E@nogui.se>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 31
X-Trace: MzEgTm9BdXRoVXNlciBURUxPQ0lUWS1SRUFERVJTIDIxNi4yMjcuMTIuMTkzICBTYXQsIDI0IEZl!YiAyMDAxIDE2OjMxOjExIFBTVA==
X-Abuse-Info: Please forward ALL headers when reporting abuse.
X-Complaints-To: abuse@telocity.net
NNTP-Posting-Date: Sat, 24 Feb 2001 16:31:11 PST
Date: Sat, 24 Feb 2001 18:31:10 -0600

Reply to Parent Message