Re: improved (?) security by requiring full path for commands issued by root?

Article View: comp.security.unix

Article #150

Back to comp.security.unix Previous Next

#150

From: Bernd Eckenfels
Date: Sun, 25 Feb 2001 04:34

18 lines
2171 bytes

In comp.security.unix bob <bob@none.for.me.com> wrote:
>> Right - more specifically the executable and the directories in its path
>> should only be writable by "trusted" users and groups. This also goes
>> for any shared libraries referenced by the executable. A user that
>> cannot log in can be considered trusted, as well as groups in which only
>> root or trusted users are members. 

> This is more or less what I thought - check /etc/shadow for users tahat
> can't login and consider them trusted.  Still haven't worked out the
> libraries yet, though.

And be aware that in case of NFS Export of that dir every remote host can
impersonate those users. Thats why you better make all those files owned by
root.root and use root_squash. This will at least avoid modifications that
way. (or use /usr and / mounted read only in addition.

Greetings
Bernd

Technical Details

Message-ID: <97a21i$89o$1@sapa.inka.de>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!news.tele.dk!130.133.1.3!fu-berlin.de!rz.uni-karlsruhe.de!schlund.de!inka.de!not-for-mail

References:

<3A822606.E06E411E@none.for.me.com> <3A82E4A9.AE6F278B@nogui.se> <3A8C1C0A.CAB78DC1@none.for.me.com> <3A8D886F.7FC03E1E@nogui.se> <3A98524E.22BFB0A9@none.for.me.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10952f,2a5221006d4e0ad9
X-Google-Attributes: gid10952f,public
X-Google-Thread: 10e732,2a5221006d4e0ad9
X-Google-Attributes: gid10e732,public
X-Google-Thread: 1133d0,2a5221006d4e0ad9
X-Google-Attributes: gid1133d0,public
X-Google-ArrivalTime: 2001-02-24 20:36:04 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!news.tele.dk!130.133.1.3!fu-berlin.de!rz.uni-karlsruhe.de!schlund.de!inka.de!not-for-mail
From: Bernd Eckenfels <W1012@lina.inka.de>
Newsgroups: comp.security.unix,alt.os.security,cern.security.unix
Subject: Re: improved (?) security by requiring full path for commands issued by  root?
Date: 25 Feb 2001 04:34:58 GMT
Organization: (Posted via) INKA e.V. http://www.inka.de/
Lines: 18
Message-ID: <97a21i$89o$1@sapa.inka.de>
References: <3A822606.E06E411E@none.for.me.com> <3A82E4A9.AE6F278B@nogui.se> <3A8C1C0A.CAB78DC1@none.for.me.com> <3A8D886F.7FC03E1E@nogui.se> <3A98524E.22BFB0A9@none.for.me.com>
NNTP-Posting-Host: puric.inka.de
X-Trace: sapa.inka.de 983075698 8504 212.227.14.17 (25 Feb 2001 04:34:58 GMT)
X-Complaints-To: newsmaster@inka.de
NNTP-Posting-Date: 25 Feb 2001 04:34:58 GMT
User-Agent: tin/1.5.7-20001104 ("Paradise Regained") (UNIX) (Linux/2.0.36 (i686))

Reply to Parent Message