Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Trying to secure a Linux server and have little experience with SUID. After executing

find / -perm +4000

many programs were discovered. I have seen conflicting advice here and hereon what should be enabled and not.

SUID Enabled
/bin/su
/usr/bin/passwd
/usr/bin/gpasswd
/sbin/unix_chkpwd

SUID Disabled
/usr/bin/crontab
/usr/bin/newgrp
/bin/ping
/bin/ping6
/bin/umount
/bin/mount
/usr/bin/chsh
/usr/bin/chfn
/usr/libexec/pt_chown
/usr/bin/sudo
/usr/bin/sudoedit
/usr/bin/chage
/usr/sbin/userhelper
/usr/sbin/usernetctl
/usr/sbin/suexec

UNSURE
/usr/libexec/openssh/ssh-keysign
/sbin/pam_timestamp_check

Server will host multiple sites with few Linux / SFTP users.
What should change? Also, how should I test?

share|improve this question
add comment

3 Answers 3

up vote 3 down vote accepted

I personally wouldn't bother as the programs you listed are typically considered to be safe and secure. And for example sudo without the suid bit set makes no sense. The same goes for chsh chfn etc. If you really want to secure your server I would just give following executables suid permissions:

  • ping/ping6 for diagnostic reasons.
  • suexec to run cgi scripts under different users
  • su or sudo
  • pt_chown if you don't have devpts

You can remove the suid bit from ssh-keysign as it is only used for host based authentification according to http://lists.freebsd.org/pipermail/freebsd-stable/2006-October/029737.html

You should also make sure your users don't get shell access and have their directory chrooted.

If you really want to secure your server you should consider looking into SELinux.

share|improve this answer
add comment

Let your distribution do what it wants unless you're sure you know what you're doing. The fact that you need to ask this question shows that you don't know enough. So leave well alone.

Which programs need to be setuid depends on how things are set up on your distribution. For example, Fedora has replaced most uses of setuid by setcap. For example, ping needs the CAP_NET_RAWIO capability to be able to open raw sockets; it can get it by being setcap CAP_NET_RAWIO (better privilege isolation), or by being setuid root (the traditional method, which doesn't require setcap executables).

The programs you list are designed to be executed by ordinary users but require extra privileges to function. If you remove their setuid bit, you will break your system. For example, ping will just stop working (unless you're logged in as root). You will be able to become root with su but not with sudo, which defeats the whole point of sudo. Users will not be able to set crontabs. And so on.

On a dedicated server, some of the things that you've broken might not matter. But you should only change the distribution's defaults if you know that you're doing the right thing, not the other way round. Remember that availability is part of security. If you lock yourself out of the server or make yourself unable to diagnose and repair problems, you've broken your own security.

share|improve this answer
    
+1 for the first paragraph, and another mental +1 for the remainder. –  Michael Kjörling Feb 14 '13 at 10:38
    
@Gilles, definitely don't know enough which is why I am asking. Do you see vulnerabilities in any of the enabled programs if all are left to enabled? –  Christopher Ickes Feb 14 '13 at 14:27
    
@ChristopherIckes If there's a known vulnerability in any of these programs, your distribution's maintainers will push a security update. –  Gilles Feb 14 '13 at 15:35
add comment

selinux will take care a lot of that (on those systems that have it). So if you are using selinux, I would leave all the setuid stuff alone, it shouldn't have any more permissions than the selinux policy would give it.

share|improve this answer
    
Right as far as it goes, but SELinux can't give permissions, just take them away. –  vonbrand Feb 14 '13 at 14:36
    
@vonbrand afaik you can specify which programs/context have which capabilities... –  Ulrich Dangel Feb 14 '13 at 15:10
    
Right but if you are worried about setuid/setgid programs having too many permissions, selinux manages it and only gives it the perms it needs, even with setuid on. –  lsd Feb 14 '13 at 20:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.