Hot answers tagged

89

Security is always about making trade-offs. Root would be most secure if there were no way to access it at all. I notice that your LD_PRELOAD and PATH attacks assume an attacker with access to your account already, or at least to your dotfiles. Sudo doesn't protect against that very well at all — if they have your password, after all, no need to try ...


69

If you take a look at the executable sudo: $ which sudo /usr/bin/sudo $ ls -la /usr/bin/sudo ---s--x--x 2 root root 208808 Jun 3 2011 /usr/bin/sudo You'll notice that it carries the permission bits ---s--x--x. These can be broken down as follows: -|--s|--x|--x - - first dash denotes if a directory or a file ("d" = dir, "-" = file) --s - only ...


31

You don't need to give sudo access to echo. Call the small script with sudo, allowing NOPASSWD: access to ONLY that script (and any other similar scripts) by the user(s) who need access to it. This is always the best/safest way to use sudo. Isolate the small number of commands that need root privileges into their own separate script(s) and allow the ...


26

This is a very complex question. mattdm has already covered many points. Between su and sudo, when you consider a single user, su is a little more secure in that an attacker who has found your password can't gain root privileges immediately. But all it takes is for the attacker to find a local root hole (relatively uncommon) or install a trojan and wait for ...


24

setcap 'cap_net_bind_service=+ep' /path/to/program this will work for specific processes. But to allow a particular user to bind to ports below 1024 you will have to add him to sudoers. Have a look at this discussion for more.


24

I'm going to use Firefox as an example, because its open source and easy to find the information for, but this applies (probably with slightly different lists of ports) to other browsers, too. In August 2001, CERT issued a vulnerability note about how a web browser could be used to send near-arbitrary data to TCP ports chosen by an attacker, on any ...


23

acess denied to root: root can be denied direct network access. This is useful on internet connected hosts, as it requires that you login as smith, then sudo. some stuff root can't do: This is NOT for a lack of privilege. I can't see anything root couldn't do, however some technical issues might be experienced as "forbidden". I am root, why can't I ...


18

(Some of these methods have been mentioned in other answers; I'm giving several possible choices in rough order of preference.) You can redirect the low port to a high port and listen on the high port. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 1080 You can start your server as root and drop privileges after it's started ...


17

The 9.04 release was supported until October 23 2010. The vulnerability you found was reported in August 2009. It seems reasonable that, since the release was still current and supported at the time, the ISO was patched and what you downloaded was a version that is no longer vulnerable. Furthermore, you seem to have demonstrated quite nicely that it isn't ...


16

Check the owner on the gpio files: ls -l /sys/class/gpio/ Most likely, you'll find out that they are owned by group gpio: -rwxrwx--- 1 root gpio 4096 Mar 8 10:50 export ... In that case, you can simply add your user to the gpio group to grant access without sudo: sudo usermod -aG gpio myusername You'll need to logout and log back in after ...


13

No, this isn't possible. You can set the immutable attribute with chattr +i, which will at least make it irritating and non-obvious what has to be done to allow writing to the file, but they can just unset it again. Also, your filesystem has to support this, and have the functionality enabled. SELinux can also do some limiting, but again, it can be ...


13

Use su: su - alice sudo vim /etc/hosts From man su: The su command is used to become another user during a login session. Invoked without a username, su defaults to becoming the superuser. The optional argument - may be used to provide an environment similar to what the user would expect had the user logged in directly. For more ...


12

ping needs root so it can open a socket in raw mode. That's literally the first thing it does when it starts up: icmp_sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP); socket_errno = errno; That's the only thing it needs root for, so like many programs, it immediately drops its privilege level back to your normal user account: uid = getuid(); if ...


12

You mix two different distinctions here: Between real and effective group ids Between primary and supplementary users' groups The first distinction refers to how processes are being run. Normally, when you run a command/program, it is run with the privileges of your user. It has the real group id same as your user's primary group. This can be changed by ...


11

The simplest way is to use the su(1) command, it has an option that allows you to run a command via the user's shell, example: su foo -c ls This will switch to the user foo and run the ls command. If the user you want to use does not have a valid shell (ie it's not in /etc/shells, like /bin/false or /sbin/nologin) you will also have to specify a shell on ...


11

What you really want to do is to use SSH CA and sign keys used by each support person (they should have their own ssh keys, like passports) and configure your clients' servers to use the TrustedUserCAKeys /etc/ssh/users_ca.pub in the /etc/ssh/sshd_config. This way the server will accept any key signed by the CA key (which you have access to) and you will be ...


11

In the usual case, this is incorrect - the superuser has privileges / permissions to any functionality the system provides(1). Where this rule breaks down is when you throw SELinux into the mix. With SELinux, it is possible to restrict even root's privileges to disallow certain actions. However, the specific actions disallowed are highly dependent on the ...


10

When executing shell scripts that have the setuid bit (e.g., perms of rwsr-xr-x), the scripts run as the user that executes them, not as the user that owns them. This is contrary to how setuid is handled for binaries (e.g., /usr/bin/passwd), which run as the user that owns them, regardless of which user executes them. Check this page: ...


10

You should read the Arch Wiki page on sudo. sudo ("substitute user do") allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. You can install sudo from the repositories and then ...


9

Running unprivileged containers is the safest way to run containers in a production environment. Containers get bad publicity when it comes to security and one of the reasons is because some users have found that if a user gets root in a container then there is a possibility of gaining root on the host as well. Basically what an unprivileged container does ...


8

This is from the kill(2) manpage: For a process to have permission to send a signal it must either be privileged (under Linux: have the CAP_KILL capability), or the real or effective user ID of the sending process must equal the real or saved set-user-ID of the target process. In the case of SIGCONT it suffices when the send‐ ...


8

From here (centos.org) useradd (which is the actual binary the runs when you call adduser, it just behaves differently. See here about that.) has an flag -r which is documented as follows: -r Create a system account with a UID less than 500 and without a home directory Which sounds like what you want to do.


8

I think I should link here two answers from serverfault: how do i duplicate the nobody user? and Create restricted user on Debian server ( btw, it was moved to serverfault from stackoverflow, just recently -- and possibly could have been moved to this site as well ) Basically -r means "set account as a system one" -- "no expiration", etc -- and the full ...


8

Change the setuid bit of mysqld executable and the ownership of the executable file to mysql account, besides adding the required user in the group mysql for making him have access to the files on the filesystem. Use visudo -f /etc/sudoers and grant him permission to execute the /etc/rc.d/init.d/mysql start and /etc/rc.d/init.d/mysql stop as two seperate ...


8

The kernel view Conceptually, there are three sets of groups that a process is a member of. Each set is a subset of the following one. The single group that is the process's default group, which files created by this process will belong to. The set of groups that are checked when the group requires permission to open a file. The set of groups that a ...


8

sudo tcpdump -Z uses initgroups(3), setgid(2) and setuid(2) to drop the root privileges of its own process. # code taken from: # http://www.opensource.apple.com/source/tcpdump/tcpdump-32/tcpdump/tcpdump.c /* Drop root privileges and chroot if necessary */ static void droproot(const char *username, const char *chroot_dir) { ... if ...


6

Chroot only restricts filesystem access. If you have root permissions, a chroot is merely an inconvenience, not a secure confinement. Ordinary users can use sockets but not shut down the machine. There are ways to restrict what users can do: capabilities, AppArmor, SELinux, … But by far the easiest way is to confine the webapp user to a virtual machine. You ...


6

The designers of the secured OpenWall GNU/*/Linux distro have also expressed critical opinions on su (for becoming root) and sudo. You might be interested in reading this thread: ...unfortunately both su and sudo are subtly but fundamentally flawed. Apart from discussing the flaws of su and other things, Solar Designer also targets one specific reason to ...


6

As others have said, generally, the idea of root is a user is permitted to make the machine do anything the machine can do. So, there isn't an easy flag that can prevent root from intentionally deleting a file (chattr +i can prevent accidental deletion). But, despite this, there are a couple of solutions: Put the file on a fileserver, and configure the ...


6

From the bash info page: `-p' Turn on privileged mode. In this mode, the `$BASH_ENV' and `$ENV' files are not processed, shell functions are not inherited from the environment, and the `SHELLOPTS', `BASHOPTS', `CDPATH' and `GLOBIGNORE' variables, if they appear in the environment, are ignored. If the shell is ...



Only top voted, non community-wiki answers of a minimum length are eligible