Tag Info

Hot answers tagged

81

Security is always about making trade-offs. Root would be most secure if there were no way to access it at all. I notice that your LD_PRELOAD and PATH attacks assume an attacker with access to your account already, or at least to your dotfiles. Sudo doesn't protect against that very well at all — if they have your password, after all, no need to try ...


60

If you take a look at the executable sudo: $ which sudo /usr/bin/sudo $ ls -la /usr/bin/sudo ---s--x--x 2 root root 208808 Jun 3 2011 /usr/bin/sudo You'll notice that it carries the permission bits ---s--x--x. These can be broken down as follows: -|--s|--x|--x - - first dash denotes if a directory or a file ("d" = dir, "-" = file) --s - only ...


25

This is a very complex question. mattdm has already covered many points. Between su and sudo, when you consider a single user, su is a little more secure in that an attacker who has found your password can't gain root privileges immediately. But all it takes is for the attacker to find a local root hole (relatively uncommon) or install a trojan and wait for ...


23

I'm going to use Firefox as an example, because its open source and easy to find the information for, but this applies (probably with slightly different lists of ports) to other browsers, too. In August 2001, CERT issued a vulnerability note about how a web browser could be used to send near-arbitrary data to TCP ports chosen by an attacker, on any ...


13

No, this isn't possible. You can set the immutable attribute with chattr +i, which will at least make it irritating and non-obvious what has to be done to allow writing to the file, but they can just unset it again. Also, your filesystem has to support this, and have the functionality enabled. SELinux can also do some limiting, but again, it can be ...


13

Use su: su - alice sudo vim /etc/hosts From man su: The su command is used to become another user during a login session. Invoked without a username, su defaults to becoming the superuser. The optional argument - may be used to provide an environment similar to what the user would expect had the user logged in directly. For more ...


11

setcap 'cap_net_bind_service=+ep' /path/to/program this will work for specific processes. But to allow a particular user to bind to ports below 1024 you will have to add him to sudoers. Have a look at this discussion for more.


9

(Some of these methods have been mentioned in other answers; I'm giving several possible choices in rough order of preference.) You can redirect the low port to a high port and listen on the high port. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 1080 You can start your server as root and drop privileges after it's started ...


9

The simplest way is to use the su(1) command, it has an option that allows you to run a command via the user's shell, example: su foo -c ls This will switch to the user foo and run the ls command. If the user you want to use does not have a valid shell (ie it's not in /etc/shells, like /bin/false or /sbin/nologin) you will also have to specify a shell on ...


9

You should read the Arch Wiki page on sudo. sudo ("substitute user do") allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. You can install sudo from the repositories and then ...


9

ping needs root so it can open a socket in raw mode. That's literally the first thing it does when it starts up: icmp_sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP); socket_errno = errno; That's the only thing it needs root for, so like many programs, it immediately drops its privilege level back to your normal user account: uid = getuid(); if ...


7

This is from the kill(2) manpage: For a process to have permission to send a signal it must either be privileged (under Linux: have the CAP_KILL capability), or the real or effective user ID of the sending process must equal the real or saved set-user-ID of the target process. In the case of SIGCONT it suffices when the send‐ ...


7

sudo tcpdump -Z uses initgroups(3), setgid(2) and setuid(2) to drop the root privileges of its own process. # code taken from: # http://www.opensource.apple.com/source/tcpdump/tcpdump-32/tcpdump/tcpdump.c /* Drop root privileges and chroot if necessary */ static void droproot(const char *username, const char *chroot_dir) { ... if ...


7

Change the setuid bit of mysqld executable and the ownership of the executable file to mysql account, besides adding the required user in the group mysql for making him have access to the files on the filesystem. Use visudo -f /etc/sudoers and grant him permission to execute the /etc/rc.d/init.d/mysql start and /etc/rc.d/init.d/mysql stop as two seperate ...


6

The designers of the secured OpenWall GNU/*/Linux distro have also expressed critical opinions on su (for becoming root) and sudo. You might be interested in reading this thread: ...unfortunately both su and sudo are subtly but fundamentally flawed. Apart from discussing the flaws of su and other things, Solar Designer also targets one specific reason to ...


6

Chroot only restricts filesystem access. If you have root permissions, a chroot is merely an inconvenience, not a secure confinement. Ordinary users can use sockets but not shut down the machine. There are ways to restrict what users can do: capabilities, AppArmor, SELinux, … But by far the easiest way is to confine the webapp user to a virtual machine. You ...


6

You mix two different distinctions here: Between real and effective group ids Between primary and supplementary users' groups The first distinction refers to how processes are being run. Normally, when you run a command/program, it is run with the privileges of your user. It has the real group id same as your user's primary group. This can be changed by ...


6

As others have said, generally, the idea of root is a user is permitted to make the machine do anything the machine can do. So, there isn't an easy flag that can prevent root from intentionally deleting a file (chattr +i can prevent accidental deletion). But, despite this, there are a couple of solutions: Put the file on a fileserver, and configure the ...


6

apache restarts just fine but on the web it does not work. Port 80 is the default HTTP port for browsers as well as servers. This means in order to access a server that's operating on a non-standard port from a browser, you need to include the port in the address, e.g.: http://localhost:79/rest/of/url Without the :79 after the hostname, the browser ...


5

I think I should link here two answers from serverfault: how do i duplicate the nobody user? and Create restricted user on Debian server ( btw, it was moved to serverfault from stackoverflow, just recently -- and possibly could have been moved to this site as well ) Basically -r means "set account as a system one" -- "no expiration", etc -- and the full ...


5

From here (centos.org) useradd (which is the actual binary the runs when you call adduser, it just behaves differently. See here about that.) has an flag -r which is documented as follows: -r Create a system account with a UID less than 500 and without a home directory Which sounds like what you want to do.


5

First I'll discuss the setuid bit, which passwd uses and is distinct from the setuid() system call (which passwd does not use). There is perhaps some confusion in the question in this regard. It is not a protection against a buffer overflow, it's vunerable to such, or basically anything which would allow an attacker to use a privileged process for some ...


5

From the bash info page: `-p' Turn on privileged mode. In this mode, the `$BASH_ENV' and `$ENV' files are not processed, shell functions are not inherited from the environment, and the `SHELLOPTS', `BASHOPTS', `CDPATH' and `GLOBIGNORE' variables, if they appear in the environment, are ignored. If the shell is ...


4

If I understand correctly, you just need to su from root to some other user. Try copying an su binary (it won't need to be setuid root), but I don't know if that will work on Solaris. Or compile a small C program that drops privileges and executes a command. Here's a small “down-only” su. Minimally tested. Should compile as is under Solaris and *BSD; you ...


4

The process itself has to call setuid(2). You should also investigate running it inside chroot(8) if you arent already. As far as I know there is no way for root to change the uid of another process. If the reason you are running it as root is to bind ports I'd suggest running it as a normal user on a higher port and using ipfw(8) on OS X to forward port ...


4

If start-stop-daemon is available on your system you should probably use it and have a look at its options (especially -u and -g in this case). (Otherwise, you might use a combination of su and sg.) Update: Here is an example taken from some /etc/init.d/mpd script (which uses start-stop-daemon): Start command: echo "Starting Music Player Daemon" ...


4

On a default Ubuntu install, the root account is locked, which is implemented by storing into the password hash field a value that cannot be a legal hash. See more details here: Is there a root password on OS X and Ubuntu?


4

A simple ls -l would do the trick. The -l option to the Unix command ls will list the files using a long format. In short this displays for each file: Unix file type permissions number of hard links owner group size last-modified date filename Example: $ ls -l -rw------- 1 root root 9560 23 mar 12:05 .bash_history -rwxr-xr-x 1 root root 524 28 ...


4

When executing shell scripts that have the setuid bit (e.g., perms of rwsr-xr-x), the scripts run as the user that executes them, not as the user that owns them. This is contrary to how setuid is handled for binaries (e.g., /usr/bin/passwd), which run as the user that owns them, regardless of which user executes them. Check this page: ...


4

You can do this through Linux capabilities. You'll need to set CAP_NET_BIND_SERVICE and you can use the answer given here as a guide. However, as others have pointed out, this is an unwise thing to do. Having a user take over port 22 or port 80 could have very bad consequences.



Only top voted, non community-wiki answers of a minimum length are eligible