Tag Info

Hot answers tagged

82

Security is always about making trade-offs. Root would be most secure if there were no way to access it at all. I notice that your LD_PRELOAD and PATH attacks assume an attacker with access to your account already, or at least to your dotfiles. Sudo doesn't protect against that very well at all — if they have your password, after all, no need to try ...


61

If you take a look at the executable sudo: $ which sudo /usr/bin/sudo $ ls -la /usr/bin/sudo ---s--x--x 2 root root 208808 Jun 3 2011 /usr/bin/sudo You'll notice that it carries the permission bits ---s--x--x. These can be broken down as follows: -|--s|--x|--x - - first dash denotes if a directory or a file ("d" = dir, "-" = file) --s - only ...


25

This is a very complex question. mattdm has already covered many points. Between su and sudo, when you consider a single user, su is a little more secure in that an attacker who has found your password can't gain root privileges immediately. But all it takes is for the attacker to find a local root hole (relatively uncommon) or install a trojan and wait for ...


23

I'm going to use Firefox as an example, because its open source and easy to find the information for, but this applies (probably with slightly different lists of ports) to other browsers, too. In August 2001, CERT issued a vulnerability note about how a web browser could be used to send near-arbitrary data to TCP ports chosen by an attacker, on any ...


15

setcap 'cap_net_bind_service=+ep' /path/to/program this will work for specific processes. But to allow a particular user to bind to ports below 1024 you will have to add him to sudoers. Have a look at this discussion for more.


13

No, this isn't possible. You can set the immutable attribute with chattr +i, which will at least make it irritating and non-obvious what has to be done to allow writing to the file, but they can just unset it again. Also, your filesystem has to support this, and have the functionality enabled. SELinux can also do some limiting, but again, it can be ...


13

Use su: su - alice sudo vim /etc/hosts From man su: The su command is used to become another user during a login session. Invoked without a username, su defaults to becoming the superuser. The optional argument - may be used to provide an environment similar to what the user would expect had the user logged in directly. For more ...


9

The simplest way is to use the su(1) command, it has an option that allows you to run a command via the user's shell, example: su foo -c ls This will switch to the user foo and run the ls command. If the user you want to use does not have a valid shell (ie it's not in /etc/shells, like /bin/false or /sbin/nologin) you will also have to specify a shell on ...


9

(Some of these methods have been mentioned in other answers; I'm giving several possible choices in rough order of preference.) You can redirect the low port to a high port and listen on the high port. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 1080 You can start your server as root and drop privileges after it's started ...


9

You should read the Arch Wiki page on sudo. sudo ("substitute user do") allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. You can install sudo from the repositories and then ...


9

ping needs root so it can open a socket in raw mode. That's literally the first thing it does when it starts up: icmp_sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP); socket_errno = errno; That's the only thing it needs root for, so like many programs, it immediately drops its privilege level back to your normal user account: uid = getuid(); if ...


8

Change the setuid bit of mysqld executable and the ownership of the executable file to mysql account, besides adding the required user in the group mysql for making him have access to the files on the filesystem. Use visudo -f /etc/sudoers and grant him permission to execute the /etc/rc.d/init.d/mysql start and /etc/rc.d/init.d/mysql stop as two seperate ...


8

Running unprivileged containers is the safest way to run containers in a production environment. Containers get bad publicity when it comes to security and one of the reasons is because some users have found that if a user gets root in a container then there is a possibility of gaining root on the host as well. Basically what an unprivileged container does ...


7

sudo tcpdump -Z uses initgroups(3), setgid(2) and setuid(2) to drop the root privileges of its own process. # code taken from: # http://www.opensource.apple.com/source/tcpdump/tcpdump-32/tcpdump/tcpdump.c /* Drop root privileges and chroot if necessary */ static void droproot(const char *username, const char *chroot_dir) { ... if ...


7

This is from the kill(2) manpage: For a process to have permission to send a signal it must either be privileged (under Linux: have the CAP_KILL capability), or the real or effective user ID of the sending process must equal the real or saved set-user-ID of the target process. In the case of SIGCONT it suffices when the send‐ ...


7

I think I should link here two answers from serverfault: how do i duplicate the nobody user? and Create restricted user on Debian server ( btw, it was moved to serverfault from stackoverflow, just recently -- and possibly could have been moved to this site as well ) Basically -r means "set account as a system one" -- "no expiration", etc -- and the full ...


6

From here (centos.org) useradd (which is the actual binary the runs when you call adduser, it just behaves differently. See here about that.) has an flag -r which is documented as follows: -r Create a system account with a UID less than 500 and without a home directory Which sounds like what you want to do.


6

The designers of the secured OpenWall GNU/*/Linux distro have also expressed critical opinions on su (for becoming root) and sudo. You might be interested in reading this thread: ...unfortunately both su and sudo are subtly but fundamentally flawed. Apart from discussing the flaws of su and other things, Solar Designer also targets one specific reason to ...


6

Chroot only restricts filesystem access. If you have root permissions, a chroot is merely an inconvenience, not a secure confinement. Ordinary users can use sockets but not shut down the machine. There are ways to restrict what users can do: capabilities, AppArmor, SELinux, … But by far the easiest way is to confine the webapp user to a virtual machine. You ...


6

You mix two different distinctions here: Between real and effective group ids Between primary and supplementary users' groups The first distinction refers to how processes are being run. Normally, when you run a command/program, it is run with the privileges of your user. It has the real group id same as your user's primary group. This can be changed by ...


6

As others have said, generally, the idea of root is a user is permitted to make the machine do anything the machine can do. So, there isn't an easy flag that can prevent root from intentionally deleting a file (chattr +i can prevent accidental deletion). But, despite this, there are a couple of solutions: Put the file on a fileserver, and configure the ...


6

When executing shell scripts that have the setuid bit (e.g., perms of rwsr-xr-x), the scripts run as the user that executes them, not as the user that owns them. This is contrary to how setuid is handled for binaries (e.g., /usr/bin/passwd), which run as the user that owns them, regardless of which user executes them. Check this page: ...


6

apache restarts just fine but on the web it does not work. Port 80 is the default HTTP port for browsers as well as servers. This means in order to access a server that's operating on a non-standard port from a browser, you need to include the port in the address, e.g.: http://localhost:79/rest/of/url Without the :79 after the hostname, the browser ...


5

First I'll discuss the setuid bit, which passwd uses and is distinct from the setuid() system call (which passwd does not use). There is perhaps some confusion in the question in this regard. It is not a protection against a buffer overflow, it's vunerable to such, or basically anything which would allow an attacker to use a privileged process for some ...


5

From the bash info page: `-p' Turn on privileged mode. In this mode, the `$BASH_ENV' and `$ENV' files are not processed, shell functions are not inherited from the environment, and the `SHELLOPTS', `BASHOPTS', `CDPATH' and `GLOBIGNORE' variables, if they appear in the environment, are ignored. If the shell is ...


5

init files, which run at system boot (or on demand) do two main things: they start daemons running they do various one-time-per-boot tasks, such as cleaning up or preparing files, setting network parameters, etc. In this case, the sudo init script does not start a daemon. Instead, it invalidates any cached credential files that may have been left around ...


4

If I understand correctly, you just need to su from root to some other user. Try copying an su binary (it won't need to be setuid root), but I don't know if that will work on Solaris. Or compile a small C program that drops privileges and executes a command. Here's a small “down-only” su. Minimally tested. Should compile as is under Solaris and *BSD; you ...


4

The process itself has to call setuid(2). You should also investigate running it inside chroot(8) if you arent already. As far as I know there is no way for root to change the uid of another process. If the reason you are running it as root is to bind ports I'd suggest running it as a normal user on a higher port and using ipfw(8) on OS X to forward port ...


4

The kernel view Conceptually, there are three sets of groups that a process is a member of. Each set is a subset of the following one. The single group that is the process's default group, which files created by this process will belong to. The set of groups that are checked when the group requires permission to open a file. The set of groups that a ...


4

If start-stop-daemon is available on your system you should probably use it and have a look at its options (especially -u and -g in this case). (Otherwise, you might use a combination of su and sg.) Update: Here is an example taken from some /etc/init.d/mpd script (which uses start-stop-daemon): Start command: echo "Starting Music Player Daemon" ...



Only top voted, non community-wiki answers of a minimum length are eligible