Tag Info

Hot answers tagged

7

The way to add a directory to sudo's PATH (which, as you found out is not the same as root's), is to edit the sudoers file: sudo visudo Then, find this line: Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" And add your directory to the end of it: Defaults ...


4

Without something like SELinux, root can always write to files; since you're running as root you can always write. If you're not running as root, then the permissions apply; if file exists and is not writable, then > file or >> file will fail. If file does not exist, then it will be created if the parent directory is writable.


3

It's all about risk mitigation; if make does something destructive, you can only lose whatever data was modifiable (or deletable) by the user running it. So you run make as a plain user to limit the scope to that user's files, and you run make install as root because you have to if you want to install to /usr/local typically. Note that in the example you ...


2

It comes down to trust vs convenience. True, make might be insecure, but then so might make install. It's just that the surface attack area should (hopefully) be smaller for make install, and it's more likely a quick perusal of the Makefile will spot anything strange. However, installing software into the $PATH is risky regardless of who has compiled it, so ...


2

When sticky bit is set, only the file's owner, the directory's owner, or root can rename or delete the file. The sudo command is there to enable a user to impersonate another user, including root. When user2 issues a command through sudo to become root, he's getting root's permissions, and root always has all permissions on the system.


2

I don't know if this is the kosher way to do it, but it does work: The program that runs on a virtual terminal at startup is decided by the /etc/inittab file. These are all run as root. It has lines like these: 1:2345:respawn:/sbin/getty 38400 tty1 They decide what ends up on which virtual terminal. /sbin/getty provides a virtual terminal. In my case, ...


2

Your remote mail server doesn't believe root@yourdomain in the SMTP envelopeĀ¹ is a valid email address, so it's refusing messages from you. And that's where apticron is trying to send from, so it doesn't work. ssmtp allows you to override the default email address and relay on a per-user basis in the /etc/ssmtp/revaliases file. You can use this to set an ...


1

gksu acts like su, not sudo. That's why it asks you root password. Try to run gksudo instead if available. If not, you can run gksu --sudo-mode. Also, from the man page: Also notice that the library will decide if it should use su or sudo as backend using the /apps/gksu/sudo-mode gconf key, if you call the gksu command. You can force the backend by ...


1

On Root privileges You can remove root login, root password etc. You will then need some other way to get admin things done: such as adding users to groups configuring sudo to give fine-grained permissions giving users and programs capabilities. root has recently been broken into a number of capabilities, so where you read that you need root to do ...


1

First of all it is indeed a bad idea to use the homedirectory of root for other purposes. Consider a dedicated home directory for the new user, root is always able to access it. Are you indeed looking for setting the homedirectory of the ftp user to the homedirectory of the superuser root or are you looking for a way to safely specify a FTP root (jailed or ...


1

These values must match: /etc/rkhunter.conf: ALLOW_SSH_ROOT_USER=no /etc/ssh/sshd_config: PermitRootLogin no Can you confirm that these values are set as above? If so, you should not be warned by rkhunter any longer.


1

That you found a root or Adminstrator account in every OS you looked at is just coincidence (or maybe a result of being new to this all). You don't need that kind of super-user in an OS and many OS don't have such a user or any concept of user at all. e.g. MSDOS. If you (as the OS manifacturer) want to prevent all programs from doing everything without ...


1

Since you want to disable your application to see anything in the root directory, the easiest way is to change your application to check if the absolute rewrite of any path starts with / and take appropriate action. You need to work with the absolute paths to prevent workarounds like ../../.. from some location down the tree. That way you can even easily ...



Only top voted, non community-wiki answers of a minimum length are eligible