5

I was sshing into a certain computing system that I use. I was trying to follow some Linux instructions that involved sudo, and tried a few times to enter the password unsuccessfully, before realizing that I was getting it incorrect because I was typing in my ssh terminal.

I then received a very accusatory email about how my trying to sudo constituted a threat to the system. The tone was sustained even after I explained that it was an accident.

My concrete question is: what is the threat model whereby trying a couple times to sudo without permission is considered a serious violation of system security?

Note: I understand in principle why the rule is there. My guess is that you don't want people writing automated scripts trying to crack the password - or I guess try to input a password one obtained via social engineering. But a couple unsuccessful guesses for some silly command...what's the threat model?

  • 4
    If you're just now learning to use Linux, you should really set up a dedicated virtual machine for learning purposes—definitely not play with sudo on a machine that has any value at all. ;) You do need sudo for some learning purposes, though. I recommend downloading and installing Vagrant and VirtualBox, and using the vanilla puppetlabs vagrant boxes as recommended here. – Wildcard Apr 16 '16 at 0:36
  • 3
    Why don't you share the list of commands you tried to use? It's difficult to assess why the administrator is so angry without a complete picture of what happened. – Patrick Trentin Apr 16 '16 at 6:16
  • 1
    Theoretically, I can easily imagine my shared hosting providor getting pissed of if I try to get root. On the other hand, free pentesting. – Sebb Apr 16 '16 at 12:11
14

First off, sudo all by itself, doesn't send any emails or create warning messages, other than logging your unsuccessful attempt to the log. People who observe these logs and correlate events (most probably using a scripted log watcher), see that some user id, which happened to be yours this time, is trying to gain root access where he/she is not permitted. As a result, the automated process fires an email to the offender. Even though you think you might be responding to a human being, 9 out 10 times, your response goes into a mailbox, which is either not observed, or checked very seldom.

If you think you have received a response to your explanation from an actual human, who keeps accusing you after you made clear that this was a mistake and you were not on the right server, he is either too bored and looking for something to do or have strict orders to scare people off.

Other than brute force cracking attempts, there is no other threat vector in the wild at this time, attacking sudo protected servers, that I know.

Also, consider asking questions of this nature in the Information Security section of Stack Exchange.

  • Thanks for your great answer. I know for a fact it was a human, given his follow up responses. – Lepidopterist Apr 15 '16 at 21:26
  • 2
    @Lepidopterist then it probably was an annoyed sysadmin. After I got enough of those mails from sudo, and mails to users didn't have any effect, I just wrapped sudo in a script that kills the users' session if they can't run sudo. – muru Apr 16 '16 at 8:50
  • 2
    "First off, sudo all by itself, doesn't send any emails" - Yes, it does. See the mail_no_user option in the man page: mail_no_user - If set, mail will be sent to the mailto user if the invoking user is not in the sudoers file. This flag is on by default. – marcelm Apr 16 '16 at 17:04
  • Thank you for this information. I have never seen or used this feature of sudo. – MelBurslan Apr 18 '16 at 11:09
8

I was trying to follow some linux instructions that involved sudo

This is the threat. A user who doesn't know or understand what he or she is entering into their terminal with sudo privileges can cause very bad things to happen very quickly. It sounds like the admin didn't really explain to you that trying to sudo isn't really the issue, (in theory you could try sudoing everything until you're blue in the face, but if you don't have sudo access none of it will do anything). It's the potential that he's concerned with. What if you did have sudo privileges and you entered a command you found on the internet that happened to be destructive?

  • 2
    That doesn't make sense. The question is about lacking sudo privileges and your answer is about having them. – Rein Henrichs Apr 16 '16 at 3:03
  • 1
    If they had sudo privileges then they wouldn't have tripped an alarm by trying to use sudo without privileges! – Rein Henrichs Apr 16 '16 at 3:05
  • 1
    @ReinHenrichs The implied question was also "why did the admin yell at me?" For doing something OP had no business doing, namely trying to sudo when he didn't have access. It's pretty clear from the admins response that OP shouldn't have been doing what he was doing, and instead of sitting down and explaining why he doesn't have sudo access he simply said "It's a security risk, case closed." Like I said, probably not the most tactful, but if we had to sit down and explain sudo to everyone who tried it we wouldn't have time for anything else. – SupBrah Apr 16 '16 at 3:51
  • 3
    Remember, the guy who doesn't have sudo access today could be the guy that does have it tomorrow. If you can teach someone not to paste commands requiring sudo from the internet before they even have sudo access, 99% of the job is done. – SupBrah Apr 16 '16 at 3:59
  • 1
    I have never seen any reason to believe that the purpose of this sort of alarm is to teach non-sudo users how to use sudo... which is good, because it would be a pretty terrible way to do that. It's generally part of an intrusion detection strategy. Why did the admin yell? Who knows. Some admins like to yell and some admins are annoyed when false positives cause unnecessary work for themselves. – Rein Henrichs Apr 16 '16 at 4:07
3

I can't speak to your specific situation; you'll have to ask your sysadmin why they chose to yell at you.

But I can tell you why sudo reports these incidents: Because there is no legitimate reason for them to happen. You do not have root. You should know that you don't have root (and if somehow you don't, you can check with sudo -l). You have no business attempting to do something which the sysadmin has chosen to prohibit. You will often find in computer security that "everything not permitted is prohibited." Since there is no valid reason to run sudo commands when you don't have appropriate privileges, it ought to be reported to a human for review. It might indicate misconfigured software, a compromised account, or any number of other security or non-security issues with the system.

2

If sudo is configured to send email and if the mailbox file hypothetical failed sudoers email goes to (or if the MTA is broken, the mail queue) is not or seldom monitored, and if a malicious local user is given sufficient time, and if disk usage on /var is not monitored, then a malicious local user may be able to fill that partition with mailbox or mailqueue entries due to failed logins, which could be bad. But that's a lot of if, and there would probably be more attractive targets in such a poorly run shop.

  • Upvoted because for some reason the thought of a user doing this without a script strikes me as extremely funny. – Lepidopterist Apr 16 '16 at 15:10
  • @Lepidopterist it would probably have to be a script, unless /var were teeny tiny, as I've seen root mailboxes with like two million messages and /var not full yet, and that was back in the '90s. – thrig Apr 18 '16 at 14:15
0

I suspect that the system reports each failed sudo attempt to the sysadmin, who takes them as individual action items. Yelling at you allows the sysadmin to cross them off his/her todo list.

The threat model is not to the system, but to the sysadmin. The sysadmin feels a need to respond to these incidents to prove that s/he is not asleep at the wheel.

If this is the case, the solution is to get VirtualBox or similar and stop bothering the sysadmin.

-1

The threat of repeatedly failed sudo access attempts is that a malicious user might be able to brute force the password and thereby escalate their privileges. Since the user in question doesn't actually have sudo access, this is a dangling threat – a threat with no vulnerability to exploit. However, a monitoring system might trigger an alarm for this as part of an intrusion detection strategy, or because it's a standard operating procedure for the admins.

The issue with false positives in alarm systems in general is that they can cause the alarm to lose its significance to the humans that monitor it, "Boy Who Cried Wolf" style. Admins are thus justifiably concerned with minimizing the number of false positives in their monitoring/alarm systems.

That said, this seems to be a pro forma email from an admin in response to a triggered alarm, and that admin's default communication style seems to be "disproportionately annoyed". I wouldn't worry about it.

(As a side note, I would worry about your practice of reckless copy/paste systems administration, especially when the commands you are copy/pasting are sudo commands.)

  • I didn't copy and paste. I just typed a sudo command into the wrong terminal. Thanks for your answer, though. – Lepidopterist Apr 18 '16 at 19:08
  • Ok. Reckless retyping the commands verbatim into the wrong terminal. The problem is the recklessness, not the copy/pasting. At a minimum, you should check that you are sending the commands to the correct machine before you proceed. – Rein Henrichs Apr 18 '16 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.