5

How can I safely access "my" web services and accounts in a computer in which I do have sudo rights but the administrator(s) have, naturally, remote root access as well?

Details

I use a dekstop which is connected to a (large) closed/restricted LAN. Even log-in to the system is only successful if connected to the LAN.

The administrator has, of course, remote root access (which I will suggest to change and opt for a password-less ssh-key based authentication). As well, my userid is assigned to the sudoers group, ie, in the /etc/sudoers file, there is:

userid ALL=(ALL) NOPASSWD: ALL

I am hesitant to use my passwords for accessing my webmail client and my firefox account. And more.

Questions

  • What can I do to ensure that my passwords, to access external web services, are protected from anyone else than me?

  • For example, since I do have sudo rights, how can I ensure that no key loggers are running?

  • I access password-less-ly based on SSH key(s) various services. How can I protect my passphrase from being logged?

  • Would 2FA be safe to access external services in such a use-case?

  • Is there a collection of "Safe practices using a Linux-based computer which others can access remotely as root?"

7
  • SELinux, AppArmor ? encryption?
    – ceph3us
    Commented Feb 22, 2017 at 9:59
  • 3
    @ceph3us ... which root can disable... Commented Feb 22, 2017 at 10:00
  • 2
    security.stackexchange.com/questions/7801/…
    – ceph3us
    Commented Feb 22, 2017 at 10:03
  • And if someone can install dedicated hardware, they don't even need root. (And the aforementioned hardware may already be present: If you've got a firewire interface, then the first 4GB of your RAM is readable by anyone who can plug into it). Commented Feb 22, 2017 at 18:51
  • @CharlesDuffy Forget about firewire, you can have an USB keylogger on Arduino. Small enough that you wouldn't notice it on your own computer. Commented Feb 23, 2017 at 7:38

2 Answers 2

25

You can't.

The root user has full access to the machine. This includes the possibility of running keyloggers, reading any file, causing the programs you run to do things without showing them in the user interface... Whether this is likely to happen depends on your environment so we can't tell you that. Even 2FA isn't safe because of the possibility of session hijacking.

In general, if you suspect a machine isn't safe, you shouldn't use it to access your services.

9
  • Since I have sudo rights, and I can become root too, isn't there any way to ensure that key loggers aren't running. I remember reading that even without an explicit key logger, it is still possible, in Linux, to get what is typed, given root access. Commented Feb 22, 2017 at 11:36
  • 2
    Well, you might examine all processes and check what they're doing, but discovering a keylogger is going to be a hard task if root decided to hide it. Concerning your second sentence: w tells you what is the current command run by any user. You can also examine the shell command history of any user, too.
    – dr_
    Commented Feb 22, 2017 at 11:58
  • 7
    Note that you can't really trust anything. w could be replaced by w | grep -v shadyuser or even recompiled to hide what certain users are currently executing.
    – simon
    Commented Feb 22, 2017 at 13:25
  • 2
    @NikosAlexandris That's mostly impossible, and basically a cat--mouse problem. The root can run a keylogger under a different process name. You can examine all root's processes' assembler code for "malware". They can modify the program that lets you read raw memory so that it does not reveal the process is a malware. You can port your own such program. Etc. -- do I have to continue?
    – yo'
    Commented Feb 22, 2017 at 15:26
  • 2
    @dr01, rootkits -- software packages that make a formerly non-malicious environment into a malicious one, including hiding from tools (up to and including patching the kernel to not show up in the procfs and sysfs interfaces that ps, top, etc. use), are very much a thing that exist, and they're often programmatically installed as part of a malware infection. Which is to say -- no, not really that unlikely. Commented Feb 22, 2017 at 18:44
1

The accepted answer is technically correct and probably alright for about 99% of all of the usual crop of Unix/Linux machines in use today, I assume. Still, we can tackle the problem with a slightly more differentiated view and try to target your actual question (which is not exactly "can root do everything in my machine" but "how can I protect myself").

@ceph3us linked https://security.stackexchange.com/questions/7801/keeping-secrets-from-root-on-linux in a comment. That question and its answers talks about possibilities to keep things secret from root, available today. If you are real paranoid, and likely you will have to reinstall the machine, then you could try some of that stuff. I.e., SELinux with very restrictive settings.

SELinux has, in your scenario, a big drawback. The remote admins are remote admins because, well, they are supposed to admin your machine. This means they need to have full control over absolutely anything, to do basically anything with your machine, including making it secure in the first place. It is not a technical issue at all, it is one of organization. Even if you install SELinux, they will still need to have full access to do their job.

To transcend the question of root, let's rephrase the problem like this: any remote admin who has enough power to do everything a remote admin needs to do (up to and including configuring and hardening any security aspects of the system) is outside of the security aspects of the system. By definition. No technical measure can change this, ever.

So, in practice, the only angle I see for you is this: reinstall the machine with your own installation, from scratch. Now, hear me out. There are two scenarios, both of which I have experienced in different companies: the one kind of company acknowledges that while most people (predominantly non-Unix people) could not care less, there are some people who are able and can be trusted to handle their own machine. If you are one of those guys, then you trade their potential service for your freedom. They usually will deny any help with your machine, after you took it over. Which is exactly what you want.

Then, you can harden it as much as you want, and your erstwhile admins will then have no particularly stronger possibility to hack your machine, compared to any other script kiddy out there.

This kind of company has understood that an internal LAN is not, by itself, a particularly safe place; i.e., it handles all machines on the LAN (even though they are presumably hardened by the company's team of admins) as possible attackers. In this scenario, they could care less about you installing your own stuff.

The other scenario is that your company simply forbids it. Then it's time to find out why that it the case. Are they afraid that you might botch your machine and then call them for help, which will be hard for them to do? Assure them that you will handle yourself. Is there a license issue? On Linux? Don't think so. Are they afraid that you can run malicious code/install stuff from the internet, whatever? You can already do that, you already have root. Do they think you can do the machine to do malicious stuff without their keyloggers/screenloggers seeing it? Then you probably work at the NSA and they monitor their own guys (I'm just kidding, I have no idea about NSA internals ;) ).

You see where I'm going, I hope. There is no practical reason to assume that you using their installation (with you having full root access yourself) makes anything safer than you using your own installation and them having no access.

Try to convince them, or find out why they won't be convinced. That should tell you something, maybe.

1
  • +1 Very interesting insight, touches many aspects of my questions. Commented Feb 23, 2017 at 11:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .