5

How can I safely access "my" web services and accounts in a computer in which I do have sudo rights but the administrator(s) have, naturally, remote root access as well?

Details

I use a dekstop which is connected to a (large) closed/restricted LAN. Even log-in to the system is only successful if connected to the LAN.

The administrator has, of course, remote root access (which I will suggest to change and opt for a password-less ssh-key based authentication). As well, my userid is assigned to the sudoers group, ie, in the /etc/sudoers file, there is:

userid ALL=(ALL) NOPASSWD: ALL

I am hesitant to use my passwords for accessing my webmail client and my firefox account. And more.

Questions

  • What can I do to ensure that my passwords, to access external web services, are protected from anyone else than me?

  • For example, since I do have sudo rights, how can I ensure that no key loggers are running?

  • I access password-less-ly based on SSH key(s) various services. How can I protect my passphrase from being logged?

  • Would 2FA be safe to access external services in such a use-case?

  • Is there a collection of "Safe practices using a Linux-based computer which others can access remotely as root?"

  • SELinux, AppArmor ? encryption? – ceph3us Feb 22 '17 at 9:59
  • 3
    @ceph3us ... which root can disable... – Satō Katsura Feb 22 '17 at 10:00
  • 2
  • And if someone can install dedicated hardware, they don't even need root. (And the aforementioned hardware may already be present: If you've got a firewire interface, then the first 4GB of your RAM is readable by anyone who can plug into it). – Charles Duffy Feb 22 '17 at 18:51
  • @CharlesDuffy Forget about firewire, you can have an USB keylogger on Arduino. Small enough that you wouldn't notice it on your own computer. – Satō Katsura Feb 23 '17 at 7:38
26

You can't.

The root user has full access to the machine. This includes the possibility of running keyloggers, reading any file, causing the programs you run to do things without showing them in the user interface... Whether this is likely to happen depends on your environment so we can't tell you that. Even 2FA isn't safe because of the possibility of session hijacking.

In general, if you suspect a machine isn't safe, you shouldn't use it to access your services.

  • Since I have sudo rights, and I can become root too, isn't there any way to ensure that key loggers aren't running. I remember reading that even without an explicit key logger, it is still possible, in Linux, to get what is typed, given root access. – Nikos Alexandris Feb 22 '17 at 11:36
  • 2
    Well, you might examine all processes and check what they're doing, but discovering a keylogger is going to be a hard task if root decided to hide it. Concerning your second sentence: w tells you what is the current command run by any user. You can also examine the shell command history of any user, too. – dr01 Feb 22 '17 at 11:58
  • 7
    Note that you can't really trust anything. w could be replaced by w | grep -v shadyuser or even recompiled to hide what certain users are currently executing. – simon Feb 22 '17 at 13:25
  • 2
    @NikosAlexandris That's mostly impossible, and basically a cat--mouse problem. The root can run a keylogger under a different process name. You can examine all root's processes' assembler code for "malware". They can modify the program that lets you read raw memory so that it does not reveal the process is a malware. You can port your own such program. Etc. -- do I have to continue? – yo' Feb 22 '17 at 15:26
  • 2
    @dr01, rootkits -- software packages that make a formerly non-malicious environment into a malicious one, including hiding from tools (up to and including patching the kernel to not show up in the procfs and sysfs interfaces that ps, top, etc. use), are very much a thing that exist, and they're often programmatically installed as part of a malware infection. Which is to say -- no, not really that unlikely. – Charles Duffy Feb 22 '17 at 18:44
1

The accepted answer is technically correct and probably alright for about 99% of all of the usual crop of Unix/Linux machines in use today, I assume. Still, we can tackle the problem with a slightly more differentiated view and try to target your actual question (which is not exactly "can root do everything in my machine" but "how can I protect myself").

@ceph3us linked https://security.stackexchange.com/questions/7801/keeping-secrets-from-root-on-linux in a comment. That question and its answers talks about possibilities to keep things secret from root, available today. If you are real paranoid, and likely you will have to reinstall the machine, then you could try some of that stuff. I.e., SELinux with very restrictive settings.

SELinux has, in your scenario, a big drawback. The remote admins are remote admins because, well, they are supposed to admin your machine. This means they need to have full control over absolutely anything, to do basically anything with your machine, including making it secure in the first place. It is not a technical issue at all, it is one of organization. Even if you install SELinux, they will still need to have full access to do their job.

To transcend the question of root, let's rephrase the problem like this: any remote admin who has enough power to do everything a remote admin needs to do (up to and including configuring and hardening any security aspects of the system) is outside of the security aspects of the system. By definition. No technical measure can change this, ever.

So, in practice, the only angle I see for you is this: reinstall the machine with your own installation, from scratch. Now, hear me out. There are two scenarios, both of which I have experienced in different companies: the one kind of company acknowledges that while most people (predominantly non-Unix people) could not care less, there are some people who are able and can be trusted to handle their own machine. If you are one of those guys, then you trade their potential service for your freedom. They usually will deny any help with your machine, after you took it over. Which is exactly what you want.

Then, you can harden it as much as you want, and your erstwhile admins will then have no particularly stronger possibility to hack your machine, compared to any other script kiddy out there.

This kind of company has understood that an internal LAN is not, by itself, a particularly safe place; i.e., it handles all machines on the LAN (even though they are presumably hardened by the company's team of admins) as possible attackers. In this scenario, they could care less about you installing your own stuff.

The other scenario is that your company simply forbids it. Then it's time to find out why that it the case. Are they afraid that you might botch your machine and then call them for help, which will be hard for them to do? Assure them that you will handle yourself. Is there a license issue? On Linux? Don't think so. Are they afraid that you can run malicious code/install stuff from the internet, whatever? You can already do that, you already have root. Do they think you can do the machine to do malicious stuff without their keyloggers/screenloggers seeing it? Then you probably work at the NSA and they monitor their own guys (I'm just kidding, I have no idea about NSA internals ;) ).

You see where I'm going, I hope. There is no practical reason to assume that you using their installation (with you having full root access yourself) makes anything safer than you using your own installation and them having no access.

Try to convince them, or find out why they won't be convinced. That should tell you something, maybe.

  • +1 Very interesting insight, touches many aspects of my questions. – Nikos Alexandris Feb 23 '17 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.