3

I was reading the BSI Security Guidelines (GERMAN), on NIS and it explicitly mentioned that one should prevent the entry +::0:0::: from occuring in the /etc/passwd file of the NIS server.

From my research I have garnered, that the + would import the entire NIS list into the passwd file. The solution proposed by the guideline, is to add a * to the password section of the entry, which would make the username be looked up in the shadow file. Is this not somewhat counter productive, as it would essentially make importing the NIS list useless (since these do not have entries in shadow)?

Furthermore, what would a legitimate usage of this entry be and how could an attacker exploit the entry (without the *)?

4

The entries like +::0:0::: can only work as intended if you have passwd: compat in your /etc/nsswitch.conf file. If you use passwd: files nis instead, this entry will not have its intended effect.

At least according to nsswitch.conf(5) man page on my Debian 9 system, that does not seem like valid syntax anyway: it should be either +user::0:0::: where user would be a NIS username who will be given root access on this system, or just + which includes all NIS users except those that have previously been excluded using -user or -@netgroup syntax, without overriding the NIS-specified UID/primaryGID values.

By extension, +::0:0::: would seem to mean "every NIS user is root on this system", which seems like not a good idea in the first place.

The danger is, for an application that handles authentication on its own by reading /etc/passwd and /etc/shadow but does not implement the passwd: compat style syntax extensions, that line literally means "user + has UID 0 and GID 0 and has no password".

If you're using such an application, this is a "type + to the username prompt, just press Enter at the password prompt; you now have root access" vulnerability. Since there is no valid shell, you might not get shell access immediately: but just having UID 0 access through an application probably gives a savvy intruder plenty of leverage to gain full root shell access quite soon afterwards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.