SUID permissions - Which is correct?

Question

Trying to secure a Linux server and have little experience with SUID. After executing

find / -perm +4000

many programs were discovered. I have seen conflicting advice here and here on what should be enabled and not.

SUID Enabled
/bin/su
/usr/bin/passwd
/usr/bin/gpasswd
/sbin/unix_chkpwd

SUID Disabled
/usr/bin/crontab
/usr/bin/newgrp
/bin/ping
/bin/ping6
/bin/umount
/bin/mount
/usr/bin/chsh
/usr/bin/chfn
/usr/libexec/pt_chown
/usr/bin/sudo
/usr/bin/sudoedit
/usr/bin/chage
/usr/sbin/userhelper
/usr/sbin/usernetctl
/usr/sbin/suexec

UNSURE
/usr/libexec/openssh/ssh-keysign
/sbin/pam_timestamp_check

Server will host multiple sites with few Linux / SFTP users.
What should change? Also, how should I test?

Answer 1

Let your distribution do what it wants unless you're sure you know what you're doing. The fact that you need to ask this question shows that you don't know enough. So leave well alone.

Which programs need to be setuid depends on how things are set up on your distribution. For example, Fedora has replaced most uses of setuid by setcap. For example, ping needs the CAP_NET_RAWIO capability to be able to open raw sockets; it can get it by being setcap CAP_NET_RAWIO (better privilege isolation), or by being setuid root (the traditional method, which doesn't require setcap executables).

The programs you list are designed to be executed by ordinary users but require extra privileges to function. If you remove their setuid bit, you will break your system. For example, ping will just stop working (unless you're logged in as root). You will be able to become root with su but not with sudo, which defeats the whole point of sudo. Users will not be able to set crontabs. And so on.

On a dedicated server, some of the things that you've broken might not matter. But you should only change the distribution's defaults if you know that you're doing the right thing, not the other way round. Remember that availability is part of security. If you lock yourself out of the server or make yourself unable to diagnose and repair problems, you've broken your own security.

Answer 2

I personally wouldn't bother as the programs you listed are typically considered to be safe and secure. And for example sudo without the suid bit set makes no sense. The same goes for chsh chfn etc. If you really want to secure your server I would just give following executables suid permissions:

• ping/ping6 for diagnostic reasons.
• suexec to run cgi scripts under different users
• su or sudo
• pt_chown if you don't have devpts

You can remove the suid bit from ssh-keysign as it is only used for host based authentification according to http://lists.freebsd.org/pipermail/freebsd-stable/2006-October/029737.html

You should also make sure your users don't get shell access and have their directory chrooted.

If you really want to secure your server you should consider looking into SELinux.

Answer 3

selinux will take care a lot of that (on those systems that have it). So if you are using selinux, I would leave all the setuid stuff alone, it shouldn't have any more permissions than the selinux policy would give it.