3

Trying to secure a Linux server and have little experience with SUID. After executing

find / -perm +4000

many programs were discovered. I have seen conflicting advice here and here on what should be enabled and not.

SUID Enabled
/bin/su
/usr/bin/passwd
/usr/bin/gpasswd
/sbin/unix_chkpwd

SUID Disabled
/usr/bin/crontab
/usr/bin/newgrp
/bin/ping
/bin/ping6
/bin/umount
/bin/mount
/usr/bin/chsh
/usr/bin/chfn
/usr/libexec/pt_chown
/usr/bin/sudo
/usr/bin/sudoedit
/usr/bin/chage
/usr/sbin/userhelper
/usr/sbin/usernetctl
/usr/sbin/suexec

UNSURE
/usr/libexec/openssh/ssh-keysign
/sbin/pam_timestamp_check

Server will host multiple sites with few Linux / SFTP users.
What should change? Also, how should I test?

3 Answers 3

6

Let your distribution do what it wants unless you're sure you know what you're doing. The fact that you need to ask this question shows that you don't know enough. So leave well alone.

Which programs need to be setuid depends on how things are set up on your distribution. For example, Fedora has replaced most uses of setuid by setcap. For example, ping needs the CAP_NET_RAWIO capability to be able to open raw sockets; it can get it by being setcap CAP_NET_RAWIO (better privilege isolation), or by being setuid root (the traditional method, which doesn't require setcap executables).

The programs you list are designed to be executed by ordinary users but require extra privileges to function. If you remove their setuid bit, you will break your system. For example, ping will just stop working (unless you're logged in as root). You will be able to become root with su but not with sudo, which defeats the whole point of sudo. Users will not be able to set crontabs. And so on.

On a dedicated server, some of the things that you've broken might not matter. But you should only change the distribution's defaults if you know that you're doing the right thing, not the other way round. Remember that availability is part of security. If you lock yourself out of the server or make yourself unable to diagnose and repair problems, you've broken your own security.

3
  • 1
    +1 for the first paragraph, and another mental +1 for the remainder.
    – user
    Feb 14, 2013 at 10:38
  • @Gilles, definitely don't know enough which is why I am asking. Do you see vulnerabilities in any of the enabled programs if all are left to enabled?
    – csi
    Feb 14, 2013 at 14:27
  • @ChristopherIckes If there's a known vulnerability in any of these programs, your distribution's maintainers will push a security update. Feb 14, 2013 at 15:35
5

I personally wouldn't bother as the programs you listed are typically considered to be safe and secure. And for example sudo without the suid bit set makes no sense. The same goes for chsh chfn etc. If you really want to secure your server I would just give following executables suid permissions:

  • ping/ping6 for diagnostic reasons.
  • suexec to run cgi scripts under different users
  • su or sudo
  • pt_chown if you don't have devpts

You can remove the suid bit from ssh-keysign as it is only used for host based authentification according to http://lists.freebsd.org/pipermail/freebsd-stable/2006-October/029737.html

You should also make sure your users don't get shell access and have their directory chrooted.

If you really want to secure your server you should consider looking into SELinux.

1

selinux will take care a lot of that (on those systems that have it). So if you are using selinux, I would leave all the setuid stuff alone, it shouldn't have any more permissions than the selinux policy would give it.

3
  • Right as far as it goes, but SELinux can't give permissions, just take them away.
    – vonbrand
    Feb 14, 2013 at 14:36
  • @vonbrand afaik you can specify which programs/context have which capabilities... Feb 14, 2013 at 15:10
  • Right but if you are worried about setuid/setgid programs having too many permissions, selinux manages it and only gives it the perms it needs, even with setuid on.
    – lsd
    Feb 14, 2013 at 20:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .