2

I have tried the NOEXEC in my CentOS6.4 I have edited my /etc/sudo.conf file as below :

Path noexec /usr/libexec/sudo_noexec.so

and /etc/sudoers:

ssh ALL=(root) ALL,NOEXEC:/usr/bin/passwd

I am sure that the lib for noexec exists in the right path, but as the user ssh still can change password. The NOEXEC did not make any effect, can anyone give some suggestions on it?

4

The NOEXEC tag doesn't prevent programs from getting executed. It prevents listed programs from executing any other programs. From man sudoers:

aaron  shanty = NOEXEC: /usr/bin/more, /usr/bin/vi

This allows user aaron to run /usr/bin/more and /usr/bin/vi with noexec enabled. This will prevent those two commands from executing other commands (such as a shell).
If you are unsure whether or not your system is capable of supporting noexec you can always just try it out and check whether shell escapes work when noexec is enabled.

If you want to prevent users from executing a specific command have a look at !, e.g:

ssh ALL=(root) ALL, !/usr/bin/passwd

Please note that this line does not help much as it would be possible to create a copy of /usr/bin/passwd under a different name, copy one onto the host and set the appropriate permissions etc.

  • wow,get it.So it prevent the shell escape such as less ,more ?Nice of you,thank you – user42826 Jul 11 '13 at 11:29
1

I like @Ulrich's answer. I'll also caution you to fully understand the requirement around LD_PRELOAD and dynamically-linked executables mentioned at https://www.sudo.ws/man/1.7.10/sudoers.man.html#Preventing_shell_escapes

Takeaway:

Ultimately, using sudo safely is very difficult. Assume that your security measures are only adequate for reducing cases of trusted users making mistakes. If you are using it to secure untrusted users or processes, you should know enough to not need to ask questions.

Context:

I've been doing this professionally since 1995 and I'm not ready. YMMV

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.