From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Thu, 30 Mar 2006 21:32:43 +0300 From: Michael Shigorin To: sysadmins@lists.altlinux.org Message-ID: <20060330183243.GE5173@osdn.org.ua> Mail-Followup-To: sysadmins@lists.altlinux.org Mime-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.4.2.1i Subject: [Sysadmins] Fwd: Re: Sudo tricks X-BeenThere: sysadmins@lists.altlinux.org X-Mailman-Version: 2.1.7 Precedence: list Reply-To: shigorin@gmail.com, ALT Linux sysadmin discuss List-Id: ALT Linux sysadmin discuss List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2006 18:33:59 -0000 Archived-At: List-Archive: Hi! Опинион, тасказать. ----- Forwarded message from Krzysztof Halasa ----- Date: Tue, 28 Mar 2006 15:27:25 +0200 From: Krzysztof Halasa To: John Richard Moser Subject: Re: Sudo tricks Cc: bugtraq/securityfocus.com John Richard Moser writes: > My conclusion is that the only real way to protect against this is for > bash to look for every binary in your path when you don't specify a > path; and check to see if any of those binaries is SUID. If even one > is, it should FLAT OUT IGNORE any aliases or non-SUID matches (to avoid > PATH=$HOME attacks). What do you all think? It won't work. If your non-root account is compromised you can't use sudo, su (or anything that changes access rights) safely. For example, you can't be sure what shell are you using. The password check (or other challenge) does only make sense if the terminal (on which it's entered: shell and user account count too) and the machine which checks it (the system) are both secure. I usually use a term "security level" to show what could in theory be safe and what can never be safe. For instance, root have higher security level than others on the same machine. "Trusted" machines (such as admin's terminal) have higher levels than non-trusted (multi-user, servers etc.): I can safely ssh from my non-root account on my secure terminal to root/some.server but the reverse is forbidden. Switching to higher level is never safe. Switching to lower level _can_ be safe - under conditions. One can consider root and non-root admin account to have the same security level, though (with non-root account used instead of root to limit accidental damage only). -- Krzysztof Halasa ----- End forwarded message ----- -- ---- WBR, Michael Shigorin ------ Linux.Kiev http://www.linux.kiev.ua/