Re: Strange command histories in hacked shell history

From: Elvedin Trnjanin (mnsan11_at_earthlink.net)
Date: 12/18/04

  • Next message: Ed Stover: "Re: Strange command histories in hacked shell history"
    Date: Fri, 17 Dec 2004 22:13:47 -0600
    To: bv@wjv.com
    
    

    Bill Vermillion wrote:

    > I understand that after using Unix for about 2 decades.
    >
    >However in FreeBSD a user is supposed to be in the wheel group [if
    >it exists] to be able to su to root.
    >
    >But if a person who is not in wheel su's to a user who is in wheel,
    >then they can su to root - as the system sees them as the other
    >user.
    >

    >This means that the 'wheel' security really is nothing more
    >than a 2 password method to get to root.
    >
    >
    >
    Precisely. If you don't like this then the way around is to only allow a
    certain group access to su and none for everyone else.

    >If the EUID of the orignal invoker is checked, even if they su'ed
    >to a person in wheel, then they should not be able to su to root.
    >
    >I'm asking why is this permitted, or alternatively why is putting a
    >user in the wheel group supposed to make things secure, when in
    >reality it just makes it seem more secure - as there is only one
    >more password to crack.
    >
    >

    One more password to crack is more time which means a better chance of
    catching the cracker in the act. Although I don't know why exactly the
    authors of su did that the way they did but my first and best guess
    would be convenience. The two password method is better than a new login
    session each time you want to get to root. Second best guess would be is
    that they didn't figure out that issue or at least think much of it.

    -- 
    ---
    Elvedin Trnjanin
    http://www.ods.org
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
    

  • Next message: Ed Stover: "Re: Strange command histories in hacked shell history"

    Relevant Pages

    • Re: Strange command histories in hacked shell history
      ... >>to a person in wheel, then they should not be able to su to root. ... One more password to hack does make it harder, but in a paranoid ... > users in the wheel group can even execute su. ...
      (FreeBSD-Security)
    • Re: Strange command histories in hacked shell history
      ... However in FreeBSD a user is supposed to be in the wheel group [if ... it exists] to be able to su to root. ... But if a person who is not in wheel su's to a user who is in wheel, ... > on blah blah blah... ...
      (FreeBSD-Security)
    • Re: Question about a recent installation
      ... about how the root account is made. ... Found that the root folder was created ... the one, in addition to root, that belongs to the wheel group. ...
      (freebsd-questions)
    • Re: Strange command histories in hacked shell history
      ... > However in FreeBSD a user is supposed to be in the wheel group [if ... > it exists] to be able to su to root. ... > But if a person who is not in wheel su's to a user who is in wheel, ... > reality it just makes it seem more secure - as there is only one ...
      (FreeBSD-Security)
    • Re: Strange command histories in hacked shell history
      ... > But if a person who is not in wheel su's to a user who is in wheel, ... > than a 2 password method to get to root. ... > reality it just makes it seem more secure - as there is only one ...
      (FreeBSD-Security)