RE: Locking down ssh config in large env

From: Michael Shirk (shirkdog_at_cryptomail.org)
Date: 09/30/04

  • Next message: Joseph Miller: "Re: Blocking ssh but not sftp/scp" 
    Date: Thu Sep 30 12:29:38 EDT 2004
To: secureshell@securityfocus.com

    Thanks for fixing my error. (It is nice when people understand you when you type silly things :-)
                                                                                                                                                                                                                                                                                       
    I found the same info as you on chattr (well, use ext2 LOL). But there has to be a way to protect that file from modification.
                                                                                                                                                                                                                                                                                                  
    Shirkdog
    -----Original Message-----
    From: atossava@cc.helsinki.fi [mailto:atossava@cc.helsinki.fi]
    Sent: Wednesday, September 29, 2004 2:30 AM
    To: secureshell@securityfocus.com
    Subject: Re: Locking down ssh config in large env
    Importance: Low
    Michael Shirk (Shirkdog) wrote:
    > What about the immutable bit "chmod +i .ssh".
    > If it is root owned, and the immutable bit set, no one can change it.
    > Root has to unset the bit first. However, it will not be able to update
    > for new sshd hosts, but that it is a security feature.
    > Atro, test this on your box and let me know.
    root@thisbox /home/username 4 # uname -a
    Linux thisbox 2.4.27 #1 Mon Aug 16 15:45:29 EEST 2004 i686 unknown
    root@thisbox /home/username 5 # mount
    /dev/hda7 on / type reiserfs (rw)
    ...
    root@thisbox /home/username 2 # mkdir pelle
    root@thisbox /home/username 3 # chmod +i pelle
    chmod: invalid mode
    You mean chattr, and according to its manual page, it only works on ext2.
    The attribute is set and recorded on reiserfs too (can be viewed with
    lsattr), but does not prevent the user from renaming the root-owned
    supposedly immutable directory "pelle" in the user's home directory.
    Even if it worked across all Linux file systems, which it seems not to
    be doing, it is at any rate not portable across UNIX systems and there-
    fore not a solution either. I couldn't find anything on Solaris 8 or
    HP-UX 10.20 that would do the same (but maybe I wasn't looking hard
    enough). IRIX 6.5 has the capabilities system and OSF1 (Tru64) has
    the Extended File Attributes which might be applicable. 

    -- 
Atro Tossavainen (Mr.)               / The Institute of Biotechnology at
Systems Analyst, Techno-Amish &     / the University of Helsinki, Finland,
+358-9-19158939  UNIX Dinosaur     / employs me, but my opinions are my own.
< URL : http : / / www . helsinki . fi / %7E atossava / > NO FILE ATTACHMENTS
!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+
CryptoMail provides free end-to-end message encryption.  
http://www.cryptomail.org/   Ensure your right to privacy.
Traditional email messages are not secure.  They are sent as
clear-text and thus are readable by anyone with the motivation
to acquire a copy.
!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+
  • Next message: Joseph Miller: "Re: Blocking ssh but not sftp/scp"

    Relevant Pages

    • Re: Locking down ssh config in large env
      ... > If it is root owned, and the immutable bit set, no one can change it. ... supposedly immutable directory "pelle" in the user's home directory. ... Even if it worked across all Linux file systems, ... it is at any rate not portable across UNIX systems and there- ...
      (SSH)
    • Re: What the logic to group ownership?
      ... say only root can *write* to the root/sys 755 files. ... The group (sys) ... there that groups were more widely used on early Unix systems ... in file permissions is another. ...
      (comp.unix.solaris)
    • Re: / owned by bin causes sshd to complain bad ownership
      ... A SUID with bin has less power than a SUID with uid=root ... SUID root, why not convert most binaries to uid=bin, thenmost binaries ... are 2 bits away from jackpot, more safety in event of a blunder too. ... UID which all unix systems agree on. ...
      (FreeBSD-Security)
    • Re: Excellent news.. Malware for OS X!
      ... If you'll note that some files ownerships are 'root' 'wheel' and then printers on some unix systems are 'lp' 'root'. ... Sometimes you can make changes on some files with admin rights and other times you cannot. ... Try and do a chmod +w or -x on those bin files. ...
      (comp.sys.mac.advocacy)
    • Re: root password
      ... rather than login in as a user, and su to root. ... Direct root logins are a security hazard, ... known to exist in all UNIX systems, so all an attacker needs to guess ... accounts, even on UNIX systems, and root GUI logins on their Compaq ...
      (comp.os.linux.setup)