Re: how to avoid user1 becoming user2 using local root ?
From: Daniel Souza (daniel_at_cidadedodireito.com.br)
Date: 03/27/04
- Previous message: Brian Hatch: "Re: nis : how to avoid user1 becoming user2 using local root ?"
- In reply to: Frédéric Médery: "nis : how to avoid user1 becoming user2 using local root ?"
- Next in thread: phaser-X: "Re: nis : how to avoid user1 becoming user2 using local root ?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: Frédéric Médery <mederyf@LEXUM.UMontreal.CA>, "Mailing List Linux- Security" <focus-linux@securityfocus.com> Date: Sat, 27 Mar 2004 17:55:56 -0300
you can just write a kernel module to deny any set*uid() by returning a
EPERM when the process' current uid is 0, except when the "destination uid"
is some like apache's uid, or named user (when you start apache, you start
it as a root user, cuz it uses the port 80 that is a priviledged port, so,
it after this initial start, it becomes "apache-user-owned").
[]'s
----- Original Message -----
From: "Frédéric Médery" <mederyf@LEXUM.UMontreal.CA>
To: "Mailing List Linux- Security" <focus-linux@securityfocus.com>
Sent: Friday, March 26, 2004 6:58 PM
Subject: nis : how to avoid user1 becoming user2 using local root ?
> our situation :
> All linux servers, all nfs share use the root_squash option.
> We're using NIS
> All developpers can become root on their local machines.
>
> The prob : if user1 do a `su -` on their station. And then, `su user2`
> they can become user2.
>
> For me it's a huge problem (windows don't have this prob, local admin
> are very different from domain/server admin) is there a way to avoid
> this prob ?
>
> Thanks !
>
>
- Previous message: Brian Hatch: "Re: nis : how to avoid user1 becoming user2 using local root ?"
- In reply to: Frédéric Médery: "nis : how to avoid user1 becoming user2 using local root ?"
- Next in thread: phaser-X: "Re: nis : how to avoid user1 becoming user2 using local root ?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
