Re: Access to nfs server, Part 2

From: Scott Gifford (sgifford_at_suspectclass.com)
Date: 07/23/04

  • Next message: Alex Derkach: "Re: Hack attempt" 
    To: Kevin Johnson <kjohnson@secureideas.net>
Date: Fri, 23 Jul 2004 12:14:05 -0400

    Kevin Johnson <kjohnson@secureideas.net> writes:

    > I believe that using sudo to give the developer access to what ever
    > commands he needs to run should prevent the 'su - <username>' trick.
    > I am always leery of giving someone root access to any machine on my
    > network if I don't trust him on EVERY machine.

    This will only work if you're very careful of what commands you allow
    them to run, and the commands are designed to be run with elevated
    privileges. Otherwise the developer may be able to use command-line
    options or interactive commands to get into a shell or otherwise run
    arbitrary commands.

    For example, let's say you put a command in sudoers to allow a
    developer to edit /etc/services with vi. Once vi starts up, they can
    simply use :! to run commands as root. There are many variations on
    this sort of attack/abuse, and it can be quite difficult to find them
    all.

    -----ScottG.

  • Next message: Alex Derkach: "Re: Hack attempt"

    Relevant Pages

    • Re: Simple tracking question
      ... a user is logging in from (in one of my cases: root access from a LAN ... Studying the logs I can easily see who have been using sudo and the ... commands they executed with it. ... is the fact that you won't have to give away the root password. ...
      (comp.os.linux.security)
    • Re: How do you use the Xwindows interface as the root?
      ... commands with root access but the the xwindows Gnome interface still is ... <programname>" from the commandline. ...
      (alt.linux)
    • Re: Most common line commands in RH or Fedora?
      ... Commands like: ... yum - used to install packages if you have setup yum (you probably want ... grep - when you are listing things allows you to limit the list to ... sudo - used to give you root access for a single command (you need to ...
      (alt.os.linux.redhat)
    • Re: sudo not log command
      ... them root access with setuid but restrict who can execute them by group ... Setting suid works for the 2 commands, so i can run the command completely with all options/switches, but I didn't really need that, it's a bit overkill. ... If I try setting chown to root for the script then setting suid on the script only, ...
      (comp.os.linux.misc)
    • Re: [opensuse] Checkinstall dropped from Opensuse [Was: Compiling the Suse way]
      ... But then there is a large list listing every single file and directory that the rpm has to have. ... Only the developer of that library knows what needs to be included. ... Commands I can type, ... Even an advanced user. ...
      (SuSE)