[5363] in RedHat Linux List
Re: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Kyle Ferrio)
Wed Nov 20 22:28:30 1996
Date: Wed, 20 Nov 1996 22:23:41 -0500 (EST)
From: Kyle Ferrio <kbf@babylon5.ea.org>
Reply-To: kbf@phy.duke.edu
To: redhat-list@redhat.com
In-Reply-To: <3293BE78.7664FB01@in_my.signature>
Resent-From: redhat-list@redhat.com
On Wed, 20 Nov 1996, Borg wrote:
> Chris Evans wrote:
> >
> > Hi,
> >
> > On my redhat4.0 system, a "find / -perm 4000" lists an awful lot of suid
> > programs. Some sound highly dubious. How many of these have been scrutinised
> > for security holes?
>
> ?? Nothing like that is found on my system where
> all permissions are default ones except pppd:
>
> [root@borg /]# find / -perm 4000
> [root@borg /]#
What version of 'find' are you using? If you're using the gnu find that
ships with Colgate, then you should be using (as root)
find / -perm +4000 -uid 0
The '+' in from of the mode is very significant. Unadorned modes must
match exactly. The + (-) prefix modifiers require the mode of the target
files to macth a sub (super) set of the specified mode. If an unadorned
4000 returns anything, I'd be (mildly) surprised. The -uid restriction to
root is not essential but prunes out files owned by news, mail, etc.
Flavor to taste.
I also find a bunch of suid root programs on my system, but I know why the
overwhelming majority of them need to be. Admittedly, there are few that
I don't know as much about as I should. I wonder what
that /usr/sbin/backdoor could be? :) :) :)
Kyle Ferrio
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
