[5405] in RedHat Linux List
Re: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Wojtek Pilorz)
Thu Nov 21 07:09:00 1996
Date: Thu, 21 Nov 1996 13:03:59 +0100 (MET)
From: Wojtek Pilorz <wpilorz@celebris.bdk.lublin.pl>
To: kbf@phy.duke.edu
Cc: redhat-list@redhat.com
In-Reply-To: <Pine.LNX.3.95.961120221405.457C-100000@babylon5.ea.org>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
On Wed, 20 Nov 1996, Kyle Ferrio wrote:
> Date: Wed, 20 Nov 1996 22:23:41 -0500 (EST)
> From: Kyle Ferrio <kbf@babylon5.ea.org>
> To: redhat-list@redhat.com
> Subject: Re: RedHat4.0 security
>
>
> On Wed, 20 Nov 1996, Borg wrote:
>
> > Chris Evans wrote:
> > >
> > > Hi,
> > >
> > > On my redhat4.0 system, a "find / -perm 4000" lists an awful lot of suid
> > > programs. Some sound highly dubious. How many of these have been scrutinised
> > > for security holes?
> >
> > ?? Nothing like that is found on my system where
> > all permissions are default ones except pppd:
> >
> > [root@borg /]# find / -perm 4000
> > [root@borg /]#
>
> What version of 'find' are you using? If you're using the gnu find that
> ships with Colgate, then you should be using (as root)
>
> find / -perm +4000 -uid 0
>
> The '+' in from of the mode is very significant. Unadorned modes must
> match exactly. The + (-) prefix modifiers require the mode of the target
> files to macth a sub (super) set of the specified mode. If an unadorned
> 4000 returns anything, I'd be (mildly) surprised. The -uid restriction to
> root is not essential but prunes out files owned by news, mail, etc.
> Flavor to taste.
>
Actially, I would prefer
find / -perm +6000 -ls
which also cover executables with set group id set (can also be
dangerous ...); or, if you have remote filesystems (hopefully imported
with -o noduid,nodev , or even noexec):
find / -perm +6000 -xdev -prune -ls
find /usr -perm +6000 -xdev -prune -ls
end so on for other mount points;
For those concerned with security of their systems I would heartily
recommend reading O'Reilly's Practical Unix Security;
(e.g. it took my attention to the fact, that one should also look for
devices on the system; if someones breaks into the system, he can
leave a hidden device named as he wish (maybe ' '? ; or '.. ')
with major/minor numbers same as, say , /dev/kmem, or a hard disk,
as a perfect backdoor for later break-ins;
Also, do you remember to use some/all of noexec,nosuid,nodev
when importing nfs filesystems, when defaults are too permissive
in a given case?
)
> I also find a bunch of suid root programs on my system, but I know why the
> overwhelming majority of them need to be. Admittedly, there are few that
> I don't know as much about as I should. I wonder what
> that /usr/sbin/backdoor could be? :) :) :)
A suid program you have written to log intrusion attempts .... :-)
>
> Kyle Ferrio
>
BTW:
On my RHL 4.0, I have:
-rwsr-sr-x 1 root tty 51296 Aug 29 22:30 /sbin/dump
-rwsr-sr-x 1 root tty 55376 Aug 29 22:30 /sbin/restore
Anyone has any clue, what set-group-id to tty is needed for them?
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
