[5416] in RedHat Linux List
Re: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Erik Troan)
Thu Nov 21 10:34:39 1996
Date: Thu, 21 Nov 1996 10:32:58 -0500 (EST)
From: Erik Troan <ewt@redhat.com>
To: redhat-list@redhat.com
In-Reply-To: <Pine.LNX.3.95.961120221405.457C-100000@babylon5.ea.org>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
On Wed, 20 Nov 1996, Kyle Ferrio wrote:
> What version of 'find' are you using? If you're using the gnu find that
> ships with Colgate, then you should be using (as root)
>
> find / -perm +4000 -uid 0
>
> The '+' in from of the mode is very significant. Unadorned modes must
> match exactly. The + (-) prefix modifiers require the mode of the target
> files to macth a sub (super) set of the specified mode. If an unadorned
> 4000 returns anything, I'd be (mildly) surprised. The -uid restriction to
> root is not essential but prunes out files owned by news, mail, etc.
> Flavor to taste.
A faster way of finding suid binaries on a Red Hat system is:
rpm -qalv | grep 'root' | grep '^...s'
This runs in about 1.5 seconds on our build machine (166 MHz Pentinue [which
was fast when we bought it!]). If you want to see all of the suid root binaries
Red Hat ships, cd to RedHat/RPMS on your CDROM and run:
rpm -qlvp * | grep 'root' | grep '^...s'
I actually do know why they are all set that way -- if you have questions about
any of them, feel free to ask.
Erik
-------------------------------------------------------------------------------
| I told you I'm not very bright -- Sugar in "Some Like It Hot" |
| |
| Erik Troan = http://sunsite.unc.edu/ewt/ = ewt@sunsite.unc.edu |
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
