[5421] in RedHat Linux List
RE: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Dwight Hubbard)
Thu Nov 21 10:58:45 1996
From: "Dwight Hubbard" <Dwight.Hubbard@MCI.Com>
To: "'redhat-list@redhat.com'" <redhat-list@redhat.com>
Date: Thu, 21 Nov 1996 09:50:30 -0600
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
Could you summarize why each one is set uid??
----------
From: Erik Troan[SMTP:ewt@redhat.com]
Sent: Thursday, November 21, 1996 4:32 AM
To: redhat-list@redhat.com
Subject: Re: RedHat4.0 security
On Wed, 20 Nov 1996, Kyle Ferrio wrote:
> What version of 'find' are you using? If you're using the gnu find that
> ships with Colgate, then you should be using (as root)
>
> find / -perm +4000 -uid 0
>
> The '+' in from of the mode is very significant. Unadorned modes must
> match exactly. The + (-) prefix modifiers require the mode of the target
> files to macth a sub (super) set of the specified mode. If an unadorned
> 4000 returns anything, I'd be (mildly) surprised. The -uid restriction to
> root is not essential but prunes out files owned by news, mail, etc.
> Flavor to taste.
A faster way of finding suid binaries on a Red Hat system is:
rpm -qalv | grep 'root' | grep '^...s'
This runs in about 1.5 seconds on our build machine (166 MHz Pentinue [which
was fast when we bought it!]). If you want to see all of the suid root binaries
Red Hat ships, cd to RedHat/RPMS on your CDROM and run:
rpm -qlvp * | grep 'root' | grep '^...s'
I actually do know why they are all set that way -- if you have questions about
any of them, feel free to ask.
Erik
-------------------------------------------------------------------------------
| I told you I'm not very bright -- Sugar in "Some Like It Hot" |
| |
| Erik Troan = http://sunsite.unc.edu/ewt/ = ewt@sunsite.unc.edu |
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
