[5633] in RedHat Linux List
Re: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Michael Lupp)
Fri Nov 22 17:31:24 1996
Date: Fri, 22 Nov 1996 11:59:15 +0100
From: Michael Lupp <mike@nemesis.saar.de>
To: redhat-list@redhat.com
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
Erik Troan (ewt@redhat.com) wrote:
> A faster way of finding suid binaries on a Red Hat system is:
> rpm -qalv | grep 'root' | grep '^...s'
> This runs in about 1.5 seconds on our build machine (166 MHz Pentinue [which
> was fast when we bought it!]). If you want to see all of the suid root binaries
This is very fast, but it doesn't find all suid binaries. Here is the example
on my system:
nemesis:~# rpm -qalv | grep 'root' | grep '^...s' | awk '{print $8}' >rpm.list
nemesis:~# find / -perm -4000 | sort >find.list
nemesis:~# diff find.list rpm.list
15d14
< /usr/bin/cu
31,34d29
< /usr/bin/uucp
< /usr/bin/uuname
< /usr/bin/uustat
< /usr/bin/uux
38,39c33
< /usr/sbin/uucico
< /usr/sbin/uuxqt
---
> /usr/sbin/traceroute
If you make a 'rpm -qlv uucp traceroute' you will see that these file are
installed with suid-bit.
These packages are from colgate (uucp-1.06.1-6,traceroute-1.0.4.4bsd-2).
BWT: Why doesn't colgate deinstall NetKit-A-0.08-7 if upgrading from picasso?
Best,
/\/\ichael
--
E-Mail : mike@nemesis.saar.de, milu@sbustd.rz.uni-sb.de (PGP s. Homepage)
Paper-Mail: Michael Lupp, Oberer Hornbachstaden 26, 66482 Zweibruecken
Sound-Mail: 06332-13007 -- Homepage: http://pandemonium.abyss.saar.de/~mike
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
