1

I recently did a ca /etc/passwd

And it revealed many accounts and their respective directories. Is my shared server secure? Does this tell anything?

Can a good hacker access my directory from their shared hosting folder on the same server as me?

closed as unclear what you're asking by Steffen Ullrich, Xander, forest, Teun Vink, LvB Jan 6 at 12:09

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

4

/etc/passwd is always world-readable; without it you can't do things like map ownership on files (which only have user and group IDs) to the names of those users / groups. By design, multiple users on a single *nix (or Windows) box can tell who else has an account, and where its profile directory is (not that this is usually at all hard to guess), but not much else. In the classic use of a shared server (providing resources for a corporate or academic department, or similar), knowing other peoples' user names is not really a risk.

Virtualization is easy enough these days that it's kind of weird your hosting service is putting multiple tenants on the same logical machine. It probably means you could (at a minimum) do a partial denial-of-service attack against the other tenants by consuming excessive CPU, RAM, and I/O time (although careful sandboxing can mitigate this). It also might reveal some detail about who your other tenants are, which you otherwise presumably wouldn't know.

As for accessing your directory, the answer is most likely no if the host is keeping the machine up to date. Local privilege escalation bugs are found reasonably often, and usually patched immediately, but if the sysadmin is less that fully vigilant there may be an opportunity between publishing the vuln and it getting patched where it could be abused. With that said, do check the permissions on your home directory - it should be 0700 (full access to you, none to anybody else) - because some poorly-designed *nix systems (coughUbuntucoughOS Xcough) make your home directory world-readable-and-traversable by default. Some programs (OpenSSH, for example) specifically make their files available only to the user, but others (bash in things like .bash_history) are world-readable if the user's home directory is traversable.

0

If you really revealed other tenants' account names and it is a public shared hosting server then it's an issue regarding information disclosure. You can go deeper and try to register another account and make some tests of directory access rights, path traversal, LFI/RFI, etc. between your own accounts. And it's always better to make your provider aware of your research activity.

  • I'll let them know What are the tools I can perform those testss? Can you name a few ? – Born vs. Me Dec 25 '18 at 18:56
  • The basic GNU/Linux file manipulation utilities are pretty enough in most cases, so it's better to dig into the theory and nature of mentioned issues. – odo Dec 25 '18 at 20:17
  • gcc compile c to escalte priviledges? what if gcc is not installed? – Born vs. Me Dec 25 '18 at 21:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.