1

In visudo Ubuntu I whitelist this program

myuser ALL=(root) NOPASSWD:/myuser/program.pl

when I run

sudo /myuser/program.pl

I get prompt to set password. The solution is to add to visudo /usr/bin/perl

myuser ALL=(root) NOPASSWD:/myuser/program.pl,/usr/bin/perl

Now I can run without asking the password.

Here is the problem; when I run my web service system with the user as myuser the web service can run any commands as /usr/bin/perl for example

/usr/bin/sudo  /usr/bin/perl -e 'system ("cat /etc/shadow");'

Is my assertion correct? What is the solution to this problem?

2
  • Yes, your assertion is correct. As for the solution...good question
    – user163495
    Oct 22, 2019 at 12:27
  • 1
    You'd better never let anyone run an interpreter as root without password...
    – ThoriumBR
    Oct 22, 2019 at 14:24

2 Answers 2

1

To solve this issue you need to modify this line: myuser ALL=(root) NOPASSWD:/myuser/program.pl,/usr/bin/perl Into this one: myuser ALL=(root) NOPASSWD:/usr/bin/perl /myuser/program.pl

3
0

First of all: do not run the webserver under a user-ID that you use interactively. That is a very bad practice. Especially, if your interactive sessions use sudo-s.

Normally, sudo uses per-tty authentication, so your assessment is correct if your webserver is launched from the same tty as from where you are sudoing, or if your sudoers contains Defaults !tty_tickets.

If you really need to run the webserver under your own name, and from the same tty, you will need to set the time-out for sudo to 0. From man sudoers:

sudoers uses per-user time stamp files for credential caching. Once a user has been authenticated, a record is written containing the uid that was used to authenticate, the terminal session ID, and a time stamp (using a monotonic clock if one is available). The user may then use sudo without a password for a short period of time (5 minutes unless overridden by the timestamp_timeout option). By default, sudoers uses a separate record for each tty, which means that a user's login sessions are authenticated separately.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .