Questions tagged [sudo]
`sudo` is a command that allows a user to use commands with the privileges of another user, usually the root user.
84 questions
0
votes
0
answers
39
views
How to exploit Python script and sudo subprocess shared file handle?
I am wondering what attacks would be theoretically possible against a Python script that executes a subprocess involving sudo. I know that asking for the sudo password using input() or getpass(), then ...
3
votes
1
answer
201
views
Is it wise to use sudo in .bash_aliases?
My ~/.bash_aliases contains aliases such as the following examples:
alias duh="sudo du -sh ./* | sort -hr | head -n 10"
alias pcm="sudo pcm -nc -nsys"
Question is, how smart that ...
- 259
7
votes
3
answers
2k
views
Security implications of increasing sudo timeout in terminal
I often need to run commands with sudo during development and since my password is lengthy I don't like to type it every time sudo times out which by default is 5 minutes.
To deal with that I've run ...
- 259
1
vote
1
answer
127
views
Sudo user without ability to login
I have a main user with home folder encryption enabled. To avoid typing long phrase each time I want to have another user with sudo privilege and weak password.
In the terminal I would first switch ...
- 121
2
votes
2
answers
1k
views
Risks and recommendations of using passwordless sudo
Given that I'm the only human who should have access to a Linux server, what are the major security risks associated with updating sudo to not require a password for my local user?
Are there other ...
- 123
11
votes
2
answers
4k
views
The rationale behind allowing `sudo -u root` but disallowing `sudo -u <any other user>`
I'm working with a customer where I use a functional user ID, created specifically for the purpose, to install and configure some software on multiple servers. The customer's security policies, ...
- 181
0
votes
2
answers
308
views
Is Windows UAC's clicking OK authentication as secure as macOS/Linux's password authentication?
Windows only show [Yes] or [No] for the same thing as Linux's sudo. macOS/Linux both require you to type the password. Is the password-less Windows implementation almost as secure as password-...
- 227
0
votes
0
answers
102
views
sudo with a USERID
This question relates to a comment on a question I posted at https://askubuntu.com/questions/1426688/sudo-with-a-userid-reverting-old-behaviour?noredirect=1#comment2484447_1426688
Specifically, in ...
- 691
1
vote
2
answers
220
views
How to securely use `pass`, `sudo`, and `npm` on the same machine
TL;DR: running npm i ... not long after pass my-password allows a malicious package to steal my entire password store.
I use pass as a password manager, on Linux. And like probably all Linux users, I ...
- 113
1
vote
1
answer
459
views
Security difference between changing permissions versus using sudo to execute
If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
- 13
1
vote
1
answer
159
views
Read files protected with System Integrity Protection with sudo
I had a debate with a friend about the security model in new OS X versions. OS X El Capitan and newer have the System Integrity Protection security feature which protects aspects of the OS even from ...
- 633
1
vote
0
answers
986
views
Using GPG from another user (GNU/Linux)
I want to use gpg from another user (user2), so that the primary user (user1) does not have access to the encrypted file, but only to the part the script will output.
Added a sudo rule for user1 to ...
- 725
0
votes
0
answers
231
views
Secure method of creating sudoer password through cloud-init
We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following.
users:
- name: myuser
groups: sudo
...
0
votes
1
answer
396
views
ec2 instance insecure to allow ssh to any ip address
I have a linux instance deployed on AWS EC2.
Sorry for my dumb question, but I'll ask anyways just to be safe.
Q1. While creating an instance, I set anyone 0.0.0.0:0 for the ssh. Though, on the next ...
- 105
2
votes
1
answer
254
views
Why is sudo's usage of timestamp files insecure?
Sudo and Opendoas on Linux use timestamp files to keep track of how long it's been since you've last entered your password. Doas on BSD uses a kernel feature instead.
Why is the latter considered more ...
- 123
0
votes
2
answers
258
views
Disable everything but a hidden command for root access
linux security and root access question....
I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
0
votes
0
answers
859
views
How is doas with persist less secure than sudo?
The cross-platform port of doas, opendoas, has a persist feature that basically caches the user's password so they don't have to enter it repeatedly. It seems like many people consider this insecure.
...
- 249
0
votes
2
answers
304
views
How `sudo` command checks password?
To check the sudo password, we need root permission to even read the /etc/shadow file. But how sudo checks password?
- 13
1
vote
1
answer
254
views
How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?
I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
- 166
2
votes
1
answer
355
views
Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?
I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
- 41
2
votes
2
answers
384
views
How are docker containers affected by CVE-2021-3156?
Do docker (web service/server)s run unattended updates? Otherwise, how to do this? I am worried about the recent sudo -s CVE. How are docker containers affected? If I set up an auditing system with ...
- 51
4
votes
3
answers
2k
views
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
We cannot remove RPMs or similar.
We can only change a configuration.
Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
- 1,479
1
vote
0
answers
129
views
Can a sudo account access my browser sessions (e.g. Stack Exchange) remotely? [duplicate]
Suppose I am logged in to Stack Exchange on Firefox on my work computer. This session is clearly stored as a cookie (or something else), because it persists when I reboot the computer. I have sudo ...
- 151
1
vote
1
answer
1k
views
Java application run as root
I'm testing Linux server where Java web application is run as root, I typed:
>ps aux
in the result I see:
root 18265 (...) Sl+ 19:52 0:37 java -Xmx2g -jar test_app.jar
what is the best ...
- 1,363
4
votes
3
answers
2k
views
On a single user laptop does it make sense to have a separte password for root and the user?
I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is:
The change of ...
1
vote
0
answers
52
views
Why does sudo remove environment variables by default? [duplicate]
The sudo command has the -E option that allows users to pass through all environment variables, although it's still subject to the security policy configuration. So, is the use of -E inherently unsafe?...
- 131
0
votes
1
answer
302
views
security difference between sudo make install versus sudo su make install
Is there a security difference between doing
sudo make install
versus two step
sudo su
and then typing
make install
The reason I'm asking is because a security requirement to install some software ...
- 201
2
votes
1
answer
482
views
Homebrew and NOPASSWD sudo
I like to be able to run some commands installed via Homebrew without typing my sudo password. The problem is that Homebrew installs everything with user permissions, so if I add the executables to ...
- 121
0
votes
0
answers
178
views
Reverse sudo - sudo ro untrusted user
I want to split my terminal sessions to different users, to compartmentalize them.
If I sudo -i -u user1 in one terminal window,
can user1 attack my main session?
Everyone talks about sudo to escalate ...
1
vote
1
answer
404
views
Properly granting restrictive administrative privileges to developers on a production server [closed]
I am a business owner with a strong technical background, say a programmer, though not an advanced system administrator. I've bought a VPS server where I want to host several applications and webpages....
- 11
31
votes
5
answers
5k
views
What are the potential vulnerabilities of allowing non-root users to run apt-get?
There are two ways I can think of doing this:
On a system with sudo, by modifying /etc/sudoers.
On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
- 421
114
votes
11
answers
49k
views
Is `sudo` almost useless?
Once an attacker has a shell as your sudoer user (or just compromised a local process enough), he/she can use one of the many privilege escalation tool to even automatically put themselves for example ...
- 1,227
0
votes
2
answers
2k
views
Exectuting sudo command in one line within a non-tty shell
I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed).
The ...
- 1
0
votes
3
answers
541
views
Does sudo ever de-escalate privilege while the program/command/service is running?
For Example
Is it safer to do:
$ sudo [cmd] [args] [enter user password]
or
$ su - [enter root password]
# [cmd] [args]
I always assumed they are the exact same thing, because sudo utilizes ...
- 375
1
vote
1
answer
183
views
Rate my idea: NodeJS as root behind Apache as a proxy with password
I'm the admin of a small Linux server owned by a relative of mine. He's fairly tech savvy, but more at a level of a power user than an expert. I want to make a handy visual tool for him that would ...
- 1,050
1
vote
1
answer
188
views
Using a pen drive + secure certificate instead of sudo passwords
Is this recommended and/or possible? I just don't like the idea of anyone beside me being able to see when I type my password.
- 111
5
votes
1
answer
266
views
Is explicitly disabling a default in the sudoers file the same as not listing it at all?
I'm reviewing the /etc/sudoers file on a machine in response to CVE-2019-18634, a buffer-overflow vulnerability present in sudo. The bulletin on the sudo.ws website recommends the following mitigation:...
- 186
1
vote
1
answer
687
views
Why not use sudo instead of setuid/setgid?
If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it?
The big question: what prevents using sudo instead of the setuid/setgid binaries?
"ping" would be ...
12
votes
5
answers
1k
views
How can one tell if a binary is safe to give sudo permissions for to an untrusted user?
sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
user163495
1
vote
2
answers
626
views
sudo whitelist just program perl
In visudo Ubuntu I whitelist this program
myuser ALL=(root) NOPASSWD:/myuser/program.pl
when I run
sudo /myuser/program.pl
I get prompt to set password. The solution is to add to visudo /usr/bin/...
- 51
2
votes
2
answers
2k
views
Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]
I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD.
(root) NOPASSWD: /usr/bin/vi /...
- 93
57
votes
9
answers
13k
views
Is `curl {something} | sudo bash -` a reasonably safe installation method?
The most straightforward way to install NodeJS on Ubuntu or Debian seems to be Nodesource, whose installation instructions say to run:
curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -
...
- 859
1
vote
0
answers
950
views
Preventing Linux brute force concurrent su/sudo attempts
Its well known that popular Linux distros use the PAM default to slightly delay incorrect login attempts, thus mitigating brute-force attacks against a user account (for example, running su repeatedly ...
- 301
1
vote
1
answer
2k
views
sudo restrictions circumvention with pkexec: root shell
I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good.
But that turns out to be a big ...
- 13
4
votes
1
answer
487
views
How can a bad process obtain root by waiting for a user to run a command as sudo?
A comment on this answer states:
The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
- 143
1
vote
1
answer
467
views
Using SUID program to avoid having entries in sudoers
Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
- 33
5
votes
1
answer
715
views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
- 187
1
vote
1
answer
120
views
Does it make sense to check command integrity after running it as root?
The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied ...
- 2,267
5
votes
5
answers
516
views
Unix Privilege Escalation: "sudo must be owned by uid 0 and have the setuid bit set"
It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error:
"sudo must be owned ...
- 51
1
vote
2
answers
3k
views
Sending shutdown command via ssh using sudo non-interactively
With iOS 12 and the new Siri Shortcuts app, I've been thinking of ways I could leverage the SSH command capability in the app. For those of you who don't know, the app allows you to send a bash file ...
- 175