Questions tagged [sudo]
`sudo` is a command that allows a user to use commands with the privileges of another user, usually the root user.
76
questions
1
vote
1
answer
73
views
Security difference between changing permissions versus using sudo to execute
If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
- 11
0
votes
1
answer
38
views
Read files protected with System Integrity Protection with sudo
I had a debate with a friend about the security model in new OS X versions. OS X El Capitan and newer have the System Integrity Protection security feature which protects aspects of the OS even from ...
- 583
0
votes
0
answers
79
views
Using GPG from another user (GNU/Linux)
I want to use gpg from another user (user2), so that the primary user (user1) does not have access to the encrypted file, but only to the part the script will output.
Added a sudo rule for user1 to ...
- 635
0
votes
0
answers
27
views
Secure method of creating sudoer password through cloud-init
We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following.
users:
- name: myuser
groups: sudo
...
0
votes
1
answer
62
views
ec2 instance insecure to allow ssh to any ip address
I have a linux instance deployed on AWS EC2.
Sorry for my dumb question, but I'll ask anyways just to be safe.
Q1. While creating an instance, I set anyone 0.0.0.0:0 for the ssh. Though, on the next ...
- 105
2
votes
1
answer
125
views
Why is sudo's usage of timestamp files insecure?
Sudo and Opendoas on Linux use timestamp files to keep track of how long it's been since you've last entered your password. Doas on BSD uses a kernel feature instead.
Why is the latter considered more ...
- 23
0
votes
0
answers
72
views
Resricted Sudo Inside of Jailkit?
Is it possible to enable sudo for a chrooted user (jailkit)?
I have nextcoud installed inside of a jailkit chrooted user and I am attempting to get the nextcloud occ command to work correctly. The ...
- 101
0
votes
2
answers
144
views
Disable everything but a hidden command for root access
linux security and root access question....
I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
0
votes
0
answers
216
views
How is doas with persist less secure than sudo?
The cross-platform port of doas, opendoas, has a persist feature that basically caches the user's password so they don't have to enter it repeatedly. It seems like many people consider this insecure.
...
- 209
0
votes
2
answers
181
views
How `sudo` command checks password?
To check the sudo password, we need root permission to even read the /etc/shadow file. But how sudo checks password?
- 13
2
votes
1
answer
107
views
How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?
I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
- 176
2
votes
1
answer
127
views
Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?
I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
- 41
2
votes
2
answers
216
views
How are docker containers affected by CVE-2021-3156?
Do docker (web service/server)s run unattended updates? Otherwise, how to do this? I am worried about the recent sudo -s CVE. How are docker containers affected? If I set up an auditing system with ...
- 51
4
votes
3
answers
2k
views
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
We cannot remove RPMs or similar.
We can only change a configuration.
Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
- 1,457
1
vote
0
answers
87
views
Can a sudo account access my browser sessions (e.g. Stack Exchange) remotely? [duplicate]
Suppose I am logged in to Stack Exchange on Firefox on my work computer. This session is clearly stored as a cookie (or something else), because it persists when I reboot the computer. I have sudo ...
- 141
1
vote
1
answer
327
views
Java application run as root
I'm testing Linux server where Java web application is run as root, I typed:
>ps aux
in the result I see:
root 18265 (...) Sl+ 19:52 0:37 java -Xmx2g -jar test_app.jar
what is the best ...
- 1,097
2
votes
2
answers
192
views
On a single user laptop does it make sense to have a separte password for root and the user?
I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is:
The change of ...
1
vote
0
answers
46
views
Why does sudo remove environment variables by default? [duplicate]
The sudo command has the -E option that allows users to pass through all environment variables, although it's still subject to the security policy configuration. So, is the use of -E inherently unsafe?...
- 131
0
votes
1
answer
188
views
security difference between sudo make install versus sudo su make install
Is there a security difference between doing
sudo make install
versus two step
sudo su
and then typing
make install
The reason I'm asking is because a security requirement to install some software ...
- 149
2
votes
1
answer
252
views
Homebrew and NOPASSWD sudo
I like to be able to run some commands installed via Homebrew without typing my sudo password. The problem is that Homebrew installs everything with user permissions, so if I add the executables to ...
- 121
0
votes
0
answers
121
views
Reverse sudo - sudo ro untrusted user
I want to split my terminal sessions to different users, to compartmentalize them.
If I sudo -i -u user1 in one terminal window,
can user1 attack my main session?
Everyone talks about sudo to escalate ...
1
vote
1
answer
274
views
Properly granting restrictive administrative privileges to developers on a production server [closed]
I am a business owner with a strong technical background, say a programmer, though not an advanced system administrator. I've bought a VPS server where I want to host several applications and webpages....
- 11
29
votes
5
answers
4k
views
What are the potential vulnerabilities of allowing non-root users to run apt-get?
There are two ways I can think of doing this:
On a system with sudo, by modifying /etc/sudoers.
On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
- 401
109
votes
11
answers
46k
views
Is `sudo` almost useless?
Once an attacker has a shell as your sudoer user (or just compromised a local process enough), he/she can use one of the many privilege escalation tool to even automatically put themselves for example ...
- 1,177
0
votes
2
answers
1k
views
Exectuting sudo command in one line within a non-tty shell
I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed).
The ...
- 1
0
votes
3
answers
294
views
Does sudo ever de-escalate privilege while the program/command/service is running?
For Example
Is it safer to do:
$ sudo [cmd] [args] [enter user password]
or
$ su - [enter root password]
# [cmd] [args]
I always assumed they are the exact same thing, because sudo utilizes ...
- 335
0
votes
1
answer
140
views
Rate my idea: NodeJS as root behind Apache as a proxy with password
I'm the admin of a small Linux server owned by a relative of mine. He's fairly tech savvy, but more at a level of a power user than an expert. I want to make a handy visual tool for him that would ...
- 996
1
vote
1
answer
139
views
Using a pen drive + secure certificate instead of sudo passwords
Is this recommended and/or possible? I just don't like the idea of anyone beside me being able to see when I type my password.
- 111
6
votes
1
answer
213
views
Is explicitly disabling a default in the sudoers file the same as not listing it at all?
I'm reviewing the /etc/sudoers file on a machine in response to CVE-2019-18634, a buffer-overflow vulnerability present in sudo. The bulletin on the sudo.ws website recommends the following mitigation:...
- 156
1
vote
1
answer
279
views
Why not use sudo instead of setuid/setgid?
If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it?
The big question: what prevents using sudo instead of the setuid/setgid binaries?
"ping" would be ...
12
votes
5
answers
774
views
How can one tell if a binary is safe to give sudo permissions for to an untrusted user?
sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
- 1
1
vote
2
answers
357
views
sudo whitelist just program perl
In visudo Ubuntu I whitelist this program
myuser ALL=(root) NOPASSWD:/myuser/program.pl
when I run
sudo /myuser/program.pl
I get prompt to set password. The solution is to add to visudo /usr/bin/...
- 21
2
votes
2
answers
1k
views
Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]
I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD.
(root) NOPASSWD: /usr/bin/vi /...
- 93
50
votes
6
answers
9k
views
Is `curl {something} | sudo bash -` a reasonably safe installation method?
The most straightforward way to install NodeJS on Ubuntu or Debian seems to be Nodesource, whose installation instructions say to run:
curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -
...
- 769
1
vote
0
answers
477
views
Preventing Linux brute force concurrent su/sudo attempts
Its well known that popular Linux distros use the PAM default to slightly delay incorrect login attempts, thus mitigating brute-force attacks against a user account (for example, running su repeatedly ...
- 171
2
votes
1
answer
1k
views
sudo restrictions circumvention with pkexec: root shell
I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good.
But that turns out to be a big ...
- 23
5
votes
1
answer
202
views
How can a bad process obtain root by waiting for a user to run a command as sudo?
A comment on this answer states:
The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
- 153
1
vote
1
answer
272
views
Using SUID program to avoid having entries in sudoers
Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
- 33
5
votes
1
answer
356
views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
- 188
1
vote
1
answer
87
views
Does it make sense to check command integrity after running it as root?
The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied ...
- 2,247
5
votes
5
answers
371
views
Unix Privilege Escalation: "sudo must be owned by uid 0 and have the setuid bit set"
It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error:
"sudo must be owned ...
- 51
0
votes
2
answers
2k
views
Sending shutdown command via ssh using sudo non-interactively
With iOS 12 and the new Siri Shortcuts app, I've been thinking of ways I could leverage the SSH command capability in the app. For those of you who don't know, the app allows you to send a bash file ...
- 165
3
votes
2
answers
534
views
Which Linux commands can execute user-supplied code? [closed]
As explained here (https://www.helpnetsecurity.com/2014/06/27/exploiting-wildcards-on-linux/), the tar command can be used to execute arbitrary code.
Is there a list of Linux commands, preferably ...
- 159
1
vote
1
answer
1k
views
What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]
Scenario:
Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything
For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
- 15.3k
7
votes
2
answers
2k
views
Do sudo and .profile/.bashrc enable trivial privilege escalation?
First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
- 215
-1
votes
2
answers
193
views
Is it dangerous to turn on internet connection under su -c?
If someone would turn on internet connection using command su -c "/sbin/ifup ppp1" would it put system at risk (how bad) ?
- 245
4
votes
1
answer
300
views
How to properly protect /home with separate user accounts on Linux
A great quote from this InfoSec stackExchange thread.
The way to prevent malicious code from damaging files in your home
directory is to not run it using your account. Create a separate_user
...
- 141
0
votes
2
answers
101
views
Prevent program from switching to user without password
I created a user with useradd without specifying a password. When I try to
sudo -u theuser echo hi
I am being prompted for my admin password (unless specified otherwise in the sudoers file, of ...
- 1,022
101
votes
13
answers
14k
views
Why is root security enforced but $HOME typically unprotected?
Coming from the comments in this question Why is it bad to log in as root?:
The sudo mechanics is in use so non-administrative tools "cannot harm your system." I agree that it would be pretty bad if ...
- 1,022
9
votes
2
answers
10k
views
What does this sudo -l output mean and can this be priv. escalated?
I am trying to do priviledge escalation of a linux box.
My sudo -l output shows the following :
www-data@box:/scripts$ sudo -l
sudo -l
Matching Defaults entries for www-data on box:
env_reset, ...
- 291