Questions tagged [sudo]

`sudo` is a command that allows a user to use commands with the privileges of another user, usually the root user.

Filter by
Sorted by
Tagged with
1 vote
1 answer
73 views

Security difference between changing permissions versus using sudo to execute

If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
user avatar
0 votes
1 answer
38 views

Read files protected with System Integrity Protection with sudo

I had a debate with a friend about the security model in new OS X versions. OS X El Capitan and newer have the System Integrity Protection security feature which protects aspects of the OS even from ...
user avatar
  • 583
0 votes
0 answers
79 views

Using GPG from another user (GNU/Linux)

I want to use gpg from another user (user2), so that the primary user (user1) does not have access to the encrypted file, but only to the part the script will output. Added a sudo rule for user1 to ...
user avatar
  • 635
0 votes
0 answers
27 views

Secure method of creating sudoer password through cloud-init

We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following. users: - name: myuser groups: sudo ...
user avatar
0 votes
1 answer
62 views

ec2 instance insecure to allow ssh to any ip address

I have a linux instance deployed on AWS EC2. Sorry for my dumb question, but I'll ask anyways just to be safe. Q1. While creating an instance, I set anyone 0.0.0.0:0 for the ssh. Though, on the next ...
user avatar
2 votes
1 answer
125 views

Why is sudo's usage of timestamp files insecure?

Sudo and Opendoas on Linux use timestamp files to keep track of how long it's been since you've last entered your password. Doas on BSD uses a kernel feature instead. Why is the latter considered more ...
user avatar
0 votes
0 answers
72 views

Resricted Sudo Inside of Jailkit?

Is it possible to enable sudo for a chrooted user (jailkit)? I have nextcoud installed inside of a jailkit chrooted user and I am attempting to get the nextcloud occ command to work correctly. The ...
user avatar
  • 101
0 votes
2 answers
144 views

Disable everything but a hidden command for root access

linux security and root access question.... I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
user avatar
0 votes
0 answers
216 views

How is doas with persist less secure than sudo?

The cross-platform port of doas, opendoas, has a persist feature that basically caches the user's password so they don't have to enter it repeatedly. It seems like many people consider this insecure. ...
user avatar
0 votes
2 answers
181 views

How `sudo` command checks password?

To check the sudo password, we need root permission to even read the /etc/shadow file. But how sudo checks password?
user avatar
  • 13
2 votes
1 answer
107 views

How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?

I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
user avatar
  • 176
2 votes
1 answer
127 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
user avatar
  • 41
2 votes
2 answers
216 views

How are docker containers affected by CVE-2021-3156?

Do docker (web service/server)s run unattended updates? Otherwise, how to do this? I am worried about the recent sudo -s CVE. How are docker containers affected? If I set up an auditing system with ...
user avatar
4 votes
3 answers
2k views

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156? We cannot remove RPMs or similar. We can only change a configuration. Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
user avatar
  • 1,457
1 vote
0 answers
87 views

Can a sudo account access my browser sessions (e.g. Stack Exchange) remotely? [duplicate]

Suppose I am logged in to Stack Exchange on Firefox on my work computer. This session is clearly stored as a cookie (or something else), because it persists when I reboot the computer. I have sudo ...
user avatar
  • 141
1 vote
1 answer
327 views

Java application run as root

I'm testing Linux server where Java web application is run as root, I typed: >ps aux in the result I see: root 18265 (...) Sl+ 19:52 0:37 java -Xmx2g -jar test_app.jar what is the best ...
user avatar
  • 1,097
2 votes
2 answers
192 views

On a single user laptop does it make sense to have a separte password for root and the user?

I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is: The change of ...
user avatar
1 vote
0 answers
46 views

Why does sudo remove environment variables by default? [duplicate]

The sudo command has the -E option that allows users to pass through all environment variables, although it's still subject to the security policy configuration. So, is the use of -E inherently unsafe?...
user avatar
  • 131
0 votes
1 answer
188 views

security difference between sudo make install versus sudo su make install

Is there a security difference between doing sudo make install versus two step sudo su and then typing make install The reason I'm asking is because a security requirement to install some software ...
user avatar
2 votes
1 answer
252 views

Homebrew and NOPASSWD sudo

I like to be able to run some commands installed via Homebrew without typing my sudo password. The problem is that Homebrew installs everything with user permissions, so if I add the executables to ...
user avatar
  • 121
0 votes
0 answers
121 views

Reverse sudo - sudo ro untrusted user

I want to split my terminal sessions to different users, to compartmentalize them. If I sudo -i -u user1 in one terminal window, can user1 attack my main session? Everyone talks about sudo to escalate ...
user avatar
1 vote
1 answer
274 views

Properly granting restrictive administrative privileges to developers on a production server [closed]

I am a business owner with a strong technical background, say a programmer, though not an advanced system administrator. I've bought a VPS server where I want to host several applications and webpages....
user avatar
  • 11
29 votes
5 answers
4k views

What are the potential vulnerabilities of allowing non-root users to run apt-get?

There are two ways I can think of doing this: On a system with sudo, by modifying /etc/sudoers. On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
user avatar
  • 401
109 votes
11 answers
46k views

Is `sudo` almost useless?

Once an attacker has a shell as your sudoer user (or just compromised a local process enough), he/she can use one of the many privilege escalation tool to even automatically put themselves for example ...
user avatar
  • 1,177
0 votes
2 answers
1k views

Exectuting sudo command in one line within a non-tty shell

I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed). The ...
user avatar
0 votes
3 answers
294 views

Does sudo ever de-escalate privilege while the program/command/service is running?

For Example Is it safer to do: $ sudo [cmd] [args] [enter user password] or $ su - [enter root password] # [cmd] [args] I always assumed they are the exact same thing, because sudo utilizes ...
user avatar
0 votes
1 answer
140 views

Rate my idea: NodeJS as root behind Apache as a proxy with password

I'm the admin of a small Linux server owned by a relative of mine. He's fairly tech savvy, but more at a level of a power user than an expert. I want to make a handy visual tool for him that would ...
user avatar
  • 996
1 vote
1 answer
139 views

Using a pen drive + secure certificate instead of sudo passwords

Is this recommended and/or possible? I just don't like the idea of anyone beside me being able to see when I type my password.
user avatar
6 votes
1 answer
213 views

Is explicitly disabling a default in the sudoers file the same as not listing it at all?

I'm reviewing the /etc/sudoers file on a machine in response to CVE-2019-18634, a buffer-overflow vulnerability present in sudo. The bulletin on the sudo.ws website recommends the following mitigation:...
user avatar
1 vote
1 answer
279 views

Why not use sudo instead of setuid/setgid?

If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it? The big question: what prevents using sudo instead of the setuid/setgid binaries? "ping" would be ...
user avatar
12 votes
5 answers
774 views

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
user avatar
1 vote
2 answers
357 views

sudo whitelist just program perl

In visudo Ubuntu I whitelist this program myuser ALL=(root) NOPASSWD:/myuser/program.pl when I run sudo /myuser/program.pl I get prompt to set password. The solution is to add to visudo /usr/bin/...
user avatar
2 votes
2 answers
1k views

Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]

I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD. (root) NOPASSWD: /usr/bin/vi /...
user avatar
50 votes
6 answers
9k views

Is `curl {something} | sudo bash -` a reasonably safe installation method?

The most straightforward way to install NodeJS on Ubuntu or Debian seems to be Nodesource, whose installation instructions say to run: curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash - ...
user avatar
  • 769
1 vote
0 answers
477 views

Preventing Linux brute force concurrent su/sudo attempts

Its well known that popular Linux distros use the PAM default to slightly delay incorrect login attempts, thus mitigating brute-force attacks against a user account (for example, running su repeatedly ...
user avatar
  • 171
2 votes
1 answer
1k views

sudo restrictions circumvention with pkexec: root shell

I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good. But that turns out to be a big ...
user avatar
5 votes
1 answer
202 views

How can a bad process obtain root by waiting for a user to run a command as sudo?

A comment on this answer states: The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
user avatar
  • 153
1 vote
1 answer
272 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
user avatar
5 votes
1 answer
356 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
user avatar
  • 188
1 vote
1 answer
87 views

Does it make sense to check command integrity after running it as root?

The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied ...
user avatar
  • 2,247
5 votes
5 answers
371 views

Unix Privilege Escalation: "sudo must be owned by uid 0 and have the setuid bit set"

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
user avatar
0 votes
2 answers
2k views

Sending shutdown command via ssh using sudo non-interactively

With iOS 12 and the new Siri Shortcuts app, I've been thinking of ways I could leverage the SSH command capability in the app. For those of you who don't know, the app allows you to send a bash file ...
user avatar
  • 165
3 votes
2 answers
534 views

Which Linux commands can execute user-supplied code? [closed]

As explained here (https://www.helpnetsecurity.com/2014/06/27/exploiting-wildcards-on-linux/), the tar command can be used to execute arbitrary code. Is there a list of Linux commands, preferably ...
user avatar
  • 159
1 vote
1 answer
1k views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
user avatar
  • 15.3k
7 votes
2 answers
2k views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
user avatar
  • 215
-1 votes
2 answers
193 views

Is it dangerous to turn on internet connection under su -c?

If someone would turn on internet connection using command su -c "/sbin/ifup ppp1" would it put system at risk (how bad) ?
user avatar
  • 245
4 votes
1 answer
300 views

How to properly protect /home with separate user accounts on Linux

A great quote from this InfoSec stackExchange thread. The way to prevent malicious code from damaging files in your home directory is to not run it using your account. Create a separate_user ...
user avatar
0 votes
2 answers
101 views

Prevent program from switching to user without password

I created a user with useradd without specifying a password. When I try to sudo -u theuser echo hi I am being prompted for my admin password (unless specified otherwise in the sudoers file, of ...
user avatar
  • 1,022
101 votes
13 answers
14k views

Why is root security enforced but $HOME typically unprotected?

Coming from the comments in this question Why is it bad to log in as root?: The sudo mechanics is in use so non-administrative tools "cannot harm your system." I agree that it would be pretty bad if ...
user avatar
  • 1,022
9 votes
2 answers
10k views

What does this sudo -l output mean and can this be priv. escalated?

I am trying to do priviledge escalation of a linux box. My sudo -l output shows the following : www-data@box:/scripts$ sudo -l sudo -l Matching Defaults entries for www-data on box: env_reset, ...
user avatar