Questions tagged [sudo]
`sudo` is a command that allows a user to use commands with the privileges of another user, usually the root user.
50
questions
-1
votes
2answers
86 views
Privilege Escalation - Sudoers File Rule bypass [closed]
some_admin_user ALL=/bin/find ALL, !/bin/bash
How to bypass the above /etc/sudoers rule, Please suggest.
6
votes
1answer
99 views
Is explicitly disabling a default in the sudoers file the same as not listing it at all?
I'm reviewing the /etc/sudoers file on a machine in response to CVE-2019-18634, a buffer-overflow vulnerability present in sudo. The bulletin on the sudo.ws website recommends the following mitigation:...
1
vote
1answer
93 views
Why not use sudo instead of setuid/setgid?
If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it?
The big question: what prevents using sudo instead of the setuid/setgid binaries?
"ping" would be ...
12
votes
5answers
478 views
How can one tell if a binary is safe to give sudo permissions for to an untrusted user?
sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
1
vote
0answers
96 views
Sudo parameterised all commands, is this secure? [closed]
About this question
sudo white list just program perl
I think I found possible solution using just sudo
have a program Perl and make executable chmod + x
in sudo whitelist that program and ...
1
vote
2answers
167 views
sudo whitelist just program perl
In visudo Ubuntu I whitelist this program
myuser ALL=(root) NOPASSWD:/myuser/program.pl
when I run
sudo /myuser/program.pl
I get prompt to set password. The solution is to add to visudo /usr/bin/...
2
votes
2answers
289 views
Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]
I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD.
(root) NOPASSWD: /usr/bin/vi /...
47
votes
6answers
6k views
Is `curl {something} | sudo bash -` a reasonably safe installation method?
The most straightforward way to install NodeJS on Ubuntu or Debian seems to be Nodesource, whose installation instructions say to run:
curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -
...
1
vote
0answers
127 views
Preventing Linux brute force concurrent su/sudo attempts
Its well known that popular Linux distros use the PAM default to slightly delay incorrect login attempts, thus mitigating brute-force attacks against a user account (for example, running su repeatedly ...
2
votes
1answer
378 views
sudo restrictions circumvention with pkexec: root shell
I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good.
But that turns out to be a big ...
5
votes
1answer
114 views
How can a bad process obtain root by waiting for a user to run a command as sudo?
A comment on this answer states:
The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
1
vote
1answer
128 views
Using SUID program to avoid having entries in sudoers
Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
4
votes
1answer
107 views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
1
vote
1answer
41 views
Does it make sense to check command integrity after running it as root?
The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied ...
5
votes
5answers
247 views
Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”
It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error:
"sudo must be owned ...
0
votes
2answers
743 views
Sending shutdown command via ssh using sudo non-interactively
With iOS 12 and the new Siri Shortcuts app, I've been thinking of ways I could leverage the SSH command capability in the app. For those of you who don't know, the app allows you to send a bash file ...
3
votes
2answers
431 views
Which Linux commands can execute user-supplied code? [closed]
As explained here (https://www.helpnetsecurity.com/2014/06/27/exploiting-wildcards-on-linux/), the tar command can be used to execute arbitrary code.
Is there a list of Linux commands, preferably ...
1
vote
1answer
140 views
What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]
Scenario:
Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything
For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
6
votes
2answers
759 views
Do sudo and .profile/.bashrc enable trivial privilege escalation?
First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
-1
votes
2answers
127 views
Is it dangerous to turn on internet connection under su -c?
If someone would turn on internet connection using command su -c "/sbin/ifup ppp1" would it put system at risk (how bad) ?
4
votes
1answer
160 views
How to properly protect /home with separate user accounts on Linux
A great quote from this InfoSec stackExchange thread.
The way to prevent malicious code from damaging files in your home
directory is to not run it using your account. Create a separate_user
...
0
votes
2answers
63 views
Prevent program from switching to user without password
I created a user with useradd without specifying a password. When I try to
sudo -u theuser echo hi
I am being prompted for my admin password (unless specified otherwise in the sudoers file, of ...
99
votes
13answers
14k views
Why is root security enforced but $HOME typically unprotected?
Coming from the comments in this question Why is it bad to log in as root?:
The sudo mechanics is in use so non-administrative tools "cannot harm your system." I agree that it would be pretty bad if ...
7
votes
2answers
4k views
What does this sudo -l output mean and can this be priv. escalated?
I am trying to do priviledge escalation of a linux box.
My sudo -l output shows the following :
www-data@box:/scripts$ sudo -l
sudo -l
Matching Defaults entries for www-data on box:
env_reset, ...
12
votes
2answers
3k views
Is it secure to mount Veracrypt without sudo password in this way
Does this way have any security issues other than what's mentioned in that post?
For reference:
Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
5
votes
1answer
1k views
Is an asterisk in sudo command specifications safe?
This suggests that to restrict a user to a specific command with sudo a line like
%web ALL=(ALL) /usr/bin/service apache2 *
can be used. This particular line would restrict the user to running the ...
1
vote
1answer
165 views
What is a safe way to exit a user's shell?
If I change to a potentially compromised user in Unix, for example by using su or sudo -i, then exit with exit, the compromised user could alias exit to something which drops me into a fake shell ...
2
votes
1answer
123 views
sudo -u <user> <cmd> vs sudoedit
I have read on the internet that you have to use sudoedit instead of sudo vim. I understand why this is and should be used so you can't just edit root-user files.
However I would like to manage a ...
0
votes
1answer
266 views
/etc/sudoers file with permissions set to 640 instead of 0440: what does it mean?
So I'm still new to GNU/Linux: recently I installed Debian 9.1 with KDE. Now after executing:
stat --format '%a' /etc/sudoers
I found out that my sudoers file has the 640 permissions instead 0440 ...
1
vote
2answers
309 views
Why is there no option for separate sudo password?
This has bugged me for some years now. I had a small webserver and I used ssh to log in remotely. I noticed that from the very first day there were brute force attacks to my ssh.
This made me think ...
1
vote
2answers
180 views
Does a basic sudo-less Linux user or a sudo user but with a password for sudo offer enough security against webpages exploits?
Question: I would like to know if it is good protection to browse the net using a non sudo, basic user account, on my Linux distro against webpage exploits such as scripts and other cross-platform ...
2
votes
1answer
263 views
Is it a good practice to make sudo ask for root password in a single-user system?
I have a server where I am the only normal user and I need to have password-based authentication enabled for SSH. I have configured iptables with recent module which throttles SSH connections and root ...
1
vote
4answers
90 views
Is there a criteria for allowing or disallowing the execution of bash scripts as root with sudo?
What criteria could I take in order to to allow or disallow the execution of bash scripts with sudo as root?
I know I should analyze the script but I have not enough time and I trust my developers.
...
21
votes
3answers
9k views
Best practices for hardening sudo?
Every hardening guide I read recommends forbidding to login to root account and instead using sudo. I can understand this if you set a strict sudoers file which only enables the necessary commands for ...
1
vote
1answer
1k views
Nmap not working as a root
Hi I asked this questions on other forums, and searched on google, but nothing was useful to me. My problem works as a non-privileged used, but whenever I run it as a root, I get:
Starting Nmap 7.01 (...
4
votes
1answer
6k views
Security implications of using SETCAP CAP_NET_RAW
In order to get around the 'problem' of applications requiring root privileges to run, I'm using:
sudo setcap CAP_NET_ADMIN+ep "$(readlink -f /usr/sbin/app)"
sudo setcap CAP_NET_RAW+ep "$(readlink -f ...
23
votes
6answers
6k views
Why is it considered safe to install something as a non-root user in Linux environments?
We always hear it is safe to run unknown programs as non-root users in Linux because non-root users are sandboxed from the system level and can't change anything out of their permission scope. If ...
28
votes
5answers
8k views
Why should one use sudo? [duplicate]
Most modern Linux articles advice using sudo rather than logging into root. This advice is so ingrained, some distros don't automatically allow root login. Indeed they come pre-configured with sudo ...
25
votes
3answers
7k views
Is it safe to allow www-data to execute privileged commands?
I have noticed several questions on Stack Overflow, like this one, about executing commands with root privileges using PHP. The answer proposed to add the line
www-data ALL=(ALL) NOPASSWD: ALL
to ...
11
votes
1answer
1k views
Is disabling sudo password prompt a security risk?
I was reading the this question over on Ask Ubuntu and they suggest adding the following line to etc/sudoers so that you're not prompted to enter your password each time you run sudo
%admin ALL=(ALL)...
22
votes
4answers
3k views
Is it safer to ssh as a privileged user than to ssh and sudo?
I came across this old paper, discussing the possibility of password length information being disclosed when usin SSH: Timing Analysis of Keystrokes and Timing Attacks on SSH. The paper has been ...
3
votes
1answer
270 views
Sudo debug function vulneability
I am quite stuck with an assignment question, exploiting vulnerability (vfprintf) in sudo_debug function with ASLR (CVE: 2012-0809). I can only use string format exploits.
ONLY ASLR IS ENABLED < NO ...
7
votes
4answers
1k views
Does the new Fedora package manager allow unauthorized installations?
I just upgraded to Fedora 22. The biggest change from the previous version is that the yum package manager is now replaced with dnf. One change I've noticed is that if you try to execute a command ...
5
votes
2answers
979 views
What are the security risks in leaving 'sudo' inside my production code?
I have a script that can only run successfully with root permissions
But in development it's really hard to run with root permissions (in my development environment) so I add 'sudo' when ever it's ...
2
votes
1answer
953 views
How to reduce the risk of sudo vim -Z (sudo rvim)
(I asked the same question on https://superuser.com/ One person recommended me to use this website instead of super user. I hope this question is quite apporopriate here and I can get more detailed ...
1
vote
1answer
444 views
is copy pasting sudo password from opened document a possible vulnerability?
During setup of my ubuntu systems after installing the system offline i open a textfile and change my sudo password by typing it into a textfile and paste it after so that i don't lock myself out by ...
5
votes
3answers
5k views
What are the risks of making ether-wake available to all users?
The Linux ether-wake utility, which creates a magic packet to wake on lan another machine, requires root access:
$ether-wake 12:34:56:78:9A:BC
ether-wake: This program must be run as root.
To give ...
36
votes
4answers
53k views
SSH key auth, but still need password for sudo?
SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
1
vote
2answers
1k views
Shellshock plus sudo/su environment whitelist bypass - big problem?
The question is: How big a problem is this? Looks pretty big to me.
With the shellshock bug it is possible to bypass the whitelist of known-harmless environment variables in sudo, as well as other ...
4
votes
2answers
2k views
Do `sudo` and `su` belong to capability-based security?
In Linux, do sudo and su belong to Capability-based security ?
For example, when editing a system file, we usually need sudo or su to temporarily switch to user root. Does this example belong to ...
