Re: Running MRTG as a non-root user - thoughts?
On Sun, 26 Nov 2000, Herbert Xu wrote:
> Michael-John Turner <mj@turner.org.za> wrote:
> >
> > Anyone got any thoughts on this? I don't want to go through the whole
> > process of switching to a non-root user if it isn't really necessary.
>
> You've got this backwards. This process should only be avoided if root
> privilege is really necessary for MRTG. Personally I would put MRTG in
> the high risk category since it accepts input from remote hosts.
I see. Not that we might know of any, but it is conceivable for a remote
SNMP server to be compromised, and to exploit an unknown hole in mrtg to
breach local security. On the same token, the remote SNMP server could
also conceivably exploit the local SNMP server, which mrtg depends upon.
; I don't know specifically WHY SNMP would need root privs, but I'm pretty
; sure it does to be able to gather some of the system statistics.
; I also doubt an exploited SNMP server could do much besides feed
; falsified statistics, but that would be enough for a DoS.
Reply to: