Re: sudo security Was: Reporting missing package during install
On Wed, Dec 11, 2013 at 8:28 PM, Chris Bannister
<cbannister@slingshot.co.nz> wrote:
> On Tue, Dec 10, 2013 at 11:50:00PM +0100, Gian Uberto Lauri wrote:
>>
>> What makes root special is not the name but the numerical user id and group id, bot set to zero. See /etc/passwd.
>
> Don't you have to be logged in to do that?
Sort of.
Holes in browsers can provide the effective login, however.
> The issue was that there would be only one exploitable account, if root
> was disabled by installing sudo.
And not only that, the attacker has to look in both /etc/passwd and
/etc/group. That's two files to open if the javascript or other
plugin-type vulnerability doesn't provide a full shell.
Of course, one could argue that the name of the sudo-enabled admin
group should not be sudo, ...
... and it might be useful to provide decoy fake users that are
members of de-natured wheel, admin, sudo, etc. groups. (Use a little
careful randomness in setting the password field in shadow to make the
passwords for said decoys unguessable, just to raise the wall another
foot or two.)
Pursuing this thought would suggest that the install process "invent"
a random admin group name, but there would remain a few clues behind.
--
Joel Rees
Be careful where you see conspiracy.
Look first in your own heart.
Reply to: