Re: crontab reports: ....

[Dave Baker <dsb3@earthlink.net>]

> > /etc/cron.daily/suidmanager:
> > /usr/sbin/sendmail PERMISSION MISMATCH: was root.root 777 changed to root.root
> 4755
> >
> 
> this may sound stupid... but was does this error message means?
> 

This means that suidmanager found a problem with the sendmail executable
and fixed it.

Having permissions of 777 means that ANYONE can read/write/execute the
program.  The problem is in the WRITE portion - anyone with access to your
host can replace (or perhaps already has?) sendmail with their own
version.

Having permissions of 4755 means that group/other only have read and
execute permissions - the leading 4 indicates that the suid bit is set
(program runs under the uid of the owner of the program).


With an error like this popping up in the log file, I'd start checking the
system to see if the security has been compromised....

-dave

--
   |     oOOooO           /  
 --|    oOobodoO        /   dsb3@earthlink.net
 --|     ooOoOo       /    
   |       II       /     The wise man tells you where you have fallen
   |       II     /      and where you may fall - Invaluable secrets.