On Sat, 2007-02-03 at 01:09 -0800, Evan Klitzke wrote: > > I strongly disagree with you on this. In real life, if you are an admin > and someone gets access your shell account, you're screwed. I am _not_ > talking about exploits here. For example, if I somehow got hold of your > password and could get a shell on your system, I could just put my own > "su" on your computer and change your path. The su command is a suid binary. Only root can install an su binary. While you could create something with a similar name and modify my .bashrc file to put it in my path, that would be fairly easily detectable. Until you get root on my box, you can't poke holes in my firewall to open up ports to listen on. You can't alter my binaries and modify my rpm database. When I log into my system, I will get a notice stating where my last login was from - and as far as I know, you can't hide that without being root. For example: [admin@atlantis ~]$ ssh -l texlive jerusalem texlive@jerusalem's password: Last login: Thu Feb 1 23:01:29 2007 from 192.168.15.100 [texlive@jerusalem ~]$ > Or change your shell to log > your keystrokes. Or use the keys in your ssh-agent. Or do any number of > nasty things. None of them are guaranteed to work, but if you don't know > your account has been compromised the odds are very good for the > attacker. How are you going to use the keys in my ssh-agent? I'm not stupid enough to not require a gpg pashphrase authentication, so you would need to get my gpg pass phrase. btw, I'm not sure you can install an effective key logger without root. Of course, if I have sudo set up such that "sudo sh" only requires my user password, then you could easily install a keystroke logger. > > Furthermore, it is definitely not reasonable to assume that because > someone can get a shell with your account they have your password. Of course it is not. It is also not reasonable to assume thay your password isn't installed in a world readable text file *cough*ubuntu*cough* or that users are smart enough to never use ftp to upload files to their home computer from the Starbucks with free wifi. > For > example, say you attach to an ssh-agent on some other machine. The root > user of that machine can attach to the ssh-socket and authenticate with > your keys, and get a shell on your machine. Does this mean they have > your password? Of course not. It does mean they have my pass phrase. > What if some vulnerability comes out that > lets them trick PAM? They still don't have your password. Here's an even > better case: what if you download some malicious software? That software > can spawn a shell and execute shellcode, but it doesn't have your > password. If someone can get into your account _and_ has your password, > you've been seriously compromised and if you are really concerned about > the security of your system you should just reinstall. Sure - there are lots of ways for them to get on a system w/o having the users password. But there also is something called a brute force attack. Maybe you've seen it in your logs. Someone with a cable modem has their box compromised. The system cracker then uses that box to try brute force attacks on various systems - picking common users and password (btw - this is why I think it is wrong for Fedora to allow root ssh login by default, it is a known user account name). If they succeed and your box has insecure sudo, now they can have their shell root your box, poke holes in your firewall, install a root kit, and start attacking other peoples box from yours - all without the cracker needing to install a fake su and modify my path and wait for me to fall victim. Do you see how the default sudo in OS X and Ubuntu and other distros is a worm just waiting to happen? > > The default user on Ubuntu can sudo. Other newly created users can't. Most people installing Ubuntu are installing it to be a single user machine. They use the default user. Same with OS X. > Same with Fedora. The first user enters the root password. Other users > don't know it. The only difference is that to let another user access > root you would either need to set up sudo, or give them the root > password anyway. There isn't a huge difference. Sure there is. If the shell script mentioned manages to get the default users password, the shell script has now rooted the box. While a failed use of sudo would alert the sysadmin that someone tried to use it, it isn't very hard to use the "groups" command first and only root the box with sudo if the user is in the wheel group. While Fedora does provide a wheel group, no users are put there by default - and even if you add users to the wheel group, they only have extra permission if the system administrator specifically allows it. There are three types of accounts - root system (daemons etc) users (UID 500 and above) There are not users that are more or privileged than others unless you set it up that way, which is vastly different than the insecure ubuntu/OS X model. > > No, most people will not change how sudo operates. But that's ok, > because it isn't a security issue. Yes it is - I just explained how. A shell script running brute force attacks against open ports will be able to root the box if it is succesful. With Fedora, it will only be able to root the box if it specifically was able to brute force the root account or there is a known local exploit that has not been patched. Any other rooting requires social engineering (such as waiting for me to stupidly use an su command that is not /bin/su). btw - given that you can not install a suid root application w/o already being root, that makes it a little harder to trick me into using a fake su w/o alerting me that something is amiss. I suppose you could do it with tcl via expect and *maybe* give me no visual indication that you I am not running the real su. I believe though there are protections against that. > If I looked in /var/log/auth and > realized that someone was logging onto my regular user account remotely, > I wouldn't say "Good thing I have a root password!" I'd realize that an > administrator account had been compromised, and I'd treat it the same > way I would if I was using Ubuntu or OS X and reinstall. But if they have access to sudo, your /var/log/auth file will lie to you. > The point of > installing sudo by default isn't to make the system more secure, it's to > make it more convenient. Makes it more convenient at the cost of security. sudo should NEVER be used to run a program that can spawn a shell. Period. > If you really feel that the minimal amount of > extra protection you get from having a root password in addition to your > regular user password makes a big difference, your computer wasn't > secure enough to start out with. I'm sorry, but I think you are clueless. For what its worth - my dad just retired a few years ago, but UNIX security was his job. I'm not my dad, nor am I as nearly knowkedgeable on the topic of security as he is, but I do talk with him about this sort of thing and I certainly know about the dangers of sudo. > > -- Evan Klitzke >
