SUICIDAL "sudo" command ??

Printable View

August 2nd, 2004, 02:34 PM
hacker_vk

SUICIDAL "sudo" command ??

Hi All,
This is my very first post to Forum, infact to AO.
I wanted to know the significance/relevance of the putting "sudo" command that is usually there is most Unix, Linux System. If this command is an ALTERNATIVE-TO-ROOT. Then isn't this SUICIDAL. Does this make a log if yes then in which file.

To put some pretext for the Query lemme say...
I tried this command to alter permission of so-called READONLY "passwd" file, as an ordinary user & I succeeded. Successively I was able to add one user having rOOt PoweRs (Don't ask me how?) whichout even root to letting it know . Now the Question is How could I change "passwd" [ or "shadow" file, as I did ]. Is there any "sudo" log that would have an entry of this.

ThanX in adVANce
August 2nd, 2004, 02:37 PM
SirDice

man sudo?
August 2nd, 2004, 02:38 PM
the_JinX

To allow a user to use sudo to get teh 1337 r00t powerz you need to add the user to the /etc/sudoers file

also you can specify which commands the user can execute (even which variables he is allowed to use with the command)

try man sudo or even better this page: http://www.courtesan.com/sudo/intro.html
August 2nd, 2004, 02:39 PM
hacker_vk

Thx SirDice ..But the system I'm working on [ MPRAS-UNIX] has no manual Entry on this.
;-(.
August 2nd, 2004, 02:44 PM
SirDice

See the link The_Jinx posted, you can also find the man pages there.
August 2nd, 2004, 02:46 PM
hacker_vk

Thx the_JinX for the Link. It really has substancial Info.
August 2nd, 2004, 02:53 PM
the_JinX

NoProblem ;)

Yup..
I went there while I was writing my lame tutorial on "chroot shells"..
That needed sudo and I allways shunned sudo out of a (unneeded) fear of the command..

Historicaly sudo has been abbused a lot by exploits and the likes..
But current versions are safe to use(tm)
August 2nd, 2004, 02:59 PM
SirDice

Yep, sudo is relatively safe. You just need to watch what kind of commands you're enabling...

Quote:

There is no easy way to prevent a user from gaining a root shell if that user is allowed to run arbitrary commands via sudo. Also, many programs (such as editors) allow the user to run commands via shell escapes, thus avoiding sudo's checks.

Source man sudo.
August 2nd, 2004, 03:31 PM
hacker_vk

thx again !! the_JinX, SirDice.
Right Now my head is in the sudo-link...dupppp..

Hey..one sec.. another Doubt.
Assume if I could change "passwd" file for myself to be root. Then I CAN do anything with "/etc/sudoers" file & also I can remove entries from it's log files.
Isn't that a hole. If not then what's the patch. :confused:

Thx again in advancE.
August 2nd, 2004, 03:57 PM
NeOnD

Hello EveryOne, I'd the same doubt. Any Suggestions ???
August 3rd, 2004, 07:52 AM
the_JinX

As SirDice was kind enough to point out,

you shouldn't allow any kind of program that has more than one function, let alone a function to edit / open files as the root user to be used with sudo (in the /etc/sudoers)
That way noone will be able to edit the /etc/shadow, /etc/password or /etc/sudoers or even worse files . . .

The only file allowed to be "su-done" on my system is a shellscript that chroots the home of the user and then drops back to the lower rights user..

The only thing you have to be realy realy carefull about is not to allow to much !!!
August 3rd, 2004, 10:44 PM
Vorlin

Sudo, being a program by Todd Miller at www.courtesan.com is pretty much an essential program in most implementations of *NIX these days.

The default installation goes into /usr/local/bin (sudo) and /usr/local/sbin (visudo).

The man pages are located at the author's site: here

Implementation is everything, as always, and correctly used, can provide a lot of ease to the systems administrators and those that write scripts that need "root" access, etc...

Of course, if you do this:

Code:

username ALL=(ALL) NOPASSWD: ALL

You might as well just say "here's the keys, take the car out!"....

It's got group aliasing, host aliasing, command aliasing, everything...you can narrow it down to IP-based machines, etc...it's come a long ways!
August 3rd, 2004, 10:50 PM
Vorlin

Quote:

Originally posted here by hacker_vk
thx again !! the_JinX, SirDice.
Right Now my head is in the sudo-link...dupppp..

Hey..one sec.. another Doubt.
Assume if I could change "passwd" file for myself to be root. Then I CAN do anything with "/etc/sudoers" file & also I can remove entries from it's log files.
Isn't that a hole. If not then what's the patch. :confused:

Thx again in advancE.

If you could change /etc/passwd to begin with, either /etc/passwd would be world-writeable or you'd already be equivalent to 'root' and you wouldn't need to touch sudo, which by default doesn't allow root to run it. A rather off-base question because if you're already root-equiv (UID: 0), then it doesn't matter...you can shut off syslog, change routing and networking tables, etc...install backdoors, fatal suid progs, set eth0 to promiscuous, replace binaries with your own mix, the usual....

So no, it's not a "hole"....