topic Re: suid in Operating System - HP-UX

suid

f. halili — Fri, 14 Jul 2000 13:05:55 GMT

Any brief idea about suid???
Any good docs discussing suid??

Re: suid

Philip Chan_1 — Fri, 14 Jul 2000 13:13:37 GMT

Are you talking about Sybase? or HPUX?

Re: suid

Brian M. Fisher — Fri, 14 Jul 2000 13:18:16 GMT

suid scripts are fairly risky to say the least. If they are not carefully coded, they can be broken out of giving a normal user root capability.
A much better approach to suid scripts/programs is to use the software sudo. A package to allow commands to be run as the superuser. Sudo determines who is an authorised user by consulting your /etc/sudoers database. The program prompts for a user's password to initiate a validation period of N minutes, here N is defined at installation time. N.B. There is no easy way to prevent a user from gaining a root shell if he has access to commands that are shell scripts or that allow shell escapes.
This is available at the Software Porting And Archive Centre for HP-UX:
http://hpux.cs.utah.edu/ or
http://hpux.cae.wisc.edu/ or
http://hpux.connect.org.uk/

Brian
<*(((>< er

Re: suid

Cheryl Griffin — Fri, 14 Jul 2000 13:21:25 GMT

See ITRC Knowledge Base document id A5555024 "Sys Adm: general suid questions-permissions and user classes" for an explanation of SUID.

See also "Essential System Administration" in the O'Reilly series of UNIX books, Chapter 6: Security.

Re: suid

f. halili — Fri, 14 Jul 2000 14:13:18 GMT

thanks.....

Re: suid

Tim Nelson — Sat, 22 Jul 2000 10:49:20 GMT

Don't forget that setting the suid bit only suid's for file permissions. It will not work for commands. Lately I have been using SAMs ability to allow custom menus and applications to run as root for example. This basically is the same as "sudo" but comes included with HPUX instead of another 3rd party app to be administered. I use this to allow operators to run backups as root and help desk persons to reset non-root user passwords. The scripts you write that are called upon by the restricted SAM MUST be secure and fool proof.