Can I change the suid bit?

[Carme Torca]

Hi,

There are a lot of commands with suid bit.
What it is used for?. Could I change it to have for security?

# ls -l /usr/sbin/ping
-r-sr-xr-x 1 root bin 32768 Oct 17 2006 /usr/sbin/ping

Thanks!
Carmen.

[Ivan Krastev · Accepted solution]

Better do not touch the default setuid programs. See more ifo about all mechanism here - http://en.wikipedia.org/wiki/Setuid

regards,
ivan

[sreekanthtm]

Default hpux files with suid bit will not have write permission to anybody. So only root can do some drstic change in the system. And the commands with suid set is a trusted command; means ' The command will do only, what it suppose to do'.
So don't worry about the default commands with suid bit.

[Sandeep_Chaudhary]

do not change suid bit.
The suid bit is use to run particular program with owners credentials. Thats the reason anyone can execute that program though it is owned by root

[Jeeshan]

If you talk about SUID bit, "chmod u+s", this means that a program will run with the privileges of the owner of the file instead of the user who runs the program.

For example, if /bin/rm is owned by root, without SUID bit, if user1 runs the command /bin/rm -fr /root, it will run as user1, and he won't be able to delete the files in /root as user1 has no permissions.

If /bin/rm is owned by root, and it has SUID bit enabled, if user1 runs the command /bin/rm -fr /root, it will run as "root" (the owner of the program), and will be able to delete the /root directory.

If you want to change the SUID, be aware to track what u are changing.

[Bill Hassell]

You cannot improve security by removing the suid bit on HP-supplied programs. They have been reviewed over 20 years to make sure that proper security measures are in place. If you were to remove the suid bit for ping, only root could use the command. If you remove it for login or passwd, then no one except can ever login again. You may have read a security article about suid but this only applies to user-created programs and scripts. This type of problem is very, very small when compared to the basic issues such as using telnet and ftp, not using Trusted or Advanced security on your system, or not providing a proper firewall.