Internet Express sudoers file permissions

[Rudy Williams]

Good Day--

Much to my alarm, I just discovered that the Internet Express (5.00-008) suoders file must be world readable. Since the sudo binary is owned by root and SUID, I would think that sudoers does not need to be world readable.

What is up with this? sudo is supposed to *add* security to your system, not add security flaws! Does anyone else share my concern?

Rudy

[Jaime Bolanos Rojas.]

Rudy,

This was extracted from a discussion found in the internet:

"If that is really what sudo did it would be even more insecure!!! However, that's not what it does, thankfully.

The sudo executable itself has the setuid bit set, and that's how it works. Other than that, all it does is switch user and run whatever process you tell it to.

So effectively, it is switching the uid (and gid) of the process, NOT changing the setuid bit on the executable, which would be a disaster - it would have to switch the setuid bit back again afterwards, and then if it crashed while running, that executable would be left for anyone to run as root (or whoever) anytime without requiring sudo.

sudo is insecure on a system with more than one admin (wheel) user, because there are more passwords which will allow it to be used (you only need to know one password from any of the admin users). When people do not have a sudo command on their machine, and users need to su to root to access root privileges, then people are more inclined to set a non-trivial root password. This is secure. However, if there is a sudo command, and there are several admin users, the chances are much less that they will all have good secure non-trivial passwords.

I'm not saying that sudo is always a security problem, but just that for cracking passwords (and for no other reasons) sudo is more inclined to being insecure than having root enabled with a good password.

Edit: To backup my argument about what sudo actually does, here's a quote from the man page ("man sudo"):

sudo allows a permitted user to execute a command as the superuser or another user, as specified in the sudoers file. The real and effective uid and gid are set to match those of the target user..."

Regards,

Jaime

[Pete Randall]

Why would you consider world readable a security flaw? World writable would definitely be an issue, but it makes sense to me that it needs to be world readable.


Pete

[Rudy Williams]

I think a world readable sudoers file is a security flaw because any mortal user can see who has sudo privs. (At least one Linux implementation of sudo only allows user root to view that file.)

If I can read that file then I have information on who has enhanced system privs and I have a greater attack surface. Next, if I can obtain one of those users' passwords, I have a greater chance of obtaining root.

The sudoers file is a very important one. In keeping with the traditional security paradigm of UNIX, all those eggs in one basket should be guarded *very* closely.