List of valid files to have SUID and GUID bit set

[Bill Costigan]

Is there a list somewhere of the HP-UX files that should have the SUID or GUID bit set. I'd like to compare that with the files on my system that actually have the bit set.

Thanks,
Bill

[Christopher Caldwell]

Use swverify to check permissions.

[S.K. Chan]

Not that I know of because over time this gets changed from installation of patches (especially security patches), software, etc, etc.

[Bill Costigan]

I assume the swverify will check that all files installed with swinstall have the original bits set. This will also reflect new patches that might have changed the recommended bit settings.

Is this true?

But there is no way to ensure someone didn't add a file and set its SUID or GUID bits?

Is this also true?

[Christopher Caldwell · Accepted solution]

>I assume the swverify will >check that all files >installed with swinstall >have the original bits set. >This will also reflect new >patches that might have >changed the recommended bit >settings.

>Is this true?

Yes.

>But there is no way to >ensure someone didn't add a >file and set its SUID or >GUID bits?

Find that which swverify says has setuid,setgid set. Make a list. Find that which find says has setuid,setgid set. Take a diff.

(Painful, but it would work).

Is this also true?

[S.K. Chan]

Well, swverify won't tell you what has changed (for example a specific file that had just got its SUID set). To detect this kind of changes, you got to run somekind of security checking software regularly and produces report of all SUID files or write your own script. Here we regularly run full Medusa report (once a week) that enables our system security guru to detect if any files was added/changed that has its SUID/GUID set.

[Bill Hassell]

The file settings in Software Distributor (ie, swinstall) are stored in the information files found in /var/adm/sw/products. The INFO file has all the correct ownerships and mode flags. You'll need to use sed or awk to hook the filename/directoryname together with the mode and ownership information. Since this can be scripted, you can run the script to produce a list of valid SUID/GID files and use that in scanning for rogues.

[Bill Costigan]

Thanks to all !!

[RAC_1]

how about using find with -perm option to find out SUID/GUID files?

But this will be using a lot CPU and time consuming command.

[Chris Wong]

I keep a list on my web-site of the settings just after an install:

http://newfdawg.com/SecBook-ListSource.htm

- Chris

[Bill Costigan]

Thanks Chris

That was what I was looking for.