Password shows up in syslog.log

[Barry Feinberg]

We had a user enter "su " by Accidentally not hitting enter after su the root password came up in syslog.log and sulog. We tried the same thing on another 11.0 os server which is patched more upto date and we did not get the password in suslog.log or sulog. What patch do I need to resolve this security issue?

[Chris Wilshaw]

As far as unix is concerned, your password on that command line was the ID that you wanted to su to, so it should get reported to sulog (and/or syslog, depending on how you have logging set up). Patch level should have no bearing on this, as unix has no way to tell that you've entered your password in the ID field.

You can disable all su messages to syslog.log and sulog by setting the following lines in /etc/syslog.conf, then restarting syslogd

auth.none /var/adm/syslog/syslog.log
auth.none /var/adm/sulog

However, this would prevent you from seeing messages in there that you wanted to see.

[harry d brown jr]

That's not a security issue, that's a user issue!

It would be no different than if I just typed in my passwd and it showed up in my history file:

passwd oldpasswd

Personal;ly, I'd take away the ability of the user to use "su", but that's because I'm cruel :-) I don't like users to have shell access.


Of course if you don't have this activity logged, then you don't know who is attempting to breack into your system.

live free or die
harry

[Uday_S_Ankolekar]

I'm sure you are typing command in wrong way while you run su command

you should try like this,

type in su and then press enter, system will prompt you for password.

if you type su followed by password without pressing enter system assumes your typed password as a user id and then logs in syslog file.

-USA..

[S.K. Chan]

Chris is correct, take a look also at this doc (tells you how to disable "su" logging to syslog.log). DocID=KBRC00009295
http://support2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000062760077
Another good example of this kind of scenario is, someone logs in (without paying attention) thinking the Login prompt is the password prompt.. and oops ... well guess what ...
# strings /etc/btmp

[John Bolene]

Yup, user issue, entering the wrong data in the id field.

UNIX does not know it was a password, it wanted a user id.

[Martin Johnson]

You could write a wrapper for su which validates the username typed in with the users in /etc/passwd. You can have it reprompt until is gets a valid username before passing it on to su.

HTH
Marty

[Darren Prior]

Hi Barry,

Further to the other answers to your query, it may have been logged in places other than syslog. I think there's a possibility that it would be visible if someone had run a ps -ef at that time.

You should change the root password now, and perhaps have some moderately harsh words with the user!

regards,

Darren.

[Roger Baptiste]

hi,

it's a user problem. Unfortunately there is no patch to protect against fat finger or negligent mistakes ;-)

DIsabling SU logs in syslog is not a good idea. It's useful to know who was using SU command and the history, in case of any breakins or security related issues.

HTH
raj