root's PATH

[James Armstrong]

Hi,

We have just be externally audited and one of teh recommendations is that we reduce root's path to just /usr/sbin:/sbin:/usr/bin to avoid the risk of trojans etc. I am a bit twitchy about doing this, ,has anyone got a recommendation for a minimum root path that still allows some flexibility for running most day to day commands without entering teh full path.

[Pete Randall]

Hi James,

The auditor's recommendation would be fine if you have no need to access other installed applications. However, if you have other applications (like Omniback, or your DB, for example), you may want to include those in your path. It really depends on how (and for what) you use root access.


Pete

[Stefan Farrelly · Accepted solution]

I would be very loathe to go against the minumum PATH as in /usr/newconfig/etc/PATH
/usr/bin:/usr/ccs/bin:/usr/contrib/bin
without strenuous testing to see the implications.

Ive been through many many security audits over the year - one just last week by AOL/Time Warners top security people, and they never recommended changing roots default path - which is good enough for me. I think its unnecessary.

[James R. Ferguson]

Hi James:

This isn't bad. Consider that the default environment supplied by 'cron' for its jobs is '/usr/bin:/usr/sbin:', so the above covers the standard OS commands nicely.

Regards!

...JRF...

[James Armstrong]

Thanks for that guys, I'll reduce it on one of the dev boxes for a while and see if all goes ok.

[Steven E. Protter]

The auditors recommendation is a little spartan.

You can break certain applications and scripts by being that tight. Remember in cron scripts you generally have to set the path or use full path names of commands.

Do all of your sysadmin scripts do one or the other? If not, you might be buying a little trouble.

Still your test approach is top notch. Make sure you notify your auditors and problems of any problems the recommendation causes.

SEP

[John Meissner]

We get regular audits at work from external audit companies. They make loads of suggestions to us. We take these as SUGGESTIONS. If you run feel the need to leave things in your path statement (such as usr/contrib/bin - for gzip and gunzip) then I would leave them. They are just making suggestions which your company will need to evaluate to determine risk/benifit.

[Tim Sanko]

Comply with the auditors fully. Remove virtually everything from the path. In the .dtprofile or
.profile for batches have a
.my_settings file with the appropriate paths. have it sourced on non-interactive
processes.

you can source it from the command line yourself

# . /root/.my_settings

This brings you into full compliance and lets you do your job. whith a minumum of
grief