sudo security issue with vi, more commands

[Deepak.R]

Hi Gurus,

I use sudo for controlled access in HP boxes and have given access of more and vi commands to users. Now when I run, for example,

$/usr/bin/sudo /usr/bin/more filename

from more , I can escape to shell ( ! ) and this shell would be a root shell and I can execute whatever from there and this is a BIG security loophole and want to close it.

I can not stop access to these command as well.

Pls tell me if there is any workaround for this.

thanks
deepak

[vinod_25]

hi deepak

Make the suid script act as the restricted shell for this user. You can do this by setting the /etc/passwd entry for this user not a shell, such as /sbin/sh, but instead as the name of the script, /usr/contrib/bin/rapp_menu.

Note: The r before app_menu signals a restricted shell.

The effect then is that the script runs as root, but the usercannot suspend the script and drop to a root subshell. When the script is complete, the user is automatically logged off.

Hope this sprays some light to ur query

Regards

Vinod K

[Bill Hassell]

You have not configured sudo to be restrictive. You do NOT give vi (and a LOT of other commands like rm, chmod, etc) to casual users. You don't need to run vi at all. Just type: sudo sh and you now have your root shell. TAKE AWAY EVERYTHING, then start by giving them something simple like the lpsched and lpshut command and if the user is trustworthy and properly trained, you might give them the lpadmin command. You MUST have a list of allowable commands for each user, not ALL=ALL in your sudoers file.

So here's how you close it. No one gets sudo access until you create a list of commands, and in some cases, the only allowable parameters. For instance, you can allow mount and umount but only if the 1st parameter is the device file for the CDROM drive.

Better yet, NO ordinary user gets a shell prompt. Instead, they get a menu that they cannot escape. The menu has a list of commands the user can run.

[Patrick Wallek]

If you are having that type of problem with giving access via sudo, it might be time take another look at how your have your system set up.

If there are a lot of users that need access to some files, then you need to look at group permissions for the file and those users. The same thing applies whether you are talking about vi or more.

There is really no good reason I can thing of for normal users to have root access to run more or vi.

[Gopi Sekar]

I think sudo is not your friend in this situation. I would go with other member's suggestion of user/group permission. List out all the users who has to access a particular file, add them to a particular group and give that group write access to the file.

As far as I know you only need read permission for a file to use more, so try to give group read permission to use with more.

Regards,
Gopi

[Florian Heigl (new acc)]

Bill,

thank You!

I think You're the first sudo user I ever meet actually configuring it :)
At times will people show me sudo, being very happy about the increased security it provides them.
Until I ask them to type 'sudo passwd root', that is. After that I ask them to read the documentation and properly use it....

[Bill Hassell]

sudo gives the keys to the computer to anyone in the sudoers file, so like any security policy, I only give certain keys to certain users. For workstation users, they can type sudo mount /cdrom and sudo umount /cdrom, but everything else fails (and both success and failure are looged in syslog). sudo is an excellent tool but a when thought out, sudoers will be a very big file with lots of entries to constrain the users.

[Florian Heigl (new acc)]

...which is a shared disadvantage with HP-UX/Solaris RBAC, unfortunately.

Sometimes the policy management of Windows/AIX seems much more beautiful, if it weren't even worse ;)

[Andrew Cowan]

Deepak,

If you want to lock down vi and more (this is not perfect), create a .exrc file, or set the shell variable $EXINIT, and set the shell to "nologin". This should prevent the user from shell'ing out of either command.

Example:
set shell=/bin/nologin
set exrc=noexrc

chmod 550 ~/.exrc

[Elif Gius]

We had the same problem.
Be also careful with the command "pg".

So we changed that the user is only allowed to view files via the command cat.
That works!

[Rick Garland]

Here is a sudoers entry that solved a lot of problems for unauthourized access

Note the ! characters for the root acces.


%baradm ALL=NOPASSWD:SU,!/usr/bin/su *root*,!/usr/bin/su "", \
!/usr/bin/su -,!RLOGIN,READ,DV,KILL,PRINTING,FIND,ADMINS

[Rodney Hills]

If these files are you need to "vi" or "more" are normally not available to users, and you are using "sudo" to access them, then take a look at group permissions.

If group permissions won't solve the problem, then if you get the newest version of "sudo", it has the ability to run as any user (not just root). That way you can give permission to the file without giving away the whole store.

HTH

-- Rod Hills