suid

[f. halili]

Any brief idea about suid???
Any good docs discussing suid??

[Philip Chan_1]

Are you talking about Sybase? or HPUX?

[Brian M. Fisher · Accepted solution]

suid scripts are fairly risky to say the least. If they are not carefully coded, they can be broken out of giving a normal user root capability.
A much better approach to suid scripts/programs is to use the software sudo. A package to allow commands to be run as the superuser. Sudo determines who is an authorised user by consulting your /etc/sudoers database. The program prompts for a user's password to initiate a validation period of N minutes, here N is defined at installation time. N.B. There is no easy way to prevent a user from gaining a root shell if he has access to commands that are shell scripts or that allow shell escapes.
This is available at the Software Porting And Archive Centre for HP-UX:
http://hpux.cs.utah.edu/ or
http://hpux.cae.wisc.edu/ or
http://hpux.connect.org.uk/

Brian
<*(((>< er

[Cheryl Griffin]

See ITRC Knowledge Base document id A5555024 "Sys Adm: general suid questions-permissions and user classes" for an explanation of SUID.

See also "Essential System Administration" in the O'Reilly series of UNIX books, Chapter 6: Security.

[f. halili]

thanks.....

[Tim Nelson]

Don't forget that setting the suid bit only suid's for file permissions. It will not work for commands. Lately I have been using SAMs ability to allow custom menus and applications to run as root for example. This basically is the same as "sudo" but comes included with HPUX instead of another 3rd party app to be administered. I use this to allow operators to run backups as root and help desk persons to reset non-root user passwords. The scripts you write that are called upon by the restricted SAM MUST be secure and fool proof.