Tcpdump not work from other user

[gigiz]

I guy,
I need to run tcpdump command from a normal user (not-root-user).
I have a 11.23 .
I have installed tcpdump:
swlist -l product |grep -i tcpdump
Tcpdump A.12.00-3.9.8.001 Network Monitoring and Data Acquisition
I have use SETUID:

ll ./opt/iexpress/tcpdump/sbin/tcpdump
-r-sr-sr-x 1 bin bin 1179888 May 12 2008 ./opt/iexpress/tcpdump/sbin/tcpdump


ll ./usr/sbin/tcpdump
lrwxr-xr-x 1 root sys 34 Jul 20 14:24 ./usr/sbin/tcpdump -> /opt/iexpress/tcpdump/sbin/tcpdump


but if i try to start tcpdump with a normal user :
$ /usr/sbin/tcpdump -p -i lan0
tcpdump: recv_ack: promisc_sap: UNIX error - Not owner

Help me many point at all

[Duncan Edmonstone]

The whole point of tcpdump is that it lets you snoop packets on the network...

so allowing an "ordinary" user access to it, is like granting an "ordinary" user access to all the files on your system... (and any other system this server talks to) i.e. not very bright.

Access to tools like tcpdump *should* be limited to just root - if you have a specific situation where a non-root user needs to use it, I would look at using sudo or the RBAC tools (privrun)

HTH

Duncan

[Laurent Menase · Accepted solution]

it is really not advised to set user id bit on tcpdump.
it is much better to use sudo or RBAC and fine grain priviledge.

else setuserid bit set the uid like the owner, and the owner of your tcpdump is bin and not root

so a chown root before the chmod is necessary

[gigiz]

OK