OT Newsreader?

Rick Onanian <[email hidden]> wrote:
:>[user]-$ make -n install
: That's a new one on me...what is it?

show me what you're going to do but don't actually do it. it's always a good idea to not blindly
runs things as root.

:>Peronally I think sudo is the work of satan, and always have it disabled. If you're going to do
:>something as root, you ought to have to type the root password just to remind yourself it's
:>dangerous.
:
: Sudo reminds me well enough. If I log in as root, I may forget that I did so, and end up doing
: user stuff as root.

sudo does have one disadvantage as i found out a few years back. if someone gets into your box
through, say, a trojan'd sshd on, say, sourceforge.net and they therefore actually have your
password they will 0wn your b0x in a heartbeat.

that was, btw, the last time i used sudo at home. the only legit reason for sudo imho is to
give out subprivileges (let one user run dump to do backups for instance) but a sudo su - root
has no purpose.
--
david reuteler [email hidden]

TJ Poseno said:

What do you people use to read these newsgroups, i am using google groups, but it isnt very good.
obviously.

Sow hat do you guys use?

I think that google has a "view original message source" link. Click it and you'll be able to see
for yourself what newsreaders people use.

A bientot Paul
--
Paul Floyd paulf.free.frpaulf.free.frOpen ↗ (for what it's worth) Surgery: ennobled Gerald.

David Reuteler said:

sudo does have one disadvantage as i found out a few years back. if someone gets into your box
through, say, a trojan'd sshd on, say, sourceforge.net and they therefore actually have your
password they will 0wn your b0x in a heartbeat.

...for improperly setup sudo. Granted, many people do set it up that way.

Quoted message said:

that was, btw, the last time i used sudo at home. the only legit reason for sudo imho is to
give out subprivileges (let one user run dump to do backups for instance) but a sudo su - root
has no purpose.

I've used it when I've forgotten my root password a couple times. 😉

However, it's probably not difficult to setup sudo to give the user the privileges needed to install
programs without leaving the box wide-open to that sort of attack.
--
Rick "More careful in the future" Onanian

Rick Onanian <[email hidden]> wrote:
: ...for improperly setup sudo. Granted, many people do set it up that way.

umm, for your box. from your example you had it setup to allow:

$ sudo make install

ie, to run make w/ root privileges. ok, i have your password because i trojan'd your ISP's ssh and
caught you ssh'ing into your machine. if you're smart you've got /etc/sudoers chmod 660 and owned
root.wheel.

but i'm a good guesser. i've also seen you posting about how you like to sudo make install. so i try
make, i'd probably also try sudo su - root and some others. anyway, hey, make works!

whatever will i do? i can run make with root privileges.

$ cat > Makefile install: @echo 'myroot::0:0:Fake Root:/root:/bin/csh' >> /etc/passwd $ sudo make
install $ su - myroot

& i'm in as uid 0. root.

: I've used it when I've forgotten my root password a couple times. 😉

don't do that.

if you do and you have physical access to the box it's 2 minutes to reset the root password in
single user mode either by rebooting or booting, w/ a floopy or cd.

: However, it's probably not difficult to setup sudo to give the user the privileges needed to
: install programs without leaving the box wide-open to that sort of attack.

no, it really isn't.
--
david reuteler [email hidden]

David Reuteler said:

whatever will i do? i can run make with root privileges.

$ cat > Makefile install: @echo 'myroot::0:0:Fake Root:/root:/bin/csh' >> /etc/passwd $ sudo make
install $ su - myroot

& i'm in as uid 0. root.

A few more steps might be required if, for example, passwordless accounts are not allowed.

Why not just do: $ cat > Makefile install: bash $ sudo make install
# echo ha ha!

--
Benjamin Lewis

A small, but vocal, contingent even argues that tin is superior, but they are held by most to be the
lunatic fringe of Foil Deflector Beanie science.

Benjamin Lewis <[email hidden]> wrote:
: A few more steps might be required if, for example, passwordless accounts are not allowed.

well, yea. proof of concept.

: Why not just do: $ cat > Makefile install: bash $ sudo make install
: # echo ha ha!

better yet. being devious is fun, ey? it even pays medium sized bucks. (i mean if you're a
good guy ;-).
--
david reuteler [email hidden]

David Reuteler said:

better yet. being devious is fun, ey? it even pays medium sized bucks. (i mean if you're a good
guy ;-).

What does it pay if you're a bad girl?

--
Benjamin Lewis

Chemist who falls in acid will be tripping for weeks.

Benjamin Lewis <[email hidden]> wrote:
: What does it pay if you're a bad girl?

i wish to god there were some.
--
david reuteler [email hidden]

David Reuteler said:

Rick Onanian <[email hidden]> wrote:
: ...for improperly setup sudo. Granted, many people do set it up that way.

umm, for your box. from your example you had it setup to allow: $ sudo make install ie, to run make
w/ root privileges. ok, i have your password because i

<snip>

Quoted message said:

and some others. anyway, hey, make works! whatever will i do? i can run make with root privileges.

$ cat > Makefile install: @echo 'myroot::0:0:Fake Root:/root:/bin/csh' >> /etc/passwd $ sudo make
install $ su - myroot

Hmm...you can't setup sudo to not allow overwriting/modifying files? Typical "make install"s
shouldn't need to overwrite/modify important files like passwd.

Quoted message said:

: I've used it when I've forgotten my root password a couple times. 😉
don't do that.

I didn't say it was a good idea.

Quoted message said:

if you do and you have physical access to the box it's 2 minutes to reset the root password in
single user mode either by rebooting or booting, w/ a floopy or cd.

Indeed, the proper and preferable way.

Quoted message said:

: However, it's probably not difficult to setup sudo to give the user the privileges needed to
: install programs without leaving the box wide-open to that sort of attack.

no, it really isn't.

Er, were you agreeing or disagreeing there? In the context of this message, I expect you to
disagree, but your words agree.
--
Rick Onanian

Benjamin Lewis said:

David Reuteler said:

better yet. being devious is fun, ey? it even pays medium sized bucks. (i mean if you're a good
guy ;-).

What does it pay if you're a bad girl?

Undefined. Bad_girl(geek) is a non-existant combination.
--
Rick Onanian

Rick Onanian said:

Hmm...you can't setup sudo to not allow overwriting/modifying files?

That would be somewhat crippling to "make install", wouldn't it?

Quoted message said:

Typical "make install"s shouldn't need to overwrite/modify important files like passwd.

Of course they shouldn't -- but if you're a malicious intruder, you have little motivation to
restrict yourself to typical "make installs".

Anyway, make allows you to run arbitrary commands, such as a new shell, as I pointed out in another
post. The system is completely open to users who can run make as root.

--
Benjamin Lewis

Everything that can be invented has been invented. -- Charles Duell, Director of U.S. Patent
Office, 1899

Rick Onanian <[email hidden]> wrote:
: Hmm...you can't setup sudo to not allow overwriting/modifying files? Typical "make install"s
: shouldn't need to overwrite/modify important files like passwd.

nope. sudo doesn't control the environment the program is run in (make in this case) it just checks
to see if you have access (from /etc/sudoers) and if you do it does a setuid(0) (or whatever user)
and something like a fork/waitpid or a system or exec or whatever and lets it go. it makes no
attempt to limit the system calls of the program it forks. and if it did or could (systrace?) how
would you implement the rules. which actions are legit in which contexts? installing software
requires a wide range of actions and messing w/ the passwd file is often one of them. sudo isn't
about that. it's a quick and dirty utility to dole out root privileges. it makes the large and
necessary assumption that you're thinking before you do.

lest you think rpm is any better than make you can do a similiar thing there. roll your own rpm with
a nefarious install script and bang .. you're in. or have it install a setuid program to do your
bidding, or, or, or ...

:>no, it really isn't.
:
: Er, were you agreeing or disagreeing there? In the context of this message, I expect you to
: disagree, but your words agree.

yea, i got that wrong. i meant to say that it isn't an easy thing to do. any time you give out root
privs you need to think real hard about exploits.
--
david reuteler [email hidden]

Benjamin Lewis said:

Rick Onanian said:

Hmm...you can't setup sudo to not allow overwriting/modifying files?

That would be somewhat crippling to "make install", wouldn't it?

Doh! I miscommunicated that; I meant that I thought you could set it up to not allow
overwiting/modfying _specific_ files. 😉

For that matter, there's very few files that should need modifying or overwriting when installing a
program, unless you're running Windows...but then there's no sudo. 😉

Quoted message said:

Anyway, make allows you to run arbitrary commands, such as a new shell, as I pointed out in another
post. The system is completely open to users who can run make as root.

I see; once make is run as root, it can do whatever it wants regardless of what limits sudo has.

Okay, here's another possible way to avoid having to login as root to install a program: setup a
user who can only install programs, and is unable to modify important files? Maybe?

Aw hell. This is getting too complicated. On my next system, I'll just login as root to install
stuff, and hope that I don't forget that I'm root. I'll use a nice, elaborate prompt that I had
setup only for the user, and the standard, boring prompt for root...or maybe a flashing red
warning prompt...
--
Rick Onanian

Rick Onanian said:

Okay, here's another possible way to avoid having to login as root to install a program: setup a
user who can only install programs, and is unable to modify important files? Maybe?

I don't think so. User restrictions are kind of limited. Once a "maintenance" user gets access to
/usr/ so that it can install programs, it pretty much is equivalent to root. Heck, if this user can
install a new kernel....

Quoted message said:

Aw hell. This is getting too complicated. On my next system, I'll just login as root to install
stuff, and hope that I don't forget that I'm root.

Every time you run a command as root, stop and think first. Good advice, never listened to.

--

David L. Johnson

__o | Let's not escape into mathematics. Let's stay with reality. -- _`\(,_ | Michael Crichton
(_)/ (_) |

Quoted message said:

Benjamin Lewis <[email hidden]> wrote:
: What does it pay if you're a bad girl?

David Reuteler said:

i wish to god there were some.

They're all here in Madison

--
Andrew Muzi www.yellowjersey.org Open every day since 1 April, 1971

Rick Onanian <[email hidden]> scribed in <[email hidden]>:

Quoted message said:

Hugh Fenton said:

Quoted message said:

apart from the vuris vulnerabilities of OE, my biggest complaint against it is that it
autoharvest email addresses. as soon as you

Quoted message said:

Tools, Options, Send and click the little box and the problem is gone

It's too bad that most people will never go out of their way to do that; it's because of a
combination of a bad default setting and lazy users that worms spread so easily.

exactly my point very few turn it off, but it should have been off by default.

swarf, steam and wind

--
David Forsyth -:- the email address is real /"\ terrapin.ru.ac.zawelcome.htmlOpen ↗ \
/ ASCII Ribbon campaign against HTML E-Mail > - - - - - - -> X If you receive email saying
"Send this to everyone you know," / \ PLEASE pretend you don't know me.