Date: Wed, 27 Mar 2002 09:24:33 -0500 From: Bill Vermillion <bv@wjv.com> To: Andrew Kenneth Milton <akm@theinternet.com.au> Cc: security@FreeBSD.ORG Subject: Re: Question on su / possible hole Message-ID: <20020327142432.GB30556@wjv.com> In-Reply-To: <20020328000329.E40004@zeus.theinternet.com.au> References: <20020327140006.GA30556@wjv.com> <20020328000329.E40004@zeus.theinternet.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Mar 28, 2002 at 12:03:29AM +1000, Andrew Kenneth Milton thus spoke: > +-------[ Bill Vermillion ]---------------------- > | > | However I have found that if non-wheel-group user can su to a > | user who has wheel privledges - the the non-wheel user can su to > | root. > So they can simply login as the user with wheel access and circumvent > any further checking anyway. They'd need the password after all. Not if you make sure that the user with the wheel access is coming from a designated place - eg a particular link - an assigned static IP for example. IOW besides knowing who the user is and their password, you also know WHERE they. They do need the password of course. But if you expand the wheel concept to the point that you can only become root if you are a named user in this group - IOW a trusted user - then the system would be more secure. It strikes me as strange because at first glance a person would think that only people were are in the wheel group could become root. I never knew that you could bypass this until I was just experimenting the other day. The man pages on su says "Only users who are members of group 0 can su to root" It does say this about the environment USER "The user ID is always the effective ID ..." But BSD doesn't retain the real ID as in SysV. [I'm not a fan of SysV so don't get me wrong] It just strike me as wrong. -- Bill Vermillion - bv @ wjv . com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020327142432.GB30556>