Date: Thu, 27 Aug 2015 16:27:06 +0300 From: Peter Pentchev <roam@ringlet.net> To: Borja Marcos <borjam@sarenet.es> Cc: Mike Tancsa <mike@sentex.net>, Dag-Erling =?utf-8?B?U23DuHJncmF2?= <des@des.no>, freebsd-security@freebsd.org Subject: Re: FreeBSD Security Advisory FreeBSD-SA-15:22.openssh Message-ID: <20150827132706.GB4751@straylight.m.ringlet.net> In-Reply-To: <EF0C7D98-5561-47DB-9AAB-1046C6638F7C@sarenet.es> References: <20150825212749.C154016C9@freefall.freebsd.org> <55DE0E74.4040000@sentex.net> <86h9nlqjmn.fsf@nine.des.no> <55DF0BBD.1080206@sentex.net> <EF0C7D98-5561-47DB-9AAB-1046C6638F7C@sarenet.es>
next in thread | previous in thread | raw e-mail | index | archive | help
--MW5yreqqjyrRcusr Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Aug 27, 2015 at 03:19:04PM +0200, Borja Marcos wrote: >=20 > On Aug 27, 2015, at 3:08 PM, Mike Tancsa wrote: >=20 > > On 8/27/2015 3:24 AM, Dag-Erling Sm=C3=B8rgrav wrote: > > For the latter two, I am trying to understand in the context of a shared > > hosting system. Could one user with sftp access to their own directory > > use these bugs to gain access to another user's account ? >=20 > Straghtforward Unix permissions aren't really suited to such an applicati= on. You need everything to be > world readable by an unprivileged WWW server.=20 >=20 > In such a setup we were successful by using a combination of mac/biba for= integrity, ugidfw for > effective user separation, and removing all the setuid permissions from t= he system. >=20 > Otherwise, a non-chrooted hosting user will have at least read only acces= s to the neighbors. Hmm, this doesn't necessarily need to be true. When I set up a shared hosting system some years ago, we put all the users in a single primary group, then all their home directories had u+rwx,g-a,o+x Unix access permissions. It seemed to work for keeping them out of each other's homes and for letting both the webserver and the SSH server peek inside. Of course, this would still allow somebody to explicitly modify the access permissions of her own home directory, but, first off, I don't think there ever was such a case, and we also had a periodic check for this as well as some other silly things that people always manage to do (and, yes, "people" here does include myself, too). G'luck, Peter --=20 Peter Pentchev roam@ringlet.net roam@FreeBSD.org pp@storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13 --MW5yreqqjyrRcusr Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJV3xAqAAoJEGUe77AlJ98TQncP/i9bSDiqWvpCeX0673LYAPe/ c5pOTy/szWtfvVxbyineXout5hpxhkORvmtr7INukNOQMCDYFdZRcvb/IO4Ra7SL 8M3lUn0NAam6unXqqCCkps0E03JYGWR5f+4i+7S/o03IWeKeaAL66z8anGvbsOCa UPhnPtb0V3JdFWxnezRGv3TkibUpO9nkpbf9Syeu+zvHuSnKVTaQwBozQSXmvKUx pXwmLdkFrrp8LWkIoTl9cegdcUDkVYhyoSb0N03eXrGDTbAE5sLsCOt8uMQ/goVu vslTHfh6PTGOkycuVjPVfI6a1eKA4v9Wns9fuoVqyRmvse9IfkhwwGKfPiS9juoA B66r3dPTuELo/tvUSac4h8O00HRR3SBuiJ8CVl1duAvgeor0L+Di2cIacYaySC/g plbhprZNy+YsS6sdSdnnCuWeMVy4lj9Q111o0oxSbX2Cc0XXyHmLfrPjPykj3ai3 7lYS/d1ORtwsY+33vyXhDtiWL6WsOv3fYRUEDDTB6oSMDijqXv4GMlO7M3aP9E53 B5wUaXUR8PZ1NDQ6IQsIsDGTsvS2MvgkwhoayOnAcoJOFKAnlGkK3Pp93/8liGgV pV//WlilmKL9xb/xl+cnQab6cbJaoRhE4tcCgqHQrtCcN1YZSkNjiZYtqe8OH5zV jvY67NKzWPejAGlAnwuj =6Ufg -----END PGP SIGNATURE----- --MW5yreqqjyrRcusr--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150827132706.GB4751>