Re: Unable to su on firewall
Matt Collins <[email protected]>
| Newsgroups | gmane.comp.security.sun |
|---|---|
| Message-ID | <[email protected]> |
On Wed, Apr 16, 2003 at 06:55:45PM +0200, Daniel Bergman wrote:
> Hi,
>
> I'm having huge problems switching user, using su utility, to a user named 'daniel' on my Solaris 8 x86 server.
> I've attached the full output of truss - but here's the lines that's really bugging me:
While not directly related to your query, given this is a security based list....
Change daniel's password as you've included the crypt string and never set folks home
dirs to /tmp - its a world writable directory and to compromise your machine its just
a matter of getting a substitute .profile, .login, .forward, etc in there. Once a file
that will be executed on system events (receipt of mail, login, etc) is created its
just a matter of time before it gets executed. This allows any access to the firewall,
even 'nobody' or other production 'unprivileged' accounts to start executing with
user privs.
If you already knew all that, sorry ;) Dont suppose it hurts to reiterate though.
As for the chdir... what are the permissions on "/", the root directory?
> 739: setuid(3333) = 0
> 739: chdir("/tmp") Err#13 EACCES <-- Really strange, see below for /tmp listing.
> No directory!
> 739: write(2, " N o d i r e c t o r y".., 14) = 14
> 739: mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANON, -1, 0) = 0xDFA50000
> 739: munmap(0xDFA50000, 4096) = 0
> 739: llseek(0, 0, SEEK_CUR) = 36065
> 739: _exit(1)
>
Matt