Re: scripting sudo's digest functions
Thomas Harrison <[email protected]>
| Newsgroups | gmane.comp.tools.sudo.user |
|---|---|
| Message-ID | <CALoM9ZNLCGM4=WUEvTfupd=2A87_pJa-gZce8VO5SBREfQP9Zw@mail.gmail.com> |
I'll definitely give it a shot! I used to play w tripwire a lot back in the day and even created my own cksum monitoring script. On Tue, Jun 25, 2019, 16:11 Thomas Harrison <[email protected]> wrote: > ML - I saw that chapter in your book but was concerned that patching could > cause issues if a binary changed. Great book btw! > > On Tue, Jun 25, 2019, 15:20 Michael W. Lucas <[email protected]> > wrote: > >> Hi, >> >> Sudo has a nifty digest-verification function, where it can check the >> cryptographic digest of a command before running it. >> >> At my last job I wrote a couple perl scripts to build >> platform-specific digest-checking sudoers files for all programs in >> system directories. I've cleaned them up some and added Linux >> support. They're not on github because once I do that other folks >> might find them, and I'm not convinced this is a good thing. But I'd >> like some feedback, so I'm posting here. >> >> Code is at http://www-old.michaelwlucas.com/sudo/ >> >> Usage: >> >> Set the directories you want to target at the top of $sudodigest.pl. >> >> # cd /etc/sudoers.d >> # sudodigest.pl > 00-digests >> # ids-sudoers.pl > 01-wheel >> # visudo -cf /etc/sudoers >> >> This creates platform-unique aliases for each command, and an >> EVERYTHING alias that includes all those aliases. There's also rules >> to let wheel and sudo groups run everything. But you can cut those out >> and do aliases like: >> >> Cmnd_Alias NOSHELL = EVERYTHING, !/bin/sh, !/bin/bash, !/bin/su >> %wheel ALL=NOSHELL >> >> EVERYTHING is an explicit list of programs in system directories, so >> it doesn't include user-created /tmp/sh. >> >> So: if you need sudo IDS, is this reasonable? >> >> ==ml >> >> >> -- >> Michael W. Lucas https://mwl.io/ >> author of: Absolute OpenBSD, SSH Mastery, git commit murder, >> Immortal Clay, PGP & GPG, Absolute FreeBSD, etc, etc, etc... >> ____________________________________________________________ >> sudo-users mailing list <[email protected]> >> For list information, options, or to unsubscribe, visit: >> https://www.sudo.ws/mailman/listinfo/sudo-users >> > ____________________________________________________________ sudo-users mailing list <[email protected]> For list information, options, or to unsubscribe, visit: https://www.sudo.ws/mailman/listinfo/sudo-users