Re: [Security-Discuss] Mount issues in LE2005-Club - Security Issue

After receiving multiple complaints about my report.  I am Confirming 
the fact that Mount is Broken on LE2005.  Thank you for you wonderful 
support.

Now that we have all taken this as a Newbie Report from a 20 year 
veteran, can we please fix this problem?

Antonio Galea wrote:

>On Sun, Aug 28, 2005 at 11:04:24AM -0400, Albert Whale wrote:
>  
>
>>>Have you actually tested if the partition is really mounted with the
>>>exec option then? In my experience, the mount command does not seem to
>>>always show the used mount options (e.g. I remember having seen this
>>>already with uid and gid options for smbfs mounts, on another distro,
>>>even though they are correctly working).
>>>
>>>
>>>      
>>>
>>Wow, You're kidding me?
>>
>>    
>>
>
>No, he's not: he's SUGGESTING you to actually TEST the thing: a brilliant
>idea, btw. 
>
>  
>
>>I did prove that the reported FS Mounting is insecure.
>>    
>>
>
>Sorry to contradict you, but you did not mention any proof.
>
>  
>
>>How's this for additional proof
>>
>>more /proc/filesystems
>>...
>>You'll notice that /tmp is not one of these listed.
>>
>>    
>>
>
>Well, if you look closely you'll also notice that no partition is mentioned
>at all :)
>
>This 'proof' has no relation whatsoever with your problem: you are showing us
>the list of filesystem supported by your kernel.
>
>  
>
>>But seriously, if the mount command fails to use the mount options, and 
>>then fails to report the options, then what would you say would be a 
>>valid test of the mounted filesystem?  An infected (or hacked) server?
>>
>>    
>>
>
>Pardon me if I repeat the concept once more: up to now, you only know that
>mount fails to REPORT the options, not that it fails to APPLY them... before
>whining, please do check!
>
>I would assume that if you are tightening the security of your server with a
>'noexec' option on /tmp you should know what a valid test might be: if you do
>not, you will have a hell of a hard time if a hacker ever finds you out :-)
>
>A suggestion: try what happens with 'cp /bin/bash /tmp; /tmp/bash'...
>
>Cheers,
>
>Ant9000
>
>PS: don't want to patronize you, but you should definitely lookup 'newbie'
>    and 'troll' on your preferred jargon file... your response makes you look
>    like a good candidate for both. Next time think before rushing to the
>    keyboard, please.
>
>
>  
>


-- 
Albert E. Whale, CHS CISA CISSP
Sr. Security, Network, Risk Assessment and Systems Consultant
-------------------------------------------------------------------
ABS Computer Technology, Inc. - www.ABS-CompTech.com
SPAM Zapper - No-JunkMail.com - Spam-Zapper.com - SPAM Stops Here.
President of the Pittsburgh InfraGard Alliance

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________