An intern with the keys to everything
A company gives its intern one small job: edit a settings file on the server. To save time, an administrator lets the intern use one editor with no password.
A year later a check says the intern could have become the top account, root, any day. The editor was the way.
The one rule
Warning
Look at this lab machine only. It is yours alone and reaches no one else. We find these mistakes so we can close them. Doing this to a machine that is not yours, without permission, is a crime under the Computer Misuse Act 1990.
By the end of this lesson
Note
I can explain how a small mistake gives away control.
Key words
| Word | What it means | Example |
|---|---|---|
| Root | the top account, which can do anything on the machine | |
| Privilege | the power an account has over the machine | |
| Least privilege | give each account only the power its job needs | |
| Setuid | a file setting: it runs as its owner, not as you | -rwsr-xr-x |
| Sudo rule | a line that says who may run what as root |
The cells students fill in are left blank in this preview.
Setuid runs a file as its owner
Most programs run with the rights of whoever starts them. A setuid program runs with the rights of its owner instead.
Some need it: the password tool must change a protected file. But a setuid program owned by root that was never meant to be is a way to become root.
Before you start
Note
Press Start the lab on the bar at the top. The lab is your own Ubuntu machine, so it takes a minute. Each Run below only reads the machine. None of them uses a weakness.
Find the setuid programs
find /usr/local/bin /usr/bin -perm -4000 -type fShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look at the first one
ls -l /usr/local/bin/sysfindShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: reading the s
| Mode | Meaning |
|---|---|
| -rwxr-xr-x | An ordinary program |
| -rwsr-xr-x | Setuid: it runs as its owner |
| -rwxr-sr-x | Setgid: it runs with its group |
The cells students fill in are left blank in this preview.
A sudo rule can be too wide
A sudo rule names a user, who they may act as, and which programs. NOPASSWD means no password is asked.
Naming one program sounds safe. It is not, if that program can start another one. Editors and some tools can open a shell, and a shell started inside sudo is a root shell.
What may intern run with sudo?
sudo -l -U internShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The rule itself
sudo cat /etc/sudoers.d/90-lab-internShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What those two Runs show
The first prints two lines, ending (root) NOPASSWD: /usr/bin/vim. So intern may run vim as root with no password.
The second prints the rule itself. vim can open a shell from inside itself, so this one rule hands over the whole machine.
A common mistake
Warning
Many people think a sudo rule for one program is narrow. It is only narrow if that program cannot run other programs. Before you allow one, ask: can it start a shell, or open another file as root?
Root trusts the script it runs
Root's timed jobs run a script often, as root. If anybody can edit that script, then anybody can make root run their commands.
The rule is simple. A file that root runs must be owned by root, and nobody else may write to it.
Find files anybody can write
find /opt -perm -o+w -type fShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Its mode, owner and name
stat -c "%a %U %n" /opt/maintenance/cleanup.shShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Does root run it?
sudo crontab -l -u rootShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The three mistakes and the fix
| Mistake | How to spot it | How to close it |
|---|---|---|
| A setuid copy of a tool | find with -perm -4000 | chmod u-s, or delete the copy |
| A wide sudo rule | sudo -l and the sudoers files | Name exact commands only |
| A root script anybody can edit | find with -perm -o+w | chmod 755 and owner root |
The cells students fill in are left blank in this preview.
Going further
Run find /opt /usr/local/bin /etc/cron.d -type f -perm /022. The /022 means the group or others may write.
For each line it prints, write three things: who may write to the file, who runs it, and the one command that closes the gap.