An intern with the keys to everything
A company gives its intern one small job: edit a settings file on the server. To save time, an administrator lets the intern use sudo for one editor, with no password.
A year later a report says that the intern could have become root any day. The editor was the way.
By the end of this lesson
Note
I can explain how a mistake lets a user become root and how to close it.
Key words
| Word | What it means | Example |
|---|---|---|
| Privilege | the power an account has over the machine | |
| Least privilege | give each account only the power its job needs | |
| Setuid | a file setting: it runs as its owner, whoever starts it | -rwsr-xr-x |
| Sudo rule | a line that says who may run what as root | |
| Audit | check a system against a list of known mistakes |
The cells students fill in are left blank in this preview.
The one rule
Warning
Look at this lab machine only. It is yours alone and cannot reach anyone else. Doing this to a machine that is not yours, without permission, is a crime under the Computer Misuse Act 1990.
Setuid runs a file as its owner
Most programs run with the rights of whoever starts them. A setuid program runs with the rights of its owner instead.
Some need it. passwd must change a protected file. But a setuid program owned by root that was never meant to be, is a way to be root.
Find the setuid programs
find /usr/local/bin /usr/bin -perm -4000 -type fShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look at the first one
ls -l /usr/local/bin/sysfindShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: reading the s
| Mode | Meaning |
|---|---|
| -rwxr-xr-x | An ordinary program |
| -rwsr-xr-x | Setuid: it runs as its owner |
| -rwxr-sr-x | Setgid: it runs with its group |
The cells students fill in are left blank in this preview.
A sudo rule can be too wide
A sudo rule names a user, who they may act as, and which programs. NOPASSWD means no password is asked.
Naming one program sounds safe. It is not, if that program can start another one. Editors, pagers and find can all start a shell. A shell started inside sudo is a root shell.
What may intern run with sudo?
sudo -l -U internShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The rule itself
sudo cat /etc/sudoers.d/90-lab-internShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: narrow and wide rules
| Rule | Risk | Better |
|---|---|---|
| ops ALL=(ALL) NOPASSWD: ALL | Root for anything, no password | Name the few commands needed |
| intern ALL=(root) NOPASSWD: /usr/bin/vim | vim can start a shell | Let sudoedit change one file |
| web ALL=(root) /usr/bin/systemctl restart shop | Narrow: one exact command | Keep as it is |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think a sudo rule for one program is narrow. It is only narrow if that program cannot run other programs. Before you allow one, ask: can it start a shell, or open another file as root?
Root trusts the script it runs
Root's cron runs a script every minute. If anybody can edit that script, then anybody can make root run their commands.
The rule is simple. A file that root runs must be owned by root, and nobody else may write to it. The folder it sits in matters too.
Find files anybody can write
find /opt -perm -o+w -type fShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The mode, owner and name
stat -c "%a %U %n" /opt/maintenance/cleanup.shShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Does root really run it?
sudo crontab -l -u rootShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The three mistakes and how to close them
| Mistake | How to spot it | How to close it |
|---|---|---|
| A setuid copy of a tool | find with -perm -4000 | chmod u-s, or delete the copy |
| A wide sudo rule | sudo -l and /etc/sudoers.d | Name exact commands, or use sudoedit |
| A script root runs that anybody can edit | find with -perm -o+w | chmod 755 and owner root |
The cells students fill in are left blank in this preview.
Do the lab, then close the gap
Tip
The lab asks you to use one of these mistakes on your own machine and write what you did. Do that first. Afterwards, write down in your report how you would close the gap, using the table above.
Going further
Run find /opt /usr/local/bin /etc/cron.d -type f -perm /022. The /022 means "the group or others may write".
For each line it prints, write three things in your report. Who may write to the file? Who runs it? Which one command closes the gap?