Collaborate Disseminate
Joe Vennix of Apple security has found another significant vulnerability in sudo utility that under a specific configuration could allow low privileged users or malicious programs to execute arbitrary commands with administrative (‘root’) privileges on… Continue reading Sudo Bug Lets Non-Privileged Linux and macOS Users Run Commands as Root
If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it?
The big question: what prevents using sudo instead of the setuid/setgid binaries?
“ping” would be enough for root, no? If a… Continue reading Why not use sudo instead of setuid/setgid?
sudo is sometimes used to give untrusted or “semi-trusted” users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/sudoers, specifying which… Continue reading How can one tell if a binary is safe to give sudo permissions for to an untrusted user?
About this question
sudo white list just program perl
I think I found possible solution using just sudo
have a program Perl and make executable chmod + x
in sudo whitelist that program and nothing else, I test it and work
because in… Continue reading Sudo parameterised all commands, is this secure? [closed]
In visudo Ubuntu I whitelist this program
myuser ALL=(root) NOPASSWD:/myuser/program.pl
when I run
sudo /myuser/program.pl
I get prompt to set password. The solution is to add to visudo /usr/bin/perl
myuser ALL=(root) NOPASSWD:/myu… Continue reading sudo whitelist just program perl
The bug allows users to bypass privilege restrictions to execute commands as root. Continue reading Sudo Bug Opens Root Access on Linux Systems
I want to create a secure system in which logging in to the system and using sudo requires using both password and a usb. Is there some way I can turn a regular usb into 2FA key? Can you explain the entire process?
I am usin… Continue reading How can I create a 2FA usb for using sudo? [migrated]
We take on one of #SysAdminDay’s thorny issues. Continue reading Sysadmins need to know – how DO you pronounce “sudo”?
I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run “sudo -l” command, I found out /usr/bin/vi set to (root) NOPASSWD.
(root) NOPASSWD: /usr/bin/vi /var/www/html/*
Then I … Continue reading Privilege Escalation TTY error while using sudo /usr/bin/vi command
The most straightforward way to install NodeJS on Ubuntu or Debian seems to be Nodesource, whose installation instructions say to run:
curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash –
This clashes with some basic security… Continue reading Is `curl {something} | sudo bash -` a reasonably safe installation method?