Great Circle Associates Majordomo-Users
(July 1995)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Security question
From: dwolfe @ risc . sps . mot . com (Dave Wolfe)
Date: Mon, 31 Jul 1995 12:43:21 -0500 (CDT)
To: uunet!delec.fi.uba.ar!averri (Alejandro Daniel Verri)
Cc: majordomo-users @ greatcircle . com (Majordomo user's mailing list)
Reply-to: David Wolfe <david_wolfe @ risc . sps . mot . com>

[ Alejandro Daniel Verri writes: ]
> I have a problem with my system administrator. We have the wrapper
> like this:
> -rwsrwxr-x root Majordom    wrapper*
> 
> and The administrator don't want this, because, say, it's not secure
> for the system. It's true? Can a hacker, copy a shell to the majordomo
> directory an execute like root? I don't know answer him, because, i'm
> not a unix guru. Is there any response for him?

First, remove all write permissions from wrapper. Then change the group
ownership to something compatible with sendmail (or whatever MTA runs
wrapper) so you can remove all 'other' permissions. You should end up
with something like this:

-r-sr-x--- root daemon    wrapper*

You probably don't need the read permissions either, but they shouldn't
hurt. Make sure the directory wrapper lives in can be searched by
sendmail as well, preferably through group ownership so that all the
'other' permissions can be removed, e.g.:

dr-xr-x--- Majordom daemon  Majordomo-1.93

Wrapper is reasonably safe from what the attack you describe because
it immediately changes the real and effective uid and gid to majordom/
majordom (or whatever you configured it to when you built it). Even in
the scenario you described, all the hacker would have is a shell running
as majordom, *not* root. He could savage your mailing lists but not much
else.

-- 
 Dave Wolfe    *Not a spokesman for Motorola*  (512) 891-3246
 Motorola MMTG  6501 Wm. Cannon Dr. W. OE112  Austin  TX  78735-8598

Indexed By Date Previous: No Archives!
From: majordomo <majordom@lumen>
Next: What is this BOUNCE: Admin Request?
From: Rudy Amid <rudy@hcl.com>
Indexed By Thread Previous: Security question
From: Alejandro Daniel Verri <averri@delec.fi.uba.ar>
Next: Security question (fwd)
From: Alejandro Daniel Verri <averri@delec.fi.uba.ar>

Google
 
Search Internet Search www.greatcircle.com