Package: sudo-ldap
Severity: minor
Currently sudo-ldap uses /etc/ldap/ldap.conf to contact the LDAP
server. Since this file is used by many other LDAP programs, you
can't really lock it down. As a consequence this means that anyone
can see the sudo entries in LDAP.
Whilst not a security hole per-se, I'd rather keep this information
confidential (after all, /etc/sudoers is 0660, not 0664).
I'd suggest using /etc/ldap/sudo-ldap.conf and creating this as a
symlink pointing to ldap.conf.
Patch attached
Adrian
diff -Naur a/sudo-1.6.8p12/debian/rules sudo-1.6.8p12/debian/rules
--- a/sudo-1.6.8p12/debian/rules 2007-06-27 14:13:25.000000000 +0100
+++ sudo-1.6.8p12/debian/rules 2007-06-27 14:06:54.000000000 +0100
@@ -24,6 +24,7 @@
--disable-root-mailer --disable-setresuid \
--with-sendmail=/usr/sbin/sendmail \
--mandir=/usr/share/man --libexecdir=/usr/lib/sudo \
+ --with-ldap-conf-file=/etc/ldap/sudo-ldap.conf \
--with-secure-path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin"
# LDAP version
diff -Naur a/sudo-1.6.8p12/debian/sudo-ldap.postinst sudo-1.6.8p12/debian/sudo-ldap.postinst
--- a/sudo-1.6.8p12/debian/sudo-ldap.postinst 2007-06-27 14:13:25.000000000 +0100
+++ sudo-1.6.8p12/debian/sudo-ldap.postinst 2007-06-27 14:12:09.000000000 +0100
@@ -28,6 +28,11 @@
system ('chown root:root /etc/sudoers');
system ('chmod 440 /etc/sudoers');
+# create symlink from new filename if required
+if (! -e "/etc/ldap/sudo-ldap.conf") {
+ system("ln -s ldap.conf /etc/ldap/sudo-ldap,conf");
+}
+
# must do a remove first to un-do the "bad" links created by previous version
system ('update-rc.d -f sudo remove >/dev/null 2>&1');
diff -Naur a/sudo-1.6.8p12/debian/sudo-ldap.postrm sudo-1.6.8p12/debian/sudo-ldap.postrm
--- a/sudo-1.6.8p12/debian/sudo-ldap.postrm 2007-06-27 14:13:25.000000000 +0100
+++ sudo-1.6.8p12/debian/sudo-ldap.postrm 2007-06-27 14:07:36.000000000 +0100
@@ -4,7 +4,7 @@
case "$1" in
purge)
- rm -f /etc/sudoers
+ rm -f /etc/sudoers /etc/ldap/sudo-ldap.conf
;;
remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
