On Thu, 4 Dec 2003 03:51:42 -0500 (EST) Todd Burroughs <[EMAIL PROTECTED]> wrote:
> Several exploits rely on being able to create suid programs or > to execute these programs (maybe installed by an old patch, etc.) > > I have an idea to reduce this problem. Basically, you mount > everything"nosuid", except for one filesystem. This filesystem is > obviously only writeable by root, it gets rid of the linking problem > discussed last week. > > I make a small partition and mount everything else "nosuid". I put > anything that needs suid or sgid on that filesystem and make symlinks > to where it should be. This makes is easy to find SUID programs, > run mount and make sure things are mounted nosuid, then look at your > "suid partition". I started to use a method like this some time ago, on my freebsd servers i just have 'su' left as suid on a separate partition, everything else mounted nosuid. Since now, i have discovered no problems with my services, but i would not say i have tested it 100% (so something may be broken due to this modification, if anyone knows what could, please drop me a note). > So, does this make sense? It seems to make it easier and more > controlled when you patch or add suid binaries. I would love to see > us start to use something like this on *NIX systems. I asked some ppl the same question, answers vary. On one hand some ppl trust the suids and claim that messing up with them will open new problems and that there are also many other ways to get root (kernel, libc, daemons,...) on the other hand ppl agreed with me that if i don't need uucp, why should it be on my box anyway (and that suid or sgid). As said, i disabled all suids except 'su', so a user can't use 'netstat', 'ping' or even 'man' anymore, but i do not want that on a bastion host anyway, eh? Mounting whats left on a separate partition seems to be as logical as doing that for /home, /tmp,... I would like to see a detailed discussion about this, too. kind regards -gt -- Gino Thomas | mailto: [EMAIL PROTECTED] | http://nux-acid.org GPG: E6EA9145 | 4578 F871 893E 1FEC 31FC 5B5E 8A46 4CC8 E6EA 9145 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
