11:30 p.m.
Hi,
What is the sudoers entry created to allow localuser to cat /etc/shadow)
Thanks
11:35 p.m.
Sorry for the HTML...
This seems off topic. This is list for questions surrounding the linux
audit subsystem.
That file is usually user=root group=root mode=0644. Ie read only for all,
writeable for user root. No sudoers entry needed for read access.
On Sun, Sep 23, 2018, 21:30 khalid fahad <kfgm2001(a)gmail.com> wrote:
Hi,
What is the sudoers entry created to allow localuser to cat /etc/shadow)
Thanks
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
2:50 a.m.
All systems I know disallow reading of /etc/shadow for others or even
group (for good reasons). Hence sudo would be required.
frank
On 09/24/2018 06:35 AM, William Roberts wrote:
Sorry for the HTML...
This seems off topic. This is list for questions surrounding the linux
audit subsystem.
That file is usually user=root group=root mode=0644. Ie read only for
all, writeable for user root. No sudoers entry needed for read access.
On Sun, Sep 23, 2018, 21:30 khalid fahad <kfgm2001(a)gmail.com
<mailto:kfgm2001@gmail.com>> wrote:
Hi,
What is the sudoers entry created to allow localuser to cat
/etc/shadow)
Thanks
--
Linux-audit mailing list
Linux-audit(a)redhat.com <mailto:Linux-audit@redhat.com>
https://www.redhat.com/mailman/listinfo/linux-audit
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
1:40 p.m.
If you expect to pass any kind of security audit, the perms on
/etc/shadow must be 0600. Since it contains the actual password hashes
no one can read it except root to prevent bad puppies from getting the
hashes so they can reverse the hash by brute force on some other host.
On 9/24/2018 3:50 AM, Frank Thommen wrote:
All systems I know disallow reading of /etc/shadow for others or even
group (for good reasons). Hence sudo would be required.
frank
On 09/24/2018 06:35 AM, William Roberts wrote:
> Sorry for the HTML...
>
> This seems off topic. This is list for questions surrounding the linux
> audit subsystem.
>
> That file is usually user=root group=root mode=0644. Ie read only for
> all, writeable for user root. No sudoers entry needed for read access.
>
> On Sun, Sep 23, 2018, 21:30 khalid fahad <kfgm2001(a)gmail.com
> <mailto:kfgm2001@gmail.com>> wrote:
>
> Hi,
> What is the sudoers entry created to allow localuser to cat
> /etc/shadow)
> Thanks
>
> --
> Linux-audit mailing list
> Linux-audit(a)redhat.com <mailto:Linux-audit@redhat.com>
> https://www.redhat.com/mailman/listinfo/linux-audit
>
>
>
> --
> Linux-audit mailing list
> Linux-audit(a)redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
1:58 p.m.
On Mon, Sep 24, 2018 at 11:40 AM Ed Christiansen MS <edwardc(a)ll.mit.edu>
wrote:
If you expect to pass any kind of security audit, the perms on
/etc/shadow must be 0600. Since it contains the actual password hashes
no one can read it except root to prevent bad puppies from getting the
hashes so they can reverse the hash by brute force on some other host.
Before everyone gathers the villagers, pitchforks and torches, I made a
mistake.
I crossed passwd with shadow in my response.
With that said, I was going to let it die with Frank's response, but I can
see folks
will keep at it. Just let it die. It's an off topic question related with
how linux permissions
work not with the audit subsystem.
On 9/24/2018 3:50 AM, Frank Thommen wrote:
> All systems I know disallow reading of /etc/shadow for others or even
> group (for good reasons). Hence sudo would be required.
>
> frank
>
>
> On 09/24/2018 06:35 AM, William Roberts wrote:
>> Sorry for the HTML...
>>
>> This seems off topic. This is list for questions surrounding the linux
>> audit subsystem.
>>
>> That file is usually user=root group=root mode=0644. Ie read only for
>> all, writeable for user root. No sudoers entry needed for read access.
>>
>> On Sun, Sep 23, 2018, 21:30 khalid fahad <kfgm2001(a)gmail.com
>> <mailto:kfgm2001@gmail.com>> wrote:
>>
>> Hi,
>> What is the sudoers entry created to allow localuser to cat
>> /etc/shadow)
>> Thanks
>>
>> --
>> Linux-audit mailing list
>> Linux-audit(a)redhat.com <mailto:Linux-audit@redhat.com>
>> https://www.redhat.com/mailman/listinfo/linux-audit
>>
>>
>>
>> --
>> Linux-audit mailing list
>> Linux-audit(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/linux-audit
>>
>
> --
> Linux-audit mailing list
> Linux-audit(a)redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
9:54 a.m.
The best way I can think of to let it die off would be to specifically
answer the OP's question (even though we've established that it's a Very
Bad Idea)
Add the following line to /etc/sudoers (using visudo of course):
(assuming the intended user is "localuser" as implied by the language in
OP, and 'which cat' returns '/usr/bin/cat')
localuser ALL:/usr/bin/cat /etc/shadow
On Mon, Sep 24, 2018 at 2:58 PM William Roberts <bill.c.roberts(a)gmail.com>
wrote:
With that said, I was going to let it die with Frank's response,
but I can
see folks
will keep at it. Just let it die. It's an off topic question related with
how linux permissions
work not with the audit subsystem.
2279
days inactive
2280
days old
linux-audit@lists.linux-audit.osci.io
5 comments
5 participants
participants (5)
-
Ed Christiansen MS -
Frank Thommen -
khalid fahad -
Stephen Buchanan -
William Roberts