Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

root with a single command: sudo logrotate

joshua.hu

Post reply on HN
Print view View original

11–20 of 51 posts

Re: root with a single command: sudo logrotate

#11

Post by dale_glass »

That seems contrived and kind of stupid?

Why would a random user account have access to `sudo logrotate`? logrotate is presumably for rotating logs, and the only need for root is to rotate system logs. So under what circumstances does it make sense for a random, otherwise unprivileged user to have ability to rotate system logs, but not the ability to do other administrative tasks?

It's also a tool that operates on random user-specified files, so makes for an absolutely terrible choice of command to let an unprivileged user to run.

I suppose the intent here is showing how a supposedly restricted sudo ability can be exploited into something bigger. That is a good point, but I think logrotate makes for a weird example of it.

Also, use journald and just have it deal with that. If there's a need to deal with log rotation by hand something isn't setup quite right.

Re: root with a single command: sudo logrotate

#12

Post by Guvante »

Jenk wrote: post #4
cornholio wrote: post #2

If you can sudo, you already have root, albeit limited. It's more of an ergonomic feature to discourage users logging in as root and destroying the system, than any kind of reliable security compartmentalization. Realistically speaking, most applications you would want to allow others to run as sudo were never designed to withstand such attacks and will likely fail in the hands of a competent attacker that is free to…

> If you can sudo, you already have root, albeit limited. It's more of an ergonomic feature to discourage users logging in as root and destroying the system, than any kind of reliable security compartmentalization. I figured it was so you can identify the user who ran the command in an audit, instead of everyone just appear as "root"

Most use it like that the post uses a limited form where only certain commands can be ran.

Re: root with a single command: sudo logrotate

#13

Post by LinuxBender »

Jenk wrote: post #4
cornholio wrote: post #2

If you can sudo, you already have root, albeit limited. It's more of an ergonomic feature to discourage users logging in as root and destroying the system, than any kind of reliable security compartmentalization. Realistically speaking, most applications you would want to allow others to run as sudo were never designed to withstand such attacks and will likely fail in the hands of a competent attacker that is free to…

> If you can sudo, you already have root, albeit limited. It's more of an ergonomic feature to discourage users logging in as root and destroying the system, than any kind of reliable security compartmentalization. I figured it was so you can identify the user who ran the command in an audit, instead of everyone just appear as "root"

I figured it was so you can identify the user who ran the command in an audit, instead of everyone just appear as "root"

This goal can still be performed if auditd is enabled. The transition from non-root to root is tracked with the right rules in place. In my opinion it is best to rely on auditd and immutable after being tested rules as there are many ways to elevate privileges and many ways to improperly configure or bypass sudo. Auditd has a plugin to log directly to syslog and/or forwarded to ELK, Splunk or other tools. Auditd is also important when applications are exploited and someone then uses a privilege escalation vulnerability otherwise the person will just run it again after the machine/VM/container is re-imaged. Sudo was never intended to be a security control as much as it was to give a non sysadmin the ability to restart something or launch an on-demand process that required root or other accounts despite people using it in their documented controls. Many people will disagree with me on this as has been the case since the inception of sudo.

One caveat being auditd with the most useful rules in place can get rather noisy and more to the point, costly in terms of storage and/or Splunk license. It comes down to the priorities of an organization or business.

Re: root with a single command: sudo logrotate

#15

Post by xorcist »

The example contains an asterisk in the allowed commands field. That's not something you would normally do with users who would not otherwise have root privileges. There are (figuratively) an unlimited number of ways to compose commands that do arbitrary things. Security audits explode in complexity.

Always list every literal command that is allowed. Make a command wrapper if necessary. (Also, never allow arbitrary environment variables.)

Re: root with a single command: sudo logrotate

#17

Post by orev »

Jenk wrote: post #4
cornholio wrote: post #2

If you can sudo, you already have root, albeit limited. It's more of an ergonomic feature to discourage users logging in as root and destroying the system, than any kind of reliable security compartmentalization. Realistically speaking, most applications you would want to allow others to run as sudo were never designed to withstand such attacks and will likely fail in the hands of a competent attacker that is free to…

> If you can sudo, you already have root, albeit limited. It's more of an ergonomic feature to discourage users logging in as root and destroying the system, than any kind of reliable security compartmentalization. I figured it was so you can identify the user who ran the command in an audit, instead of everyone just appear as "root"

One of the main benefits of sudo is that nobody needs to know the root password to switch to root (like one would need when using su). The actual root password can be saved in some break glass system, and admins only need to manage their own passwords.

Re: root with a single command: sudo logrotate

#18

Post by fullspectrumdev »

dale_glass wrote: post #11

That seems contrived and kind of stupid? Why would a random user account have access to `sudo logrotate`? logrotate is presumably for rotating logs, and the only need for root is to rotate system logs. So under what circumstances does it make sense for a random, otherwise unprivileged user to have ability to rotate system logs, but not the ability to do other administrative tasks? It's also a tool that operates on ra…

A lot of “appliances” make design choices like this - the web user has sudo access to a handful of commands so shit can be done from the webUI.

Which makes things like this useful for when you get code execution in the web interface and want to break root

Re: root with a single command: sudo logrotate

#19

Post by crtasm »

cornholio wrote: post #2

If you can sudo, you already have root, albeit limited. It's more of an ergonomic feature to discourage users logging in as root and destroying the system, than any kind of reliable security compartmentalization. Realistically speaking, most applications you would want to allow others to run as sudo were never designed to withstand such attacks and will likely fail in the hands of a competent attacker that is free to…

> the user cannot run anything other than sudo logrotate

Very limited!

Re: root with a single command: sudo logrotate

#20

Post by Jenk »

LinuxBender wrote: post #13
Jenk wrote: post #4

Earlier quoted context omitted.

> If you can sudo, you already have root, albeit limited. It's more of an ergonomic feature to discourage users logging in as root and destroying the system, than any kind of reliable security compartmentalization. I figured it was so you can identify the user who ran the command in an audit, instead of everyone just appear as "root"

I figured it was so you can identify the user who ran the command in an audit, instead of everyone just appear as "root" This goal can still be performed if auditd is enabled. The transition from non-root to root is tracked with the right rules in place. In my opinion it is best to rely on auditd and immutable after being tested rules as there are many ways to elevate privileges and many ways to improperly configure…

Yeah I meant more when folk `ssh root@host` over `su - root`

But I do recall it being a lot more pleasant tracing who ran what sequence of commands, on a host used by many people in concurrent workflows, when it's sudo over su.

It's also been some ~20 years since I've been in a role that required I do this so I (most probably) have forgotten a lot.

Post reply on HN