51–60 of 74 posts
From the FreeBSD man for date Only the superuser may set the date, and if the system securelevel (see securelevel(7)) is greater than 1, the time may not be changed by more than 1 second. EDIT: so you need to be root anyway or have root access to change the date.
http://packages.debian.org/changelogs/pool/main/s/sudo/sudo_...
I wonder if it would be possible to walk back the date using an ntp mitm attack.
From the FreeBSD man for date Only the superuser may set the date, and if the system securelevel (see securelevel(7)) is greater than 1, the time may not be changed by more than 1 second. EDIT: so you need to be root anyway or have root access to change the date.
Would this work with an LD_PRELOAD of libfaketime?
env_reset
If set, sudo will run the command in a minimal
environment containing the TERM, PATH, HOME, MAIL,
SHELL, LOGNAME, USER, USERNAME and SUDO_* variables.
Any variables in the caller's environment that match
the env_keep and env_check lists are then added,
followed by any variables present in the file specified
by the env_file option (if any). The default contents
of the env_keep and env_check lists are displayed when
sudo is run by root with the -V option. If the
secure_path option is set, its value will be used for
the PATH environment variable. This flag is on by
default.
Also, you can not use LD_PRELOAD on sudo itself, as it is disabled for setuid binaries.
From the FreeBSD man for date Only the superuser may set the date, and if the system securelevel (see securelevel(7)) is greater than 1, the time may not be changed by more than 1 second. EDIT: so you need to be root anyway or have root access to change the date.
Users on MacOS can change the time without root access.
Earlier quoted context omitted.
How are they going to change the date without having a path to superuser access already?
They could potentially spoof the machine's NTP server.
Earlier quoted context omitted.
How are they going to change the date without having a path to superuser access already?
They could potentially spoof the machine's NTP server.
You'd also have to do this when the NTP daemon first starts up, as:
-g Normally, ntpd exits with a message to the system log if the offset exceeds the panic
threshold, which is 1000 s by default. This option allows the time to be set to any value
without restriction; however, this can happen only once. If the threshold is exceeded after
that, ntpd will exit with a message to the system log. This option can be used with the -q
and -x options. See the tinker command for other options.I wonder if it would be possible to walk back the date using an ntp mitm attack.
-g Normally, ntpd exits with a message to the system log if the offset exceeds the panic
threshold, which is 1000 s by default. This option allows the time to be set to any value
without restriction; however, this can happen only once. If the threshold is exceeded after
that, ntpd will exit with a message to the system log. This option can be used with the -q
and -x options. See the tinker command for other options.