Path: csiph.com!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!newsfeed.xs4all.nl!newsfeed3.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
MIME-Version: 1.0
In-Reply-To: <83de920f-dea8-49ad-9f6e-e25d3b2d8446@googlegroups.com>
References: <20a49aac-3867-481f-96d4-c95a050781ed@googlegroups.com> <CAMw+j7J=ibDTi9c9dxjx_=zuoecFxLawP2KmGjbhBztEC1nWZA@mail.gmail.com> <CAPTjJmrZH1qC=X+LNenXyReNjQT4FmVTKqL24H0D0An0XK9kAg@mail.gmail.com> <mailman.2656.1370359764.3114.python-list@python.org> <592c84d8-2e86-4480-b784-c3ccadc8360d@googlegroups.com> <mailman.2666.1370365761.3114.python-list@python.org> <06fd6c2e-0979-4d61-b75a-6d9df7c1b624@googlegroups.com> <mailman.2688.1370383955.3114.python-list@python.org> <70390d65-5313-46bf-8110-b25f5fc9f76f@googlegroups.com> <mailman.2706.1370419798.3114.python-list@python.org> <8d52505a-7252-419b-8b4f-61e5ee56a78a@googlegroups.com> <mailman.2707.1370421723.3114.python-list@python.org> <2aef9194-ef36-45db-8c77-9510d3f14ebe@googlegroups.com> <mailman.2710.1370423500.3114.python-list@python.org> <c49345c2-7dd8-4b59-9f5c-c4e7ce7a3ea0@googlegroups.com> <mailman.2721.1370428837.3114.python-list@python.org> <8df8a9df-dbb9-4f35-a6a3-b45aa32a848b@googlegroups.com> <mailman.2722.1370430879.3114.python-list@python.org> <1496e27c-7870-48d2-afb0-1bf626e24b5f@googlegroups.com> <mailman.2743.1370450038.3114.python-list@python.org> <83de920f-dea8-49ad-9f6e-e25d3b2d8446@googlegroups.com>
Date: Thu, 6 Jun 2013 03:16:46 +1000
Subject: Re: Apache and suexec issue that wont let me run my python script
From: Chris Angelico <rosuav@gmail.com>
To: python-list@python.org
Content-Type: text/plain; charset=ISO-8859-7
Content-Transfer-Encoding: quoted-printable
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.2748.1370452608.3114.python-list@python.org>
Lines: 44
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:47116

On Thu, Jun 6, 2013 at 3:02 AM, =CD=E9=EA=FC=EB=E1=EF=F2 =CA=EF=FD=F1=E1=F2=
 <nikos.gr33k@gmail.com> wrote:
> =D4=E7 =D4=E5=F4=DC=F1=F4=E7, 5 =C9=EF=F5=ED=DF=EF=F5 2013 7:33:50 =EC.=
=EC. UTC+3, =EF =F7=F1=DE=F3=F4=E7=F2 Chris Angelico =DD=E3=F1=E1=F8=E5:
>> In fact, I didn't even bother fiddling with syslog. All I did was
>> .bash_history. Of course, I wasn't worried about you getting my IP
>> addresses (one of them is public anyway, and the other isn't mine any
>> longer than I'm using it), and nothing I did there was sufficiently
>> serious to be worth hiding, but I just did the history so I could
>> point out how easy this is.
>
> So, by executing .bash_history commands issued are cleared. okey.
> What abiut 'syslog' that Heiko mentioned. Since you didnt fiddle with sys=
log can the latter show me what commands have been executed, files opened, =
commands given, services started-stopped etc?

Poke around in /var/log - I didn't tamper with anything there, so you
may well find log entries. But I don't know for sure what I did and
what I didn't do.

>> and nothing I did there was sufficiently serious to be worth hiding.
>
> Actually i believ you, because if you had malice in mind you could 'rm -r=
f /' or deface frontpages which you didnt do.
>
> But is there a way for me to see what commands have been issued? syslog p=
erhaps as ia sk above?
> Since you didn't hurm the system why the need of wipe clean bash's histor=
y?

There won't be a full list of all commands, but you may find some
hints. And why wipe it? Just to show how easily it could be done.
Imagine if I'd:

1) Created a new user, with a home directory of /etc
2) Made a setuid root binary that gives me a shell
3) Removed all logfile traces of having done so

I could then *retain full access* even after you change the root
password. And you would not know what I'd done, if I do the logfile
wipes correctly. You might see some hint (eg that logs were rotated
prematurely), but it'd be extremely hard to figure out what I did.

ChrisA