Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #178187 > unrolled thread

Security hole in LXDE?

Back to article view | Back to linux.debian.user

Contents

  Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-27 10:30 +0100
    Re: Security hole in LXDE? Jonathan Dowland <jmtd@debian.org> - 2017-02-27 11:00 +0100
      Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-27 11:20 +0100
        Re: Security hole in LXDE? GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-02-27 16:40 +0100
        Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-03-02 11:50 +0100
          Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-02 12:40 +0100
            Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-03-02 13:20 +0100
              Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-02 14:20 +0100
                Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-03-02 14:40 +0100
                  Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-02 21:20 +0100
                Re: Security hole in LXDE? David Wright <deblis@lionunicorn.co.uk> - 2017-03-02 15:10 +0100
                  Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-02 21:40 +0100
        [SOLVED] Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-03-06 18:30 +0100
          Re: [SOLVED] Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-03-06 19:40 +0100
            Re: [SOLVED] Re: Security hole in LXDE? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-03-06 19:50 +0100
              Re: [SOLVED] Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-03-06 20:00 +0100
                Re: [SOLVED] Re: Security hole in LXDE? Brian <ad44@cityscape.co.uk> - 2017-03-06 20:40 +0100
                  Re: [SOLVED] Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-03-06 21:00 +0100
                    Re: [SOLVED] Re: Security hole in LXDE? Curt <curty@free.fr> - 2017-03-06 21:50 +0100
                      Re: [SOLVED] Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-03-06 22:00 +0100
                        Re: [SOLVED] Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-07 09:10 +0100
                    Re: [SOLVED] Re: Security hole in LXDE? Brian <ad44@cityscape.co.uk> - 2017-03-06 22:00 +0100
                      Re: [SOLVED] Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-07 09:10 +0100
                        Re: [SOLVED] Re: Security hole in LXDE? Brian <ad44@cityscape.co.uk> - 2017-03-07 13:10 +0100
              Re: [SOLVED] Re: Security hole in LXDE? GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-03-06 20:50 +0100
    Re: Security hole in LXDE? Davor Balder <davor@cropakglobal.com> - 2017-02-27 11:10 +0100
      Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-27 11:30 +0100
        Re: Security hole in LXDE? GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-02-27 12:20 +0100
          Re: Security hole in LXDE? David Wright <deblis@lionunicorn.co.uk> - 2017-02-27 23:00 +0100
            Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-28 11:10 +0100
              Re: Security hole in LXDE? David Wright <deblis@lionunicorn.co.uk> - 2017-02-28 18:50 +0100
            Re: Security hole in LXDE? GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-02-28 13:40 +0100
              Re: Security hole in LXDE? David Wright <deblis@lionunicorn.co.uk> - 2017-02-28 18:50 +0100
                Re: Security hole in LXDE? Lisi Reisz <lisi.reisz@gmail.com> - 2017-03-01 01:00 +0100
      Re: Security hole in LXDE? cbannister@slingshot.co.nz - 2017-03-25 07:20 +0100
    Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-02-27 12:10 +0100
      Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-27 12:30 +0100
        Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-02-27 12:50 +0100
        Re: Security hole in LXDE? Pontus Goffe <goffe.pontus@gmail.com> - 2017-02-27 15:50 +0100

Page 1 of 2  [1] 2  Next page →

#178187 — Security hole in LXDE?

Hi folks,

on my system /debian-amd64/testing) I can start Synaptic as a normal user, 
just by using the user password. In KDE this is not possible, there I need the 
root password.

I do not have sudo in use.

As I do not know, if this is a problem on my system (I have no second one to 
confirm this)., maybe please someone else could check this.

If I am correct, this is a security hole. If I am wrong, I have to recheck my 
system.

Thank you for your help.

Best

Hans

[toc] | [next] | [standalone]

#178189

[Multipart message — attachments visible in raw view] — view raw

On Mon, Feb 27, 2017 at 10:19:47AM +0100, Hans wrote:
> Hi folks,
> 
> on my system /debian-amd64/testing) I can start Synaptic as a normal user, 
> just by using the user password. In KDE this is not possible, there I need the 
> root password.
> 
> I do not have sudo in use.

What, exactly, do you do to start synaptic? Click on something, or run a command
in a terminal? What prompts you for a password? What version of synaptic do you
have installed?

-- 
Jonathan Dowland
Please do not CC me, I am subscribed to the list.

[toc] | [prev] | [next] | [standalone]

#178192

Hi,
I am just clickingin LXDE menu on the icon to start, then a popup menu opens 
and asks for my password (the user password NOT root) and I can install just 
as I am root.

Best

Hans
> 
> What, exactly, do you do to start synaptic? Click on something, or run a
> command in a terminal? What prompts you for a password? What version of
> synaptic do you have installed?

[toc] | [prev] | [next] | [standalone]

#178214

Hans:
> Hi,
> I am just clickingin LXDE menu on the icon to start, then a popup menu opens 
> and asks for my password (the user password NOT root) and I can install just 

But is that user a member in the sudo group?  I had to use root till I
added the user to the group

> Best
> 
> Hans
>>
>> What, exactly, do you do to start synaptic? Click on something, or run a
>> command in a terminal? What prompts you for a password? What version of
>> synaptic do you have installed?
> 
> 

-- 
 "The most violent element in society is ignorance" rEG

[toc] | [prev] | [next] | [standalone]

#178336

Checked my system again. 
It looks like have allowed the standard user to execute applications like 
synaptic with root rights. I know, this is going to be asked in KDE, when you 
start  a higher privileged application as a normal user. You can then decide 
(as root), if the user is allowed to start this application as normal user in 
the future.

I also found out, that the user is in group "sudo", but got no entry in /etc/
sudoers.

Also, synaptic starts as synaptic-psexec, what means, that when it is startd 
this way, it is started with root rights.

So, my question: How can I get this all back. A graphical solution is 
preferred, of course I knnow, I can edit /etc/groups and other things 
manually. But if there is a "clicky"-way, this will be preferred.

Thank you for any help and all the knowledge, you gave me.

Best regards

Hans

[toc] | [prev] | [next] | [standalone]

#178337

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Mar 02, 2017 at 11:40:10AM +0100, Hans wrote:
> Checked my system again. 
> It looks like have allowed the standard user to execute applications like 
> synaptic with root rights. I know, this is going to be asked in KDE, when you 
> start  a higher privileged application as a normal user. You can then decide 
> (as root), if the user is allowed to start this application as normal user in 
> the future.

Hm. I'm not sure I've got that one right. Who has allowed the standard
user to execute applications with root rights? How?

> I also found out, that the user is in group "sudo", but got no entry in /etc/
> sudoers.

Again: who "got no entry in /etc/sudoers"? The user in question? Or the
group "sudo"?

> Also, synaptic starts as synaptic-psexec, what means, that when it is startd 
> this way, it is started with root rights.

Seems so. I'm still confused: I don't know whether the desktop environment
is the one granting you root privileges (I can't help with that; I don't
"do" desktop environments) or whether it is sudo (or whether it is the
DE based on the sudo settings).

The sudo part is pretty easy to find out (no clickety way, sorry). Try,
in a shell those two things:

  sudo ls

  sudo synaptic

What happens in each case? Do you get a password prompt? Is synaptic
started in user mode or in root mode?

> So, my question: How can I get this all back. A graphical solution is 
> preferred, of course I knnow, I can edit /etc/groups and other things 
> manually. But if there is a "clicky"-way, this will be preferred.

Be careful when editing /etc/groups. There are things for that like
adduser and addgroup. To remove your user from group sudo:

  sudo deluser <username> sudo

Whether that helps or not depends on all of the above, of course :-)

But **first of all** you've got to get clear on what you want:

  - shall the regular user not be able to call synaptic in
    "root mode" _at all_?

  - yes, but only after entering root password?

  - yes, but only after entering her password?

regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAli4AsoACgkQBcgs9XrR2kahgwCfeciMgHKYB6jdF+5ab4K89Mzi
n/0AnjZupEhg+FAvDhnhS4cuyQJCdYSR
=qx8V
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#178338

Hi Tomas
> Hm. I'm not sure I've got that one right. Who has allowed the standard
> user to execute applications with root rights? How?
It was me, beeing haven asked by of the root password and (of course) gave the 
correct one, I allowed the user, to start applications with root rights 
(besides, I am the user and root, as i is my personal computer)
> 
> > I also found out, that the user is in group "sudo", but got no entry in
> > /etc/ sudoers.
> 
> Again: who "got no entry in /etc/sudoers"? The user in question? Or the
> group "sudo"?

It is the user, whom I allowed, to the above.

> > Seems so. I'm still confused: I don't know whether the desktop environment
> is the one granting you root privileges (I can't help with that; I don't
> "do" desktop environments) or whether it is sudo (or whether it is the
> DE based on the sudo settings).

No, no, the desktop just edits the settings, after a correct given root 
password, to start the special applications with root right sin future times.
> 
> The sudo part is pretty easy to find out (no clickety way, sorry). Try,
> in a shell those two things:
> 
>   sudo ls
> 

Gives the same als "ls".

>   sudo synaptic
sudo synaptic
sudo: Hostname protheus1 kann nicht aufgelöst werden
No protocol specified
Unable to init server: Verbindung ist gescheitert:Verbindungsaufbau abgelehnt

(synaptic:25373): Gtk-WARNING **: cannot open display: :0


> 
> What happens in each case? Do you get a password prompt? Is synaptic
> started in user mode or in root mode?
> 

No, as it is not root's environment, but the users one. However, su -p does 
the trick.
> > So, my question: How can I get this all back. A graphical solution is
> > preferred, of course I knnow, I can edit /etc/groups and other things
> > manually. But if there is a "clicky"-way, this will be preferred.
> 
> Be careful when editing /etc/groups. There are things for that like
> adduser and addgroup. To remove your user from group sudo:
> 
>   sudo deluser <username> sudo
> 
> Whether that helps or not depends on all of the above, of course :-)
> 
> But **first of all** you've got to get clear on what you want:
> 
>   - shall the regular user not be able to call synaptic in
>     "root mode" _at all_?
> 

The user shall not be able to start any application of with root rights. 
>   - yes, but only after entering root password?
> 
Exactly.
>   - yes, but only after entering her password?
> 
No, this is the actual situation.

> regards
> -- tomás

Best

Hans

[toc] | [prev] | [next] | [standalone]

#178340

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Mar 02, 2017 at 01:19:00PM +0100, Hans wrote:
> Hi Tomas
> > Hm. I'm not sure I've got that one right. Who has allowed the standard
> > user to execute applications with root rights? How?
> It was me, beeing haven asked by of the root password and (of course) gave the 
> correct one, I allowed the user, to start applications with root rights 

OK, to recap: you started synaptics (as regular user), and for the first time
you were asked a password. You gave the root (not the user's) password, and
from then on you could start synaptics as a regular user without having to
enter a password. Is that right?
 
> (besides, I am the user and root, as i is my personal computer)

Yes, I get that. That's (more or less) how most of us do things.

> > > I also found out, that the user is in group "sudo", but got no entry in
> > > /etc/ sudoers.
> > 
> > Again: who "got no entry in /etc/sudoers"? The user in question? Or the
> > group "sudo"?
> 
> It is the user, whom I allowed, to the above.

OK, let me summarize that:

 - there is a file /etc/sudoers
 - the "user" (let's call him "hans") has *no* entry in /etc/sudoers

Is that right?

That would be a typical setup (on my box it is exactly like that). The
group sudo is in the /etc/sudoers, and you give users sudo powers by
adding them to the sudo group. Typically things are set up in a way
that the user has still to enter *her* password. You can easily check
which groups a user is in with the "groups" command. In my box:

  tomas@rasputin:~$ groups tomas
  tomas : tomas cdrom floppy sudo audio dip video plugdev scanner netdev bluetooth kvm

With this setup (and supposed /etc/sudoers has this:

  # Allow members of group sudo to execute any command
  %sudo   ALL=(ALL:ALL) ALL

I can use sudo like so:

  tomas@rasputin:~$ sudo ls
  [sudo] password for tomas: 
  33c3              fr               letters [...]

Note that it asked me for a password. My password (not root). You can configure
/etc/sudoers to *not* ask for a password, to do it only for certain commands
and tons of other things (cf. man 5 sudoers). Sudo remembers whithin a session,
and for a limited time (default is 15 minutes) the password given, so next
command won't ask you, if you are quick enough. Can be changed in /etc/sudoers.

> > > Seems so. I'm still confused: I don't know whether the desktop environment
> > is the one granting you root privileges (I can't help with that; I don't
> > "do" desktop environments) or whether it is sudo (or whether it is the
> > DE based on the sudo settings).
> 
> No, no, the desktop just edits the settings, after a correct given root 
> password, to start the special applications with root right sin future times.

You mean: the desktop edits /etc/sudoers? I have had many reasons to kick
DEs out of my box many years ago, but this would be one reason more :-(

Are you sure?

> > The sudo part is pretty easy to find out (no clickety way, sorry). Try,
> > in a shell those two things:
> > 
> >   sudo ls
> > 
> 
> Gives the same als "ls".

Without being asked for *any* password? Sudo supports that (NOPASSWD), but
it's not the default.

OK. Then obviously you have sudoers running, (1) your user (hans) is allowed
sudo (most probably via its group) and (2) either you have a NOPASSWD policy,
or (3) the credentials are cached from a previous successful sudo. If you
opened your shell explicitly for this experiment, that would almost surely
rule out (3).

> >   sudo synaptic
> sudo synaptic
> sudo: Hostname protheus1 kann nicht aufgelöst werden
> No protocol specified
> Unable to init server: Verbindung ist gescheitert:Verbindungsaufbau abgelehnt
> 
> (synaptic:25373): Gtk-WARNING **: cannot open display: :0

That's funny, but hasn't to do with our current problem. Probably sudo, by
stripping the environment, has dropped some vital environment variable
(f. ex. http_proxy or something). Might be fixable by invoking "sudo -E",
but let's forget about that for now, to not get side-tracked.

> > What happens in each case? Do you get a password prompt? Is synaptic
> > started in user mode or in root mode?
> > 
> 
> No, as it is not root's environment, but the users one. However, su -p does 
> the trick.

Heh. So we reach the same conclusion.

> > > So, my question: How can I get this all back. A graphical solution is
> > > preferred, of course I knnow, I can edit /etc/groups and other things
> > > manually. But if there is a "clicky"-way, this will be preferred.
> > 
> > Be careful when editing /etc/groups. There are things for that like
> > adduser and addgroup. To remove your user from group sudo:
> > 
> >   sudo deluser <username> sudo
> > 
> > Whether that helps or not depends on all of the above, of course :-)
> > 
> > But **first of all** you've got to get clear on what you want:
> > 
> >   - shall the regular user not be able to call synaptic in
> >     "root mode" _at all_?
> > 
> 
> The user shall not be able to start any application of with root rights. 

Never? Then removing (hans) from the sudo group seems to be the most
"standard" way of achieving that.

> >   - yes, but only after entering root password?

> Exactly.

Now I'm confused. This contradicts the above. Perhaps you mean that the
user has to *login as root*. Sudo has the possibility to ask the root
password from the regular user instead of her own password (see the
rootpw, targetpw and runaspw flags in the sudoers(5) man page for all
the details).

> >   - yes, but only after entering her password?
> > 
> No, this is the actual situation.

Aha. But the user password is still necessary?

OK. Perhaps you just prefer the "classic" su behaviour and don't need
sudo at all (still: I'd recommend getting used to sudo. I don't embrace
every novelty, but this one was, after getting used, quite nice). But
hey, it's your toolbox :)

So just de-installing sudo might be an option for you (make sure your
package manager doesn't want to throw away half of your system -- I've
no idea what packages depend on sudo).

regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAli4GlsACgkQBcgs9XrR2kZmuACfSAENI16jGZon0sraaHPYRUMJ
190AnAh6IRc1ZUkMiZLWzoqLIyWE1b1A
=y4yp
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#178341

> OK, to recap: you started synaptics (as regular user), and for the first
> time you were asked a password. You gave the root (not the user's)
> password, and from then on you could start synaptics as a regular user
> without having to enter a password. Is that right?
> 

Correct. Howver, this is an implemented option, to allow normal users to start 
applications with root rights. Note: Root has to allow this!

>  - there is a file /etc/sudoers
>  - the "user" (let's call him "hans") has *no* entry in /etc/sudoers
> 
> Is that right?
> 

Correct. The user "hans" has no entry in /etc/sudoers. Note, that the user 
hans is in group "sudo".

groups
hans lp uucp dialout cdrom floppy sudo audio dip video plugdev games users 
powerdev debian-tor netdev scanner wireshark kismet

> That would be a typical setup (on my box it is exactly like that). The
> group sudo is in the /etc/sudoers, and you give users sudo powers by
> adding them to the sudo group. Typically things are set up in a way
> that the user has still to enter *her* password. You can easily check
> which groups a user is in with the "groups" command. In my box:
> 
>   tomas@rasputin:~$ groups tomas
>   tomas : tomas cdrom floppy sudo audio dip video plugdev scanner netdev
> bluetooth kvm
> 
> With this setup (and supposed /etc/sudoers has this:
> 
>   # Allow members of group sudo to execute any command
>   %sudo   ALL=(ALL:ALL) ALL
> 
> I can use sudo like so:
> 
>   tomas@rasputin:~$ sudo ls
>   [sudo] password for tomas:
>   33c3              fr               letters [...]
> 
> Note that it asked me for a password. My password (not root). You can
> configure /etc/sudoers to *not* ask for a password, to do it only for
> certain commands and tons of other things (cf. man 5 sudoers). Sudo
> remembers whithin a session, and for a limited time (default is 15 minutes)
> the password given, so next command won't ask you, if you are quick enough.
> Can be changed in /etc/sudoers.

Just take a look at my sudoers (it is not secret)

---- snip ----

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/
bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

----snap ---

> You mean: the desktop edits /etc/sudoers? I have had many reasons to kick
> DEs out of my box many years ago, but this would be one reason more :-(
> 
> Are you sure?

Dunno. I mean more, the desdktop is changing settings.
> 
> it's not the default.
> 
> OK. Then obviously you have sudoers running, (1) your user (hans) is allowed
> sudo (most probably via its group) and (2) either you have a NOPASSWD
> policy, or (3) the credentials are cached from a previous successful sudo.
> If you opened your shell explicitly for this experiment, that would almost
> surely rule out (3).
> 
> That's funny, but hasn't to do with our current problem. Probably sudo, by
> stripping the environment, has dropped some vital environment variable
> (f. ex. http_proxy or something). Might be fixable by invoking "sudo -E",
> but let's forget about that for now, to not get side-tracked.
> 
> Heh. So we reach the same conclusion.
> 
> Never? Then removing (hans) from the sudo group seems to be the most
> "standard" way of achieving that.

> Now I'm confused. This contradicts the above. Perhaps you mean that the
> user has to *login as root*. Sudo has the possibility to ask the root
> password from the regular user instead of her own password (see the
> rootpw, targetpw and runaspw flags in the sudoers(5) man page for all
> the details).
> 
> Aha. But the user password is still necessary?

That is correct. The user has to enter his own password.
> 
> OK. Perhaps you just prefer the "classic" su behaviour and don't need
> sudo at all (still: I'd recommend getting used to sudo. I don't embrace
> every novelty, but this one was, after getting used, quite nice). But
> hey, it's your toolbox :)
> 
> So just de-installing sudo might be an option for you (make sure your
> package manager doesn't want to throw away half of your system -- I've
> no idea what packages depend on sudo).
> 
> regards
> -- tomás

Best 

Hans

[toc] | [prev] | [next] | [standalone]

#178348

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Mar 02, 2017 at 02:32:19PM +0100, Hans wrote:

[snip snip]

OK, given your answers, the recommended path would be to remove your
user (hans) from group sudo, perhaps so:

  deluser hans sudo

(you've to be root for that, perhaps with -ahem- sudo ;-)

and then see whether the system behaves as you expect. You can change
things back with

  adduser hans sudo

(this time not with sudo, heh).

Note that sudo is pretty useful in other situations: you can specify
that users get sudo powers only for specific programs: that would e.g.
allow regular users to invoke a backup even if they aren't allowed to
read the files they back up. Careful planning is a good idea, since
if (to keep with the example) they have access to the backup medium
they would be able to read the files anyway -- or worse.

Regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAli4fh4ACgkQBcgs9XrR2kYN5gCaAk7PblG3qf+LoMHzldB9Mz8x
N9oAn3xgOJzWcEEugWFQsGu3ejhp6UEd
=TbB6
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#178342

On Thu 02 Mar 2017 at 14:12:59 (+0100), tomas@tuxteam.de wrote:
> On Thu, Mar 02, 2017 at 01:19:00PM +0100, Hans wrote:
> > Hi Tomas
> > > Hm. I'm not sure I've got that one right. Who has allowed the standard
> > > user to execute applications with root rights? How?
> > It was me, beeing haven asked by of the root password and (of course) gave the 
> > correct one, I allowed the user, to start applications with root rights 
> 
> OK, to recap: you started synaptics (as regular user), and for the first time
> you were asked a password. You gave the root (not the user's) password, and
> from then on you could start synaptics as a regular user without having to
> enter a password. Is that right?

If you're trying to clarify things, you have to tighten that up
considerably. Any regular user can start synaptics without a password,
as I already posted in this thread.

I can guess what you mean, and I don't think that is what happened.
(What I _think_ you mean is that by using the root password in that
situation on one occasion, the system has "remembered", and now you
don't need the apssword any more. I don't think that happened. I think
the OP configured something at an ealier time and has forgotten.)

> > (besides, I am the user and root, as i is my personal computer)
> 
> Yes, I get that. That's (more or less) how most of us do things.
> 
> > > > I also found out, that the user is in group "sudo", but got no entry in
> > > > /etc/ sudoers.
> > > 
> > > Again: who "got no entry in /etc/sudoers"? The user in question? Or the
> > > group "sudo"?
> > 
> > It is the user, whom I allowed, to the above.
> 
> OK, let me summarize that:
> 
>  - there is a file /etc/sudoers
>  - the "user" (let's call him "hans") has *no* entry in /etc/sudoers
> 
> Is that right?
> 
> That would be a typical setup (on my box it is exactly like that). The
> group sudo is in the /etc/sudoers, and you give users sudo powers by
> adding them to the sudo group. Typically things are set up in a way
> that the user has still to enter *her* password. You can easily check
> which groups a user is in with the "groups" command. In my box:
> 
>   tomas@rasputin:~$ groups tomas
>   tomas : tomas cdrom floppy sudo audio dip video plugdev scanner netdev bluetooth kvm
> 
> With this setup (and supposed /etc/sudoers has this:
> 
>   # Allow members of group sudo to execute any command
>   %sudo   ALL=(ALL:ALL) ALL
> 
> I can use sudo like so:
> 
>   tomas@rasputin:~$ sudo ls
>   [sudo] password for tomas: 
>   33c3              fr               letters [...]
> 
> Note that it asked me for a password. My password (not root). You can configure
> /etc/sudoers to *not* ask for a password, to do it only for certain commands
> and tons of other things (cf. man 5 sudoers). Sudo remembers whithin a session,
> and for a limited time (default is 15 minutes) the password given, so next
> command won't ask you, if you are quick enough. Can be changed in /etc/sudoers.
> 
> > > > Seems so. I'm still confused: I don't know whether the desktop environment
> > > is the one granting you root privileges (I can't help with that; I don't
> > > "do" desktop environments) or whether it is sudo (or whether it is the
> > > DE based on the sudo settings).
> > 
> > No, no, the desktop just edits the settings, after a correct given root 
> > password, to start the special applications with root right sin future times.
> 
> You mean: the desktop edits /etc/sudoers? I have had many reasons to kick
> DEs out of my box many years ago, but this would be one reason more :-(
> 
> Are you sure?
> 
> > > The sudo part is pretty easy to find out (no clickety way, sorry). Try,
> > > in a shell those two things:
> > > 
> > >   sudo ls
> > > 
> > 
> > Gives the same als "ls".
> 
> Without being asked for *any* password? Sudo supports that (NOPASSWD), but
> it's not the default.
> 
> OK. Then obviously you have sudoers running, (1) your user (hans) is allowed
> sudo (most probably via its group) and (2) either you have a NOPASSWD policy,
> or (3) the credentials are cached from a previous successful sudo. If you
> opened your shell explicitly for this experiment, that would almost surely
> rule out (3).
> 
> > >   sudo synaptic
> > sudo synaptic
> > sudo: Hostname protheus1 kann nicht aufgelöst werden
> > No protocol specified
> > Unable to init server: Verbindung ist gescheitert:Verbindungsaufbau abgelehnt
> > 
> > (synaptic:25373): Gtk-WARNING **: cannot open display: :0
> 
> That's funny, but hasn't to do with our current problem. Probably sudo, by
> stripping the environment, has dropped some vital environment variable
> (f. ex. http_proxy or something). Might be fixable by invoking "sudo -E",
> but let's forget about that for now, to not get side-tracked.
> 
> > > What happens in each case? Do you get a password prompt? Is synaptic
> > > started in user mode or in root mode?
> > > 
> > 
> > No, as it is not root's environment, but the users one. However, su -p does 
> > the trick.
> 
> Heh. So we reach the same conclusion.
> 
> > > > So, my question: How can I get this all back. A graphical solution is
> > > > preferred, of course I knnow, I can edit /etc/groups and other things
> > > > manually. But if there is a "clicky"-way, this will be preferred.
> > > 
> > > Be careful when editing /etc/groups. There are things for that like
> > > adduser and addgroup. To remove your user from group sudo:
> > > 
> > >   sudo deluser <username> sudo
> > > 
> > > Whether that helps or not depends on all of the above, of course :-)
> > > 
> > > But **first of all** you've got to get clear on what you want:
> > > 
> > >   - shall the regular user not be able to call synaptic in
> > >     "root mode" _at all_?
> > > 
> > 
> > The user shall not be able to start any application of with root rights. 
> 
> Never? Then removing (hans) from the sudo group seems to be the most
> "standard" way of achieving that.

Yes, that would be reverting to the default state, ie sudo:x:27:
in /etc/group.

> > >   - yes, but only after entering root password?
> 
> > Exactly.
> 
> Now I'm confused. This contradicts the above. Perhaps you mean that the
> user has to *login as root*. Sudo has the possibility to ask the root
> password from the regular user instead of her own password (see the
> rootpw, targetpw and runaspw flags in the sudoers(5) man page for all
> the details).
> 
> > >   - yes, but only after entering her password?
> > > 
> > No, this is the actual situation.
> 
> Aha. But the user password is still necessary?
> 
> OK. Perhaps you just prefer the "classic" su behaviour and don't need
> sudo at all (still: I'd recommend getting used to sudo. I don't embrace
> every novelty, but this one was, after getting used, quite nice). But
> hey, it's your toolbox :)
> 
> So just de-installing sudo might be an option for you (make sure your
> package manager doesn't want to throw away half of your system -- I've
> no idea what packages depend on sudo).

I think I would lose the ability to configure wifi APs as a user
if I lost sudo.

But I can't see that there's any point in removing sudo if you
. add noone to group sudo
. add nothing to /etc/sudoers.d/
. add nothing to /etc/sudoers

Would I be right?

BTW one thing I don't understand about sudo is why
/etc/sudoers.d/README is not world-readable.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#178349

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Mar 02, 2017 at 08:01:38AM -0600, David Wright wrote:

[...]

> If you're trying to clarify things, you have to tighten that up
> considerably. Any regular user can start synaptics without a password,
> as I already posted in this thread.

Yes. I was explicitly excluding DE authentication foo (like PolicyKit
and similar) -- first to explore the simpler sudo path and second,
because I'm definitely the wrong person to give advice related to
desktop environments. I know very little about them and... I don't
like them, to be honest.

> I can guess what you mean, and I don't think that is what happened.
> (What I _think_ you mean is that by using the root password in that
> situation on one occasion, the system has "remembered", and now you
> don't need the apssword any more. I don't think that happened. I think
> the OP configured something at an ealier time and has forgotten.)

I don't think either, and given Hans' last answer, it seems he has a
pretty standard sudo configuration, his user belonging to sudoers.
I don't remember whether that is Debian default or if you've to do
something explicitly to achieve that. I'd guess it's the latter, but
hey.

> I think I would lose the ability to configure wifi APs as a user
> if I lost sudo.

Perhaps. I don't know what PolicyKit is able to do -- the whole dance
around DBus would suggest that they want to have some communication
accross privilege domains, so it seems to be geared to that, but what
do I know.

> But I can't see that there's any point in removing sudo if you
> . add noone to group sudo
> . add nothing to /etc/sudoers.d/
> . add nothing to /etc/sudoers
> 
> Would I be right?

Yes. I described removing the package sudo as the more drastic
variant, only when you want to avoid at all costs that a user be
added to the sudo group (or, more precisely: this would then have
no effect).

> BTW one thing I don't understand about sudo is why
> /etc/sudoers.d/README is not world-readable.

Funny. README, but you can't :-)

Seems a fairly harmless mistake, perhaps a too literal interpretation
of "/etc/sudoers and all files under /etc/sudoers.d are sensitive".

Better than the other way around, though.

Regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAli4gUgACgkQBcgs9XrR2kZw+ACcC+b5ll9T+W8cEYKbg2Eud9LD
WoYAn3W69gajGVIMO+Va5LbFZ3aT2wJ/
=ne0W
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#178498 — [SOLVED] Re: Security hole in LXDE?

Closing my first report. When  I deleted the user from the group "sudo", 
everything worked back as normal.

However, IMO the user must additionally be in /et/suders to get the described 
behaviour working.

What is sure: Either KDE or LXDE gave me the opportunity (by using the root  
password), to remember the passsword and let users 
execute applications (like synaptic) s root.

I am glad, to find the reason at h eend. There is nothing more annoying, than 
not to kow, what is going on.

Thank you all for your help and your thoughts abut this problem!

I love the community!

Best regards

Hans

[toc] | [prev] | [next] | [standalone]

#178500 — Re: [SOLVED] Re: Security hole in LXDE?

On Mon, 06 Mar 2017 18:28:25 +0100
Hans <hans.ullrich@loop.de> wrote:

> Closing my first report. When  I deleted the user from the group
> "sudo", everything worked back as normal.
> 
>

Debian appears to use the group 'sudo' as an administrative group,
where some other distributions use 'wheel'.

I would not have thought that users would be added to it by default,
there are no members on my sid/xfce4 workstation. Indeed, up to Jessie,
sudo was not installed at all by default, and may still not be.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#178501 — Re: [SOLVED] Re: Security hole in LXDE?

On Mon, Mar 06, 2017 at 06:31:46PM +0000, Joe wrote:
> Debian appears to use the group 'sudo' as an administrative group,
> where some other distributions use 'wheel'.
> 
> I would not have thought that users would be added to it by default,
> there are no members on my sid/xfce4 workstation. Indeed, up to Jessie,
> sudo was not installed at all by default, and may still not be.

If you use the regular Debian installer, the user account that you
create during installation gets added to a lot of these special groups
(sudo, cdrom, floppy, audio, video, ...?).  Users that you create
post-installtion using adduser or useradd do not.

[toc] | [prev] | [next] | [standalone]

#178502 — Re: [SOLVED] Re: Security hole in LXDE?

On Mon, 6 Mar 2017 13:40:45 -0500
Greg Wooledge <wooledg@eeg.ccf.org> wrote:

> On Mon, Mar 06, 2017 at 06:31:46PM +0000, Joe wrote:
> > Debian appears to use the group 'sudo' as an administrative group,
> > where some other distributions use 'wheel'.
> > 
> > I would not have thought that users would be added to it by default,
> > there are no members on my sid/xfce4 workstation. Indeed, up to
> > Jessie, sudo was not installed at all by default, and may still not
> > be.  
> 
> If you use the regular Debian installer, the user account that you
> create during installation gets added to a lot of these special groups
> (sudo, cdrom, floppy, audio, video, ...?).  Users that you create
> post-installtion using adduser or useradd do not.
> 

New behaviour, then, my current sid was installed as wheezy, I added
sudo manually early on, but as it was not installed by default, it
would not have added the installing user to a sudo group. I'm certainly
not a member of that group, and have no wish to be.

Possibly I'm missing something, but doesn't this repeat the Windows
mistake of automatically giving the user admin privileges? Isn't that
the main reason for the existence of so many Windows viruses?

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#178503 — Re: [SOLVED] Re: Security hole in LXDE?

On Mon 06 Mar 2017 at 18:59:18 +0000, Joe wrote:

> On Mon, 6 Mar 2017 13:40:45 -0500
> Greg Wooledge <wooledg@eeg.ccf.org> wrote:
> 
> > On Mon, Mar 06, 2017 at 06:31:46PM +0000, Joe wrote:
> > > Debian appears to use the group 'sudo' as an administrative group,
> > > where some other distributions use 'wheel'.
> > > 
> > > I would not have thought that users would be added to it by default,
> > > there are no members on my sid/xfce4 workstation. Indeed, up to
> > > Jessie, sudo was not installed at all by default, and may still not
> > > be.  
> > 
> > If you use the regular Debian installer, the user account that you
> > create during installation gets added to a lot of these special groups
> > (sudo, cdrom, floppy, audio, video, ...?).  Users that you create
> > post-installtion using adduser or useradd do not.
> > 
> 
> New behaviour, then, my current sid was installed as wheezy, I added
> sudo manually early on, but as it was not installed by default, it
> would not have added the installing user to a sudo group. I'm certainly
> not a member of that group, and have no wish to be.

The "first user" is not in the sudo group. The place to check this
is the templates file in the user-setup-udeb package.
 
> Possibly I'm missing something, but doesn't this repeat the Windows
> mistake of automatically giving the user admin privileges? Isn't that
> the main reason for the existence of so many Windows viruses?

Look at it this way. The "first user" wishes to set up a printer. Is
it better for the user to be granted very limited privileges by being
in the lpadmin group or to become root to carry out the task?

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#178505 — Re: [SOLVED] Re: Security hole in LXDE?

On Mon, 6 Mar 2017 19:36:40 +0000
Brian <ad44@cityscape.co.uk> wrote:

> On Mon 06 Mar 2017 at 18:59:18 +0000, Joe wrote:
> 
> > On Mon, 6 Mar 2017 13:40:45 -0500
> > Greg Wooledge <wooledg@eeg.ccf.org> wrote:
> >   
> > > On Mon, Mar 06, 2017 at 06:31:46PM +0000, Joe wrote:  
> > > > Debian appears to use the group 'sudo' as an administrative
> > > > group, where some other distributions use 'wheel'.
> > > > 
> > > > I would not have thought that users would be added to it by
> > > > default, there are no members on my sid/xfce4 workstation.
> > > > Indeed, up to Jessie, sudo was not installed at all by default,
> > > > and may still not be.    
> > > 
> > > If you use the regular Debian installer, the user account that you
> > > create during installation gets added to a lot of these special
> > > groups (sudo, cdrom, floppy, audio, video, ...?).  Users that you
> > > create post-installtion using adduser or useradd do not.
> > >   
> > 
> > New behaviour, then, my current sid was installed as wheezy, I added
> > sudo manually early on, but as it was not installed by default, it
> > would not have added the installing user to a sudo group. I'm
> > certainly not a member of that group, and have no wish to be.  
> 
> The "first user" is not in the sudo group. The place to check this
> is the templates file in the user-setup-udeb package.
>  
> > Possibly I'm missing something, but doesn't this repeat the Windows
> > mistake of automatically giving the user admin privileges? Isn't
> > that the main reason for the existence of so many Windows viruses?  
> 
> Look at it this way. The "first user" wishes to set up a printer. Is
> it better for the user to be granted very limited privileges by being
> in the lpadmin group or to become root to carry out the task?
> 

Who said anything about lpadmin? The question is about the wisdom of
automatically including someone in the sudo group, which in a default
Debian sudoers file, gives full root privileges to everything, using the
user's password.

We have someone saying this happens, someone else saying it doesn't, I
don't know as I haven't done a recent installation, and the thread was
started by someone who says it did happen to him.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#178506 — Re: [SOLVED] Re: Security hole in LXDE?

On 2017-03-06, Joe <joe@jretrading.com> wrote:
>
> Who said anything about lpadmin? The question is about the wisdom of
> automatically including someone in the sudo group, which in a default
> Debian sudoers file, gives full root privileges to everything, using the
> user's password.
>
> We have someone saying this happens, someone else saying it doesn't, I
> don't know as I haven't done a recent installation, and the thread was
> started by someone who says it did happen to him.
>

I've only used the installer up to and including Wheezy and have always
created a root password. But if I hadn't (created a root password) then
I suppose I would've been included in the sudo group with full
administrative privileges. If not, how would or does the person
installing the OS (who is therefore, ipso facto, IMO, the administrator
of the machine) do anything administratively? And what difference would
it make security-wise to put the "first user" in the sudo group when she
or he could have gotten there anyway by simply creating a root password
and foregoing sudo altogether? Or am being stupid here, missing
something obvious?

-- 
"It might be a vision--of a shell, of a wheelbarrow, of a fairy kingdom on the
far side of the hedge; or it might be the glory of speed; no one knew." --Mrs.
Ramsay, speculating on why her little daughter might be dashing about, in "To
the Lighthouse," by Virginia Woolf.

[toc] | [prev] | [next] | [standalone]

#178508 — Re: [SOLVED] Re: Security hole in LXDE?

On Mon, 6 Mar 2017 20:47:50 +0000 (UTC)
Curt <curty@free.fr> wrote:

> On 2017-03-06, Joe <joe@jretrading.com> wrote:
> >
> > Who said anything about lpadmin? The question is about the wisdom of
> > automatically including someone in the sudo group, which in a
> > default Debian sudoers file, gives full root privileges to
> > everything, using the user's password.
> >
> > We have someone saying this happens, someone else saying it
> > doesn't, I don't know as I haven't done a recent installation, and
> > the thread was started by someone who says it did happen to him.
> >  
> 
> I've only used the installer up to and including Wheezy and have
> always created a root password. But if I hadn't (created a root
> password) then I suppose I would've been included in the sudo group
> with full administrative privileges. If not, how would or does the
> person installing the OS (who is therefore, ipso facto, IMO, the
> administrator of the machine) do anything administratively? And what
> difference would it make security-wise to put the "first user" in the
> sudo group when she or he could have gotten there anyway by simply
> creating a root password and foregoing sudo altogether? Or am being
> stupid here, missing something obvious?
> 

A member of the sudo group has permanent root privileges. He might as
well simply login as root every day, and not bother with another user.

My understanding of the use of the sudo group was for multiple server
admins, not workstation users.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web