Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #229636

Re: Permissions on NFS mounts

Show all headers | View raw

On Thu, 2020-12-10 at 16:48 +0300, Reco wrote:
> On Thu, Dec 10, 2020 at 03:36:47PM +0200, Andrei POPESCU wrote:
> > On Jo, 10 dec 20, 13:34:55, Reco wrote:
> > > On Thu, Dec 10, 2020 at 12:07:54PM +0200, Andrei POPESCU wrote:
> > > > On Jo, 10 dec 20, 12:52:56, Reco wrote:
> > > > > On Thu, Dec 10, 2020 at 11:46:02AM +0200, Andrei POPESCU
> > > > > wrote:
> > > > > > passwd -l/--lock <username>
> > > > > 
> > > > > sudo -u <locked_user> /bin/bash -i
> > > > > 
> > > > > That little trick defeats "locked" account status, an absence
> > > > > of a
> > > > > password and even /usr/sbin/nologin set as a default shell.
> > > > 
> > > > With sudo access one can also unlock the account as well, so
> > > > how is this 
> > > > relevant?
> > > 
> > > Of course it's relevant. The whole point of sudo is to be a
> > > controlled
> > > privilege escalation mechanism.
> > > I.e. you can grant an ordinary user A to execute a certain
> > > binaries with
> > > certain arguments as a different ordinary user B, *and* you do
> > > not have
> > > to provide an ordinary user A an access to root.
> > 
> > At least on Debian sudo has to be explicitly configured to allow a 
> > regular user to use '-u' with another user name. We can only assume
> > the 
> > admin had good reasons to that, possibly on purpose (see below).
> 
> You're correct here, one has to explicitly allow such activity in
> sudoers in Debian and just about any OS I've encountered these years
> (assuming it has sudo, of course).
> 
> I just like to remind you the original question:
> 
> Is there a way to put an account "beyond use", in any way including
> su,
> sudo etc,

Which, IMO, is a rather bogus question in the context that preceded
that question, namely "having unneeded users on a given machine could
be a security threat, at least in the sense that it provides a greater
than necessary attackable surface area"

Why would you execute sudo or su on the target machine to change to one
of these unneeded users, presumably you can do whatever mischief is
your aim by using the account you are executing su or sudo from. Or by
changing to another valid user on that machine if you are a legitimate
user and were trying to cover your tracks.

-- 
Tixy

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Permissions on NFS mounts Paul M Foster <paulf@quillandmouse.com> - 2020-12-09 21:40 +0100
  Re: Permissions on NFS mounts Dan Ritter <dsr@randomstring.org> - 2020-12-09 22:00 +0100
    Re: Permissions on NFS mounts Mark Fletcher <mark27q1@gmail.com> - 2020-12-10 10:20 +0100
      Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 10:50 +0100
        Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:00 +0100
          Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 11:10 +0100
            Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:40 +0100
              Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 14:40 +0100
                Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 14:50 +0100
                Re: Permissions on NFS mounts David Wright <deblis@lionunicorn.co.uk> - 2020-12-10 16:40 +0100
                Re: Permissions on NFS mounts Tixy <tixy@yxit.co.uk> - 2020-12-10 16:40 +0100
                Re: Permissions on NFS mounts Greg Wooledge <wooledg@eeg.ccf.org> - 2020-12-10 16:50 +0100
                Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:20 +0100
                Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:30 +0100
      Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:00 +0100
      Re: Permissions on NFS mounts Darac Marjal <mailinglist@darac.org.uk> - 2020-12-10 13:00 +0100
  Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:00 +0100

csiph-web