Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #178338

Re: Security hole in LXDE?

From Hans <hans.ullrich@loop.de>
Newsgroups linux.debian.user
Subject Re: Security hole in LXDE?
Date 2017-03-02 13:20 +0100
Message-ID <tgxS9-29S-1@gated-at.bofh.it> (permalink)
References <tfpMZ-3yz-1@gated-at.bofh.it> <tgwt5-13g-23@gated-at.bofh.it> <tgxfs-1z0-11@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

Hi Tomas
> Hm. I'm not sure I've got that one right. Who has allowed the standard
> user to execute applications with root rights? How?
It was me, beeing haven asked by of the root password and (of course) gave the 
correct one, I allowed the user, to start applications with root rights 
(besides, I am the user and root, as i is my personal computer)
> 
> > I also found out, that the user is in group "sudo", but got no entry in
> > /etc/ sudoers.
> 
> Again: who "got no entry in /etc/sudoers"? The user in question? Or the
> group "sudo"?

It is the user, whom I allowed, to the above.

> > Seems so. I'm still confused: I don't know whether the desktop environment
> is the one granting you root privileges (I can't help with that; I don't
> "do" desktop environments) or whether it is sudo (or whether it is the
> DE based on the sudo settings).

No, no, the desktop just edits the settings, after a correct given root 
password, to start the special applications with root right sin future times.
> 
> The sudo part is pretty easy to find out (no clickety way, sorry). Try,
> in a shell those two things:
> 
>   sudo ls
> 

Gives the same als "ls".

>   sudo synaptic
sudo synaptic
sudo: Hostname protheus1 kann nicht aufgelöst werden
No protocol specified
Unable to init server: Verbindung ist gescheitert:Verbindungsaufbau abgelehnt

(synaptic:25373): Gtk-WARNING **: cannot open display: :0


> 
> What happens in each case? Do you get a password prompt? Is synaptic
> started in user mode or in root mode?
> 

No, as it is not root's environment, but the users one. However, su -p does 
the trick.
> > So, my question: How can I get this all back. A graphical solution is
> > preferred, of course I knnow, I can edit /etc/groups and other things
> > manually. But if there is a "clicky"-way, this will be preferred.
> 
> Be careful when editing /etc/groups. There are things for that like
> adduser and addgroup. To remove your user from group sudo:
> 
>   sudo deluser <username> sudo
> 
> Whether that helps or not depends on all of the above, of course :-)
> 
> But **first of all** you've got to get clear on what you want:
> 
>   - shall the regular user not be able to call synaptic in
>     "root mode" _at all_?
> 

The user shall not be able to start any application of with root rights. 
>   - yes, but only after entering root password?
> 
Exactly.
>   - yes, but only after entering her password?
> 
No, this is the actual situation.

> regards
> -- tomás

Best

Hans

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-27 10:30 +0100
  Re: Security hole in LXDE? Jonathan Dowland <jmtd@debian.org> - 2017-02-27 11:00 +0100
    Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-27 11:20 +0100
      Re: Security hole in LXDE? GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-02-27 16:40 +0100
      Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-03-02 11:50 +0100
        Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-02 12:40 +0100
          Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-03-02 13:20 +0100
            Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-02 14:20 +0100
              Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-03-02 14:40 +0100
                Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-02 21:20 +0100
              Re: Security hole in LXDE? David Wright <deblis@lionunicorn.co.uk> - 2017-03-02 15:10 +0100
                Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-02 21:40 +0100
      [SOLVED] Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-03-06 18:30 +0100
        Re: [SOLVED] Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-03-06 19:40 +0100
          Re: [SOLVED] Re: Security hole in LXDE? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-03-06 19:50 +0100
            Re: [SOLVED] Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-03-06 20:00 +0100
              Re: [SOLVED] Re: Security hole in LXDE? Brian <ad44@cityscape.co.uk> - 2017-03-06 20:40 +0100
                Re: [SOLVED] Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-03-06 21:00 +0100
                Re: [SOLVED] Re: Security hole in LXDE? Curt <curty@free.fr> - 2017-03-06 21:50 +0100
                Re: [SOLVED] Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-03-06 22:00 +0100
                Re: [SOLVED] Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-07 09:10 +0100
                Re: [SOLVED] Re: Security hole in LXDE? Brian <ad44@cityscape.co.uk> - 2017-03-06 22:00 +0100
                Re: [SOLVED] Re: Security hole in LXDE? <tomas@tuxteam.de> - 2017-03-07 09:10 +0100
                Re: [SOLVED] Re: Security hole in LXDE? Brian <ad44@cityscape.co.uk> - 2017-03-07 13:10 +0100
            Re: [SOLVED] Re: Security hole in LXDE? GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-03-06 20:50 +0100
  Re: Security hole in LXDE? Davor Balder <davor@cropakglobal.com> - 2017-02-27 11:10 +0100
    Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-27 11:30 +0100
      Re: Security hole in LXDE? GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-02-27 12:20 +0100
        Re: Security hole in LXDE? David Wright <deblis@lionunicorn.co.uk> - 2017-02-27 23:00 +0100
          Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-28 11:10 +0100
            Re: Security hole in LXDE? David Wright <deblis@lionunicorn.co.uk> - 2017-02-28 18:50 +0100
          Re: Security hole in LXDE? GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-02-28 13:40 +0100
            Re: Security hole in LXDE? David Wright <deblis@lionunicorn.co.uk> - 2017-02-28 18:50 +0100
              Re: Security hole in LXDE? Lisi Reisz <lisi.reisz@gmail.com> - 2017-03-01 01:00 +0100
    Re: Security hole in LXDE? cbannister@slingshot.co.nz - 2017-03-25 07:20 +0100
  Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-02-27 12:10 +0100
    Re: Security hole in LXDE? Hans <hans.ullrich@loop.de> - 2017-02-27 12:30 +0100
      Re: Security hole in LXDE? Joe <joe@jretrading.com> - 2017-02-27 12:50 +0100
      Re: Security hole in LXDE? Pontus Goffe <goffe.pontus@gmail.com> - 2017-02-27 15:50 +0100

csiph-web