2

I try to restrict a backup daemon's user (that needs root access to client machines) so that it can only use the one command it needs. Thus, in /etc/sudoers, I use

daemonuser  ALL=NOPASSWD: /backup/command --with --args *

I heard from a colleague that that method is no longer considered secure, but I could not find any details. Are there any security issues I need to be aware of?

2
  • Have you asked your colleague to define the insecurity?
    – voretaq7
    Sep 26, 2011 at 18:54
  • He only alerted me that he read something about the problem, but could not recall details.
    – jstarek
    Sep 26, 2011 at 18:59

4 Answers 4

4

This is probably a no-brainer to you, but for the sake of completeness:

You'll have to make sure that /backup/command is secured against shell-escapes and similar characters. A common pitfall is, for example, the presence of '\n' in filenames, which allows insertions of arbitrary lines into xargs input and similar stuff. Many backup solutions don't take high precautions to secure their inputs, so you'll maybe want to check the correctness of the backup script.

1
  • 2
    For the sake of sanity you can always limit daemonuser to /usr/local/bin/backup-wrapper.sh (that doesn't pass along any command line arguments and ensures /backup/command is called properly). This can also mitigate the concerns @DerfK raised to some extent. Other caveats apply, but it does reduce the attack surface a bit.
    – voretaq7
    Sep 27, 2011 at 17:24
5

You are giving your daemonuser access without the requirement for a password. You should ensure that no one except root has write access to to the script. Beyond that it should be fairly secure. You could always ask your colleague for a reference to 'heard'.

4

The only issue with argument lists that I'm aware of is when people try to combine an allowed command with attempting to exclude certain arguments using !. For instance, allowing someone to rm as root but not letting them erase the entire system could be attempted with a command list like

/bin/rm, !/bin/rm -rf /

except that this wouldn't really solve the problem since the user could still run rm -fr / or rm -r -f / or rm -rf . while in the root directory, or rm -rf ../../../../../../.. and so on.

3

The normal rule is you have to prove that what you're doing is secure.
I can tell you that what you've got in your question is "secure" subject to two major caveats:

  1. You've set NOPASSWD so the system will never ask the daemonuser user for a password for executing that command. Since this is for a (probably non-interactive) daemon, that seems reasonable to me.
    (also you have to specifically set NOPASSWD, and presumably you know what you're doing…)

  2. If there is a security hole in the version of sudo you have installed you're subject to it.
    Check your installed version of sudo and make sure it's up to date.


Your clarifying comment makes your colleague's assertion sound like "I have a friend who has a friend who heard of a security hole in foo, but we don't know what it is" -- Security is something to take very seriously, but absent a known flaw we could be talking about someone acting on 5 year old information about security flaws in sudo and waving their arms...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .