1

I'm in the process of migrating one of my Linux servers, and I noticed that I have supervisor running a startup script as root, but the script is writeable by a non-root user, which creates the potential for a privilege escalation exploit. Is there a way to audit all the startup scripts on my system to make sure there aren't any more vulnerabilities like this?

1

I would configure a filesystem monitoring of the relevant configuration files and directories for the installed init system. Paths will depend if you are running systemd or legacy sysV.

To monitor filesystem for changes there are plenty of solutions. In Ubuntu I use Open-source Tripwire.

You can decide what to monitor and either receive email notifications or parse its logs in your usual way and take needed actions over filesystem changes.

There are many more ways too, those built on top of inotify kernel feature (since 2.6.13), like pyinotify, and I also know about fileschanged binary based on FAM.

They all can help you achieve your goal, and honestly I can't help you compare them and establish which one is the best.

Anyway you should:

  1. Ensure startup configuration is OK before you start (Ideally, this will be done since the system's fresh install, before going in prod).
  2. Install the filesystem monitoring solution of your choice.
  3. Monitor file content and permission changes of the relevant files and directories for your init system. (ensure to monitor the files referenced by your init scripts too!!)
  4. Get a notification, or parse logs and take automated actions over modifications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.