2

I need to monitor network traffic and EtherApe seems to be nice graphical utility. But the Wikipedia entry says sth like this :

Security: EtherApe requires root privileges to run. As such, there can be risks to the machine(s) running EtherApe when connected to the internet.

I am not getting this , we need to be connected to internet to monitor it, we do not need it at all if we are offline , don't we ?

If there is security risk what it could be and how to use it properly ?

2

The security risk is that if someone hacks you and manages to shell it, they will have a root shell. Unfortunately, this is the case with quite a lot of things.

There isn't really a way to definitively protect against this, but a reverse proxy might be a good start, as well as keeping up with patches. Additionally, use a dedicated server or VM for this which has no other function, and keep it firewalled off (in a DMZ) from everything it doesn't need access to.

3

It doesn't need to run as root, it just needs to be able to perform some network-related tasks that exceed the usual user permissions. Just use the linux capabilites to only confer these permissions without giving superuser rights:

sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/etherape

Of course its still a slight risk to allow users to monitor all network traffic, but then that is what you are asking for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.