My question is in three (or so) related parts:  1) My understanding is that getlogin() will effectively return the auid associated with the process and so isn't actually changable by the user. Is that understanding true?  2) I found  regarding getlogin() used in pam_wheel. I'm familiar with each individual command but not sure I understand how they're accomplishing the end effect. It seems they're accepting input from a symlink called tty1 which is also the same tty name the root user is on. How is it that the symlink succeeded? Shouldn't /dev/tty1 already be there if root is shown as being logged into it (in utmp)?  3) I was just starting out with GNU/Linux (like abut a year or so into it) when this exploit was written up, so it's possible that I'm unaware of some previous iteration in Linux identity/privilege management. How could a normal user create that symlink? I know /dev was a static list of mknod files back then, but reads/writes on symlinks get evaluated by the hardlink referenced, correct? I realize this is on a udev-based /dev hierarchy, but by way of example this is one pty on one of my systems:  crw--w----. 1 jadavis6 tty 136, 3 May 27 00:47 /dev/pts/3   Shouldn't the above prevent any user that's not jadavis6 nor in the tty group access (via symlink or otherwise) for reading or writing? Were the permissions in /dev more liberal pre-devfs/udev?  Also, how does reading from the TTY grant the process you're currently in root access? I could see using it to spy on the remote session by reading everything written to the tty device, but how are they getting logname to change for them? Are the subsequent commands (after the redirect from tty1) just what is happening on the root console or is there something at play here that actually led to this be a way to get root? If it's the latter, is this exploit really su specific? I mean won't a lot of functionality be opened up if all you have to do is create a symlink to a device file and then your auid is now root?  Answer: Found out most of the critical information above in
121641
I think the  of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll start a new one that hopefully people can have an easier time with.  Basically, my overall interest is in understanding logname and getlogin() as it relates to audit trails. It breaks down like this:  1) My understanding is that logname and getlogin() both display the auid that would/will end up showing in the session's audit logs. Is that correct? I know auid is an immutable process attribute, but I was interested in knowing whether the two are necessarily the same or just usually the same. This would help me with writing scripts/helper programs that can make access control decisions based on the user's original identity, rather than just who they happen to be at the moment or a mutable environmental variable.  2) I still don't understand how the  of  being shown was supposed to work. If someone could explain that to me, it would be great.  My primary interest is with point #1, though.
27147
What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh.  This is on a FreeBSD box, but I imagine it would be applicable anywhere.
63793
I am lazy at home and use password authentication for my home machines. I am ready to move to key based authentication. There are many options on the web on how to do this, including catting then sshing the key over, scping the key over directly, etc.  I am looking for the easiest and recommended way to copy a key over, hopefully there is a convenience wrapper somewhere in the Ubuntu ssh package?  I'm already aware on .
80163
If you use sudo su - or sudo -s you will get the full root certification  "likewise a root user ".  Is this user an official user or is it from canonical?  ~$ sudo su - [sudo] password for username:  root@lp:~# id uid=0(root) gid=0(root) groups=0(root) root@lp:~# pwd /root root@lp:~#
43239
Recently, My SSH log summaries for my Ubuntu 12.04 servers in Logwatch have started showing entries for "11: Normal Shutdown, Thank you for playing [preauth]" along with the "11: Bye Bye [preauth]" and "11: disconnected by user" messages they had been showing previously.  I have not seen this message in my logs before the past few weeks, nor have I seen it on my older servers which are stuck on Ubuntu 10.04. I have googled this message and can't find any clear explanations there either.  The IPs attempting to login and receiving this message are random hack attempts, and judging from the preauth I assume (hope) they are not successful, but I would like to know exactly what this message means and how it differs from others to be sure.  EDIT for additional information: My servers have password authentication and root authentication both disabled
110062
Recently a few friends and I came up with an idea for an app. To facilitate the creation of it, we set up LAMP on an Ubuntu Server 12.04. This box is running from my home. We've set up 3 user accounts. I'm still pretty new to Linux, but I have a bit of experience from using Ubuntu on my own box.  Today I was playing around with SSH and looking at the logs (I need to learn how to read that information to know how the server is performing, right?) and I saw the strangest thing.  In /var/log/auth.log and /var/log/auth.log.1 I saw a bunch of failed login attempts for 'root' and a few usernames I'm not familiar with. I looked over them and for as far as I can see no user has been authenticated except for the actual users on the system. A lot of the IP-addresses listed seem to be from Russia.  As of now this server contains nothing but a vanilla Ubuntu Server with LAMP, but even so, with the following command:  sudo grep -i fail /var/log/auth.log | wc -l   I get 3412 as a result. This seems very excessive for a server that has been up since April 8th. It gets worse, because running the above command on auth.log.1 returns 23075 (!!!!) results.  It seems obvious that people are trying to break into the server. Not that it contains anything of value, but once we start making progress on the app we wouldn't want our intellectual property stolen.  Should I be worried? And what can I do about it?  EDIT:  I found some very useful information  and this allowed me to run a script that splits and sorts all the invalid passwords and invalid users that tried to log in. May come in handy to someone who ended up here through Google!
22828
I have run the following commands:   sudo groupadd -r testgroup sudo useradd -g testgroup -M -r testuser   Notice the -r option, which according to the man page:     -r   &nbsp;&nbsp;&nbsp;&nbsp;Create a system account.   Assuming I have a user account with root privileges, I then run:  sudo -u testuser cat /dev/input/mouse0   However, I get:     cat: /dev/input/mouse0: Permission denied   Running the same command as root provides the expected output (garbled output from the mouse driver).  How can I create a user with root privileges?
81787
I am trying to figure out how a tty works1 (the work-flow and responsibilities of each elements). I have read several interesting articles about it, but there are still some blurry areas.  This is what I understand so far:   The emulated terminal makes different system calls to /dev/ptmx, the master part of the pseudo-terminal. The master part of the pseudo terminal allocates a file in /dev/pts/[0-N], corresponding to the obsolete serial port, and "attaches" a slave pseudo terminal to it. The slave pseudo terminal keeps information such as session Id, foreground job, screen size.   Here are my questions:   Has ptmx any purpose besides allocating the slave part? Does it provide some kind of "intelligence", or the emulated terminal (xterm for instance) has all the intelligence of behaving like a terminal? Why does xterm has to interact with the master part, as it only forwards the stdout and stdin of the slave part? Why can't it directly write and read from the pts file? Is a session ID always attached to one pts file and vice versa? Could I type a ps command and found 2 sessionId for the same /dev/pts/X? What other information does the pts store? Does Xterm update all fields by himself, or does the ptm add some "intelligence" on it?     1. I base my understanding on the , and the  posts, as on several other
101113
This is a idea for a security. Our employees shall have access to some commands on a linux server but not all. They shall e.g. have the possibility to access a log file (less logfile) or start different commands (shutdown.sh / run.sh).  Background information:  All employees access the server with the same user name: Our product runs with "normal" user permissions, no "installation" is needed. Just unzip it in your user dir and run it. We manage several servers where our application is "installed". On every machine there is a user johndoe. Our employees sometimes need access to the application on command line to access and check log files or to restart the application by hand. Only some people shall have full command line access.  We are using ppk authentication on the server.  It would be great if employee1 can only access the logfile and employee2 can also do X etc...  Solution: As a solution I'll use the command option as stated in the accepted answer. I'll make my own little shell script that will be the only file that can be executed for some employees. The script will offer several commands that can be executed, but no others. I'll use the following parameters in authorized_keys from as stated :  command="/bin/myscript.sh",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-dss AAAAB3....o9M9qz4xqGCqGXoJw= user@host   This is enough security for us. Thanks, community!
18828
In various shell scripts I often see two approaches for getting information from databases supported by Name Service Switch libraries like /etc/group, /etc/hosts or /etc/services. One is getent utility and other is grep or some other text processing tool. For example:  root@fw-test:~# getent passwd root root:x:0:0:root:/root:/bin/bash root@fw-test:~#    root@fw-test:~# grep root /etc/passwd root:x:0:0:root:/root:/bin/bash root@fw-test:~#    ..or:  root@fw-test:~# getent hosts www.blah.com 189.113.174.199 www.blah.com root@fw-test:~#   root@fw-test:~# host www.blah.com www.blah.com has address 189.113.174.199 root@fw-test:~#    Which of those two approaches above should be used in scripts? I mean is one of the solutions more elegant or standard than the other?
58230
I am setting up a server where there are multiple developers working on multiple applications.  I have figured out how to give certain developers shared access to the necessary application directories using the setgid bit and default ACLs to give anyone in a group access.  Many of these applications run under a terminal while in development for easy access. When I work alone, I set up a user for an application and run screen as that user. This has the downside that every developer to use the screen session needs to know the password and it is harder to keep user and application accounts separate.  One way that could work is using screen multiuser features. They do not work out-of-the-box however, screen complains about needing suid root. Does giving that have any downsides? I am pretty careful about using suid root anything. Maybe there is a reason why it isn't the default?  Should I do it with screen or is there some other intelligent way of doing what I want?
85670
Much like /etc/profile and ~/.profile but ran by root instead of the user is doing login. /etc/rc.local runs after boot but I need running the script before login. The user is not a sudoer one.   Thanks!
115867
I am completely new to *NIX based OSes. One of the things that baffles me is that a process or program may execute setuid(0) and then perform privileged operations and revert back to its normal uid.  My question is what is the mechanism in *NIX to prevent any arbitrary process from possessing root ?  If I write a simple C program that calls setuid(0) under what conditions will that call succeed and under what conditions will it fail ?
14584
Is there a way how you can check what auth method the user which just logged in to an account were using?  I like to print out a warning after login if someone is using a password instead of a keyfile.  Sure one solution is to check the ssh-logs. But is there a nicer way to do this? Since looking up logs could impact performance depending on the log size and method you use to gather this information.  We are using SUSE and Ubuntu.
92206
How do I automatically unlock the keyring at login on my Lubuntu 14.04 system?  There are a lot of answers to this problem on this site and Ubuntu Forums, but none are applicable to a 14.04 Lubuntu system - it appears that the Passwords and Keys dialog has changed significantly since those answers were supplied.   SO -    answers telling me to tick the box for "Unlock the keyring at login" in the Seahorse app do not work, because it is not there. answers (like ) telling me to tick the box on the "Unlock Keyring" dialog box to unlock it at login do not work, because it is not there auto-login was never set on this system, so that is not a contributor, and  does not apply the issue does not arise with Network Manager (like ), but rather with Deja-dup I do not want an answer that involves removing the keyring password entirely - like    How can this rather basic requirement be met on a Lubuntu 14.04 system?  [edit] - here is the dialog box requesting the keyring unlock.
2045
How does Linux know that it has to give euid 0 (uid of root) to only certain process like passwd, setuid, etc.  If a process can gain root permissions, will it not lead to potential security breaches in the Linux platform?   For example, if I write a program that can can gain root user permissions like passwd, I may corrupt important system files like /etc/passwd, /etc/groups.   How does Linux manage to still be secure?
85696
On my personal machine, I often type sudo in front of certain commands in order to accomplish administrative tasks.  I had hoped to avoid doing this throughout the day, by typing su root and providing the same password I usually do for sudo.  However, the two passwords are not the same(I don't know how to log in to su root).  Is running a command with sudo different than logging in with su root and running the same command?  I think sudo and su root are the same, because when I type sudo whoami, I get root, as opposed to just whoami where I get my user-name.