Re: 'sudo' recommendations

alekzCS.MSU.SU

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: Paul Shields: "Re: Vulnerability in Netscape & Microsoft Web browsers"
• Previous message: SGI Security Coordinator: "IRIX Vulnerability in ToolTalk RPC Service"
• In reply to: Cy Schubert: "Re: 'sudo' recommendations"

On Wed, 18 Nov 1998, Cy Schubert wrote:

|You can also issue sudo -k to delete the sudo ticket before running
|something potentially dangerous.
|
|The problem you discuss is also an issue with Kerberos.  Any potential
|attacker could use cached Kerberos tickets to gain access to hosts,
|services, or privileges.  To circumvent this, kdestroy your Kerberos
|ticket or log in as a different user.
|

The same problem exists in NIS+ environment. Attacker can get right
credentials by issuing a command under already authenticated UID,
because all credentials (public and decryptded secret keys) are cached
by keyserv daemon and "indexed" by UID. The only way to get rid of
those cached information is to run keylogout command.

• Next message: Paul Shields: "Re: Vulnerability in Netscape & Microsoft Web browsers"
• Previous message: SGI Security Coordinator: "IRIX Vulnerability in ToolTalk RPC Service"
• In reply to: Cy Schubert: "Re: 'sudo' recommendations"