Find the weak spots

A strong front door (lesson 2) doesn't help if a window is open at the back. Once someone has any account on a server, even a boring one, they look for a way to become root. The ways in are nearly always the same few mistakes, so defenders check for exactly those, before anyone else does.

SUID: programs that run as their owner

Normally a program runs with your permissions. A program with the SUID bit (the s in -rwsr-xr-x) runs as the file's owner instead, and that's usually root. That's how passwd can change your password in /etc/shadow, a file you can't even read.

A few SUID programs are normal. They come from packages and are written very carefully. But a general tool with SUID, like find, vim or bash, lets anyone run commands as root. Find every one:

sudo find / -perm -4000 -type f 2>/dev/null

Then, for anything you don't recognise, ask the package manager who put it there:

Files anyone can change

A file with w for "others" can be changed by every account on the machine. That's bad for any file, and a disaster for a script that root runs (from cron or a service): whoever edits the script decides what root does next.

sudo find / -xdev -type f -perm -0002 2>/dev/null      # files anyone can write
grep -r . /etc/cron.d/ /etc/crontab                    # what does root run, and from where?

Scripts that root runs should be owned by root and writable only by root: sudo chown root:root FILE and sudo chmod 755 FILE (or 700).

/etc/shadow: the password hashes

/etc/shadow holds everyone's password hashes. If others can read it, anyone with an account can copy it and try to crack the passwords offline, where nothing slows them down. The two families protect it a little differently:

sudo rules and least privilege

Who may use sudo, and for what, is written in /etc/sudoers and the files in /etc/sudoers.d/. A rule looks like this:

deploy  ALL=(root)  NOPASSWD: /usr/bin/systemctl restart httpd
# WHO    WHERE=(AS WHOM)  [no password:] WHICH COMMANDS

Least privilege means each account gets exactly what its job needs. A deploy account that only restarts the website needs that one command, not ALL. With NOPASSWD: ALL, anyone who steals that account's key is root at once.

Try it: audit the club server 🔍

You're doing a check-up on a server that several people have "quickly fixed" over the years. Find the four weak spots and close them.

Quick check