• Home

CodingExperiments.com

$ sudo make money

Search

Category:

  • Apple Inc.
  • Facts
  • Fun
  • Google
  • Google Android
  • Ideas
  • Internet
  • Linux
  • Microsoft
  • Programming
  • Rants
  • Security
  • Uncategorized
  • web 2.0

Archives:

  • April 2010
  • August 2009
  • July 2009
  • June 2009
  • May 2009
  • April 2009
  • March 2009
  • February 2009
  • January 2009
  • December 2008
  • November 2008
  • October 2008
  • September 2008
  • August 2008
  • July 2008
  • June 2008
  • May 2008
  • April 2008
  • March 2008
  • February 2008
  • January 2008
  • December 2007

Pages

  • About
  • About
    • The Authors
  • Commenting your code
  • How to Write Papers with Groff
  • ModCMS Anti-Spam Component Set
  • ModCMS Technical Specifications
  • Regular Expressions Guessing Game
  • Saving code directly to a web server
  • The (Almost) Perfect PHP 404 Page

Meta:

  • RSS
  • Comments RSS

Awesomeness tracker

CodingExperiments at Blogged View blog authority
Free Page Rank Tool

Sudo: Not secure enough

January 19th, 2008 by Rishabh Mishra

UPDATE: I really don’t think that this is a problem anymore. I think that this is a rather silly post. Please ignore it.

This post assumes that you know a few things about Unix-based operating systems. You will need to know about su and sudo as well as what the root or superuser is.

Some people know this, and some people don’t. On Ubuntu-based systems, by default, the root user has a complex, randomly generated password and is generally not used. The idea is to have a “sudo-capable” user that is able to do root tasks with the “sudo” command. It allows you to be root for one command and requests your password instead of the root password. That way, the root password isn’t shared. If a virus attempts to use sudo, it meets a password dialog.

If you try to use su, which basically gives you the terminal of another user, you have to type their password. If you try to use su to be root, you would have to know the complex root password. This isn’t so if you type “sudo su”. That gives you the root terminal without requiring the complex password.

I think that this is a minor security flaw as it defeats the point of the complex random password that is set to the root user by default.


Posted in Rants | View Comments

  • i80and

    It's not really a security flaw as much as it is too complex. UNIX is concentrated essence of simplicity, because the simpler a system is the less likely it is to fail and the easy to fix it is.
    Come up with an exploit that uses Ubuntu's use of sudo. I dare you :P

blog comments powered by Disqus

 
Wordpress Themes by and Website Templates by Blogcut Blogged Blog Directory Blog Directory - Blogged