Re: [Slightly OT] - Socket Security

From: Kevin Collins (spamtotrash_at_toomuchfiction.com)
Date: 05/14/04 

Date: Fri, 14 May 2004 15:52:23 GMT

In article <c814da$kl8$0@208.20.133.66>, Bruce Barnett wrote:
> spamtotrash@toomuchfiction.com (Kevin Collins) writes:
>
>> I am working on a security project identifying, tracking and reporting on
>> world-writable files on all of our systems. I have a fairly sophisticated
>> filtering system which can ignore (for example) files in a directory with the
>> sticky-bit set, temp directories (/tmp, /var/tmp), etc.
>>
>> My trouble comes in where sockets are concerned - do I need to worry about what
>> the security bits are on a socket? What are the issues if a socket is
>> world-writable? I suspect there is some security issue because there are
>> applications that have a special, sticky-bit directory where all sockets are
>> written.
>>
>> Any help would be appreciated.
>
> This doesn't address sockets, but it does let you know how vulnerable
> your system is to trojan horses.
>
> i.e. if you have /usr/bin in your search path, and it is group
> writable, this program will tell you who can drop a trojan in your
> path. It gives you a score - telling you the percentage of files in
> your search path than can be trojaned.
>
> See
>
> http://ftp.cerias.purdue.edu/pub/tools/unix/sysutils/trojan/
>
> It also looks at symbolic links, permissions of directories that
> contain directories, etc.

I don't think I've ever seen a system with a group-writable /usr/bin. That
would be a (TM) Bad Thing...

Kevin

Relevant Pages

  • Re: [Slightly OT] - Socket Security
    ... > spamtotrash@toomuchfiction.com (Kevin Collins) wrote: ... >> I am working on a security project identifying, ... What are the issues if a socket is ... > I think most versions of Unix ignore the permissions on Unix domain ...
    (comp.unix.shell)
  • Re: [Slightly OT] - Socket Security
    ... spamtotrash@toomuchfiction.com (Kevin Collins) wrote: ... >> your system is to trojan horses. ... there are no users (other than root) in that group, ...
    (comp.unix.shell)