Sudoers and other Security discussions (Split From Box86 Thread )

[levi]

Oh, so you can use usernames in sudoers. I don't use that. Instead I have this line in my sudoers:
%sudo ALL=(ALL) ALL

This allows all users in group sudo to use sudo.

 

[netcat]

don't forget to make it passwordless sudo otherwise it's a huge PITA:

ALL=(ALL) NOPASSWD: ALL

 

[TrashyMG]

don't forget to make it passwordless sudo otherwise it's a huge PITA:

ALL=(ALL) NOPASSWD: ALL

The security system admin part of me cringes at this method, but I suppose it is a handheld device...

 

[PowerGod]

The security system admin part of me cringes at this method, but I suppose it is a handheld device...

I suppose that with handheld devices the security should be stronger... you don't go around with your desktop home PC.

But if the device is used only for gaming without any kind of connection to personal data, that's another story.

 

[levi]

No, I don't do that, else someone with access to my computer while I'm not there could sudo rm -rf / or something equally odious. I find the ten minutes of passwordless sudo provided by sudo natively to be enough, or if it's not I can spawn a sudo su session for longer access.

 

[netcat]

if security is important encrypt things.

 

[levi]

I do encrypt my home directory and my backup discs separately. But if my machine gets hacked while I'm logged in (which is usual since I log in shortly after turning it on, and usually turn it off by running poweroff from my logged in account), it won't help. It will stop people stealing my computers stealing my data since to move them you'll need to power them down, but I consider compromises against online access to me more likely. Which is why I limit what my browser can do and where I run it, and how I connect computers together, as well as staying on top of the latest patches.

 

[ClockworkCoder]

if security is important encrypt things.

Security !== Privacy

 

[ElPoco]

There are also remote hacks that will be blocked by a sudo password request.

 

[netcat]

If someone is trying sudo from you account then it's already compromised and all your user data is accessible so best encrypt the sensitive stuff (not just the fs).

Gaining root access would allow someone to modify system files eg libgpg.so to eg forward your unencrypted data out. But that can be achieved without root access too, eg via modified PATH, LD_PRELOAD, etc. So many ways in my mind melts.

Why don't we all run our browsers as restricted users? A) laziness B) our browsers (and google) already know most passwords.

Requiring a sudo password merely protects system files. Like you won't be able to do rm -rf / as easily. Ok. If that's a risk it's your own problem. PLEASE STEP AWAY FROM THE COMPUTER.

If you are worried about someone taking control of your computer use file integrity monitoring. I do this on my server and also have a little report script that I read every morning in bed. It does geoip lookups for location and companies even. Interesting to see where hacks originate. Usually it's apple, google and kindergartens in china. Note: resolv.conf is modified. wtf. Need to read up as to why.

Yesterday was a mild day I got 1.3m of hack traffic. I used to get 500+m daily. My only accessible ports are ssh and smtp.

Fundamentally I am in favor of a small number of tight security practices, not a slew of half assed ones.

Interested in your comments. Happy to learn about new and fabulous hacks.

Actually, @levi is right. rm -rf / is more likely - and a funny prank. But wiping ~ is probably funny enough. If you consider this a risk I suggest offline backups.


/^2022 Feb 22/ /var/log/msgs

[2022 Feb 22 00:00:01 - 2022 Feb 22 23:59:01]

[_ignore] 45
9 x sshd.*:info Invalid user .* from
9 x sshd.*:info Received disconnect from .* disconnecting normally
9 x sshd.*:info input_userauth_request: invalid user
9 x sshd.*:notice pam_unix\(sshd:auth\): authentication failure
9 x sshd.*:warning pam_unix\(sshd:auth\): check pass; user unknown

[ssh:reject] 9
5 x - 45.155.204.161 invalid user admin password
4 x - 45.135.232.200 invalid user admin password

[smtp:sent] 2
2 x root@xxx.ch -> xxx@gmail.com

[smtp:reject] 17
4 x - 31.210.22.177 spameri@tiscali.it -> spameri@tiscali.it
3 x RU 212.192.246.221 spameri@tiscali.it -> spameri@tiscali.it
2 x NL 37.0.15.241 spameri@tiscali.it -> spameri@tiscali.it
- 2.56.57.31 spameri@tiscali.it -> spameri@tiscali.it
- 31.210.20.7 spameri@tiscali.it -> spameri@tiscali.it
- 31.210.22.180 spameri@tiscali.it -> spameri@tiscali.it
- 85.202.168.37 spameri@tiscali.it -> spameri@tiscali.it
- 85.202.169.127 spameri@tiscali.it -> spameri@tiscali.it
- 85.202.169.147 spameri@tiscali.it -> spameri@tiscali.it
RU 212.193.29.49 spameri@tiscali.it -> spameri@tiscali.it
ZA 41.13.24.77 spameri@tiscali.it -> spameri@tiscali.it

[smtp:shenanegans] 293
112 x VN 103.207.37.125 44 Hanoi -
98 x FR 193.56.29.119 - - -
26 x FR 193.56.29.154 - - -
12 x - 31.210.22.177 - - -
6 x NL 37.0.15.241 - - -
6 x RU 212.192.246.221 - - -
4 x SE 178.73.215.171 - - Portlane AB
3 x - 31.210.22.180 - - -
3 x - 85.202.169.127 - - -
3 x CN 117.50.173.133 05 Changchun -
3 x RU 212.193.29.49 - - -
3 x US 167.94.145.59 AZ Scottsdale SCOTTSDALE HEALTHCARE
3 x US 216.218.206.66 CA Fremont Hurricane Electric, Inc.
3 x ZA 41.13.24.77 06 Johannesburg VODACOM-ZA
2 x - 2.56.57.31 - - -
2 x - 31.210.20.7 - - -
2 x - 85.202.168.37 - - -
2 x - 85.202.169.147 - - -

1298 ( 1298) CRON.*:info
321 ( 321) postfix/anvil.*:info
299 ( 0) postfix/smtpd.*:info
36 ( 0) sshd.*:info
12 ( 12) kernel:notice
11 ( 0) postfix/smtpd.*:warning
10 ( 10) systemd.*:info
9 ( 0) sshd.*:notice
9 ( 0) sshd.*:warning
4 ( 4) postfix/qmgr.*:info
4 ( 2) postfix/smtp.*:info
2 ( 2) postfix/cleanup.*:info
2 ( 2) postfix/pickup.*:info
1 ( 1) tripwire.*:notice

[df]
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 19G 8.8G 8.8G 50% /

[muckolla]
* /etc/resolv.conf

[rxtx]
day >>1.3m <<253k | >>1.3m <<253k
week >>1.3m <42k | >>9.2m <<2.3m
month >>1.3m <<401k | >> 41m << 11m

[last]

wtmp begins Fri May 21 17:20:34 2021

[lastb]
admin ssh:notty 45.155.204.161[??] Tue Feb 22 19:05 - 19:05 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 19:05 - 19:05 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 19:05 - 19:05 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 19:05 - 19:05 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 19:05 - 19:05 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 19:05 - 19:05 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 19:05 - 19:05 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 19:05 - 19:05 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)
admin ssh:notty 45.155.204.161[??] Tue Feb 22 02:54 - 02:54 (00:00)

btmp begins Thu May 27 20:42:10 2021

[vmstat]
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
0 0 9036 1286088 17828 622968 0 0 13 1 0 2 0 0 100 0 0

[nmap]
Starting Nmap 6.40 ( http://nmap.org ) at 2022-02-23 00:01 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000011s latency).
Not shown: 65529 closed ports
PORT STATE SERVICE
25/tcp open smtp
143/tcp open imap
9091/tcp open transmission
44022/tcp open sshd
44080/tcp open httpd
51413/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 6.93 seconds

elapsed: 20.239s

 

[levi]

Fundamentally I am in favor of a small number of tight security practices, not a slew of half assed ones.

Yes, I'm not sure which is the worst offender in that space, historically it was always microsoft releasing patches to patch their previous patch against a bug, but recently I've seen cisco doing the same. I've not seen the same happening in linux. It perhaps doesn't help that even if you're debian and decide what's a fix against what's feature improvement, every time you patch the kernel that's still a few dozen MB of kernel package to download. Personally I prefer arch which doesn't distinguish between bug fixes and general improvements, and just takes patches as they come.

 

[ptitSeb]

Can you please continue this security discussion in another thread?

 

[netcat]

Obviously Box86 is insecure

 

[matzesu]

Box 86 is quite secure: Windows Viruse first need an Command to be abble to get run ^^

I wonder: Dit someone allready test if Itunes runs via Wine?
Whit Apple Music, Itunes might not be that important, but somethimes i want to make "Smart Playlist" (Play everything from Year 2022)
Until i find out how to install Winetricks, i could experiement whit some non gaming Windows Stuff ^^

 

[netcat]

Please let's keep this thread on security not derailed by Box86

 

[FBnil]

don't forget to make it passwordless sudo otherwise it's a huge PITA:

ALL=(ALL) NOPASSWD: ALL

Is it not better to identify which commands you need often?

%sudo ALL=(ALL) NOPASSWD: /usr/bin/dmesg
%sudo ALL=(ALL) NOPASSWD: /usr/bin/apt-get
%sudo ALL=(ALL) NOPASSWD: /usr/bin/mount

 

[netcat]

no way jose too sensible

 

[FBnil]

In that case, what about sudo su - with one password and you are root and then you can do unsafe stuff and then exit back to your lower privileges ?

 

[levi]

Nah, no password for sudo su seems far too powerful to me. It may also be the first thing a hacker might try, to elevate privs and hope there was no password set for that. You could probably do quite nasty things with apt-get too but it should always be recoverable with a boot disc, although maybe it's a way to sequester data if you have control of the network. Mount is probably even better in that instance, since you can use that to set usernames and passwords which are essentially free text to an attacker.

 

[netcat]

Actually my one hack was due to passwordless sudo.......

I woke up one morning and my little website said "root anonym". Hacked by anonymous? I'm flattered..

Someone else with a VM on the LAN must have been snooping my traffic while I was setting up my mail server and initially sent my password as cleartext. They used that to login to my user account then sudo'd to root and locked me out of my box.

Then I went mental, reinstalled and hardened everything. No passwordless sudo. But just my user account compromised was bad enough. Root was icing on the cake.

EDIT: this was when I decided to go back to Linux after years of Mac's....