[gentoo-user] hardened: setuid

[gentoo-user] hardened: setuid

[James]

Hello

I was performing a routine security audit using:

find / -user root -perm -4000 -print

which found these peculiar files:

/usr/athena/bin/su
/usr/athena/bin/otp
/usr/athena/bin/rcp
/usr/athena/bin/rsh
/usr/athena/bin/rlogin


upon greater inspection this is most troubling:

-rws--x--x 1 root root 108416 May  4 19:52 /usr/athena/bin/su
-rws--x--x 1 root root 105640 May  4 19:52 /usr/athena/bin/otp
-rws--x--x 1 root root 95840 May  4 19:52 /usr/athena/bin/rlogin


Are these part of a normal gentoo system running hardened, or is it 
time to re-install this machine?


James




-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] hardened: setuid

[Mark Shields]

[-- Attachment #1: Type: text/plain, Size: 835 bytes --]

n 7/12/06, James <wireless@tampabay.rr.com> wrote:
>
> Hello
>
> I was performing a routine security audit using:
>
> find / -user root -perm -4000 -print
>
> which found these peculiar files:
>
> /usr/athena/bin/su
> /usr/athena/bin/otp
> /usr/athena/bin/rcp
> /usr/athena/bin/rsh
> /usr/athena/bin/rlogin
>
>
> upon greater inspection this is most troubling:
>
> -rws--x--x 1 root root 108416 May  4 19:52 /usr/athena/bin/su
> -rws--x--x 1 root root 105640 May  4 19:52 /usr/athena/bin/otp
> -rws--x--x 1 root root 95840 May  4 19:52 /usr/athena/bin/rlogin
>
>
> Are these part of a normal gentoo system running hardened, or is it
> time to re-install this machine?
>
>
> James
>
>
>
>
> --
> gentoo-user@gentoo.org mailing list
>
>
Not normal.  I use hardened on two seperate servers and don't have those
files.

-- 
- Mark Shields

[-- Attachment #2: Type: text/html, Size: 1258 bytes --]

Re: [gentoo-user] hardened: setuid

[Mick]

[-- Attachment #1: Type: text/plain, Size: 338 bytes --]

On Wednesday 12 July 2006 20:21, James wrote:

> which found these peculiar files:
>
> /usr/athena/bin/su
> /usr/athena/bin/otp
> /usr/athena/bin/rcp
> /usr/athena/bin/rsh
> /usr/athena/bin/rlogin

Did you ever install RedHat, or parts of?  I guess that's what these files 
seem to be, but I am not sure.
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-user] Re: hardened: setuid

[James]

Mick <michaelkintzios <at> gmail.com> writes:

> 
> On Wednesday 12 July 2006 20:21, James wrote:
> 
> > which found these peculiar files:
> >
> > /usr/athena/bin/su
> > /usr/athena/bin/otp
> > /usr/athena/bin/rcp
> > /usr/athena/bin/rsh
> > /usr/athena/bin/rlogin
> 
> Did you ever install RedHat, or parts of?  I guess that's what these files 
> seem to be, but I am not sure.


I have not seen any indication of comprimise.
Yes the system had redhat some years ago. It's entirely possible the same
partition table was used and therefore these residual files are artifacts
of a previous installation. My googling did not find any thing.

Where did you find out they are redhat files?


James

-- 
gentoo-user@gentoo.org mailing list

[gentoo-user] Re: hardened: setuid

[Mick]

On 12/07/06, James <wireless@tampabay.rr.com> wrote:

> I have not seen any indication of comprimise.
> Yes the system had redhat some years ago. It's entirely possible the same
> partition table was used and therefore these residual files are artifacts
> of a previous installation. My googling did not find any thing.
>
> Where did you find out they are redhat files?

Have a look here:

http://rpmfind.net/linux/RPM/Red_Hat_Contrib-Net__rhcn-bugs_redhat.com_.html
http://web.mit.edu/ist/topics/linux/linux-athena.html
http://web.mit.edu/ist/topics/athena/differences.html

I have found that re-using partitions without zeroing them first,
using e.g. dd, or without making a new fs over them ends up in old
files being suddenly resurrected . . .
-- 
Regards,
Mick
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] hardened: setuid

[Donnie Berkholz]

[-- Attachment #1: Type: text/plain, Size: 838 bytes --]

James wrote:
> Hello
> 
> I was performing a routine security audit using:
> 
> find / -user root -perm -4000 -print
> 
> which found these peculiar files:
> 
> /usr/athena/bin/su
> /usr/athena/bin/otp
> /usr/athena/bin/rcp
> /usr/athena/bin/rsh
> /usr/athena/bin/rlogin
> 
> 
> upon greater inspection this is most troubling:
> 
> -rws--x--x 1 root root 108416 May  4 19:52 /usr/athena/bin/su
> -rws--x--x 1 root root 105640 May  4 19:52 /usr/athena/bin/otp
> -rws--x--x 1 root root 95840 May  4 19:52 /usr/athena/bin/rlogin
> 
> 
> Are these part of a normal gentoo system running hardened, or is it 
> time to re-install this machine?

Have you tried checking which (if any) packages own these files? Have
you built anything yourself outside of portage that could have installed
them?

Thanks,
Donnie


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]

[gentoo-user] Re: hardened: setuid

[James]

Donnie Berkholz <dberkholz <at> gentoo.org> writes:


> > /usr/athena/bin/su
> > /usr/athena/bin/otp
> > /usr/athena/bin/rcp
> > /usr/athena/bin/rsh
> > /usr/athena/bin/rlogin

> > upon greater inspection this is most troubling:

> > -rws--x--x 1 root root 108416 May  4 19:52 /usr/athena/bin/su
> > -rws--x--x 1 root root 105640 May  4 19:52 /usr/athena/bin/otp
> > -rws--x--x 1 root root 95840 May  4 19:52 /usr/athena/bin/rlogin

> > Are these part of a normal gentoo system running hardened, or is it 
> > time to re-install this machine?

> Have you tried checking which (if any) packages own these files? Have
> you built anything yourself outside of portage that could have installed
> them?

Well I used --tree and it revealed nothing.

No this system does not have any cvs or portage overlay packages....


James





-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Re: hardened: setuid

[Donnie Berkholz]

[-- Attachment #1: Type: text/plain, Size: 424 bytes --]

James wrote:
> Donnie Berkholz <dberkholz <at> gentoo.org> writes:
>> Have you tried checking which (if any) packages own these files? Have
>> you built anything yourself outside of portage that could have installed
>> them?
> 
> Well I used --tree and it revealed nothing.

--tree? How does it tell you what owns these files? Try something like
equery or qfile (gentoolkit or portage-utils).

Thanks,
Donnie


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]