MORE SSH Hacking: heads-up

[netmask]

> You know where this thread is coming from, what the starting point was.
> It is exactly that, that obviously too much Linux admins believe that
> Linux is secure by architecture or what else. It is obvious from my
> investigations too, that the hackers/crackers get access to vulnerable
> Linux hosts as unprivileged users and then using local exploits to
> become root. I know, many Linux admins think local root exploits are
> much less severe than remote root exploits. This is wrong and we now see
> to what it leads, unfortunately.

Remote root is certainly nice.. however these days it is a lot more common to 
gain access remotely via a process with drop'd privs.. You then have to find a 
local exploit to escalate privileges.

Sometimes we get lucky and exploits in PHP come out where the exploit is 
handled before privs are dropped.. and you get root. Other times in apache 
exploits, you end up as the 'nobody' user.

However, I treat local vulnerabilities as serious as remote. While it's 
definitely the smart thing to do to put your processes in jails, and make sure 
they aren't running as root.. It's just not possible to completely not run as 
root while the stack requires root privs to bind ports under 1024, and a few 
other reasons (device access, etc)..  Jails can be broken, etc.

The 'vulnerabilities' I don't worry about it.. are things like the 'info' 
overflow that came out last week on Bugtraq. Is your 'info' binary suid root? 
Do you give people 'sudo info' ?  No.. Do I really care if someone injects 
shellcode into their instance of info and drop to their own privs? not really.

But when you are talking about vulns in su, sudo, etc.. anything that is suid 
on the system (On my server that doesn't run any X.. there is only a need for 
4 suid bins total).

blah blah blah, security if a process..  blah blah, etc etc.

:P