Date: Mon, 11 Jan 2016 10:25:11 +0000 From: Tim Brown <tmb@...35.com> To: oss-security@...ts.openwall.com Subject: Re: Discuss: Daily/weekly cron jobs best practices On Wednesday 06 January 2016 23:06:20 halfdog wrote: > Are there more variants, arguments? In my opinion, b) is a good > trade-off between maintainability and security. Create scripts with secure permissions, write only to properly secured locations and execute as dedicated users with minimal privileges. Yes, there will still be problems but a lot of the most significant pain points go away. > Currently the cron scripts seem to be a weak point. I looked at the 8 > daily scripts on my machine, 2 of them belonged to the "daemon" > example class from above and both were vulnerable to daemon to root > privilege escalation, see e.g. . Not uncommon, we pop almost every UNIX box we touch this way, I assume you've seen unix-privesc-check? Tim -- Tim Brown <mailto:tmb@...35.com> Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ