Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 11 Jan 2016 10:25:11 +0000
From: Tim Brown <tmb@...35.com>
To: oss-security@...ts.openwall.com
Subject: Re: Discuss: Daily/weekly cron jobs best practices

On Wednesday 06 January 2016 23:06:20 halfdog wrote:

> Are there more variants, arguments? In my opinion, b) is a good
> trade-off between maintainability and security.

Create scripts with secure permissions, write only to properly secured 
locations and execute as dedicated users with minimal privileges. Yes, there 
will still be problems but a lot of the most significant pain points go away.

> Currently the cron scripts seem to be a weak point. I looked at the 8
> daily scripts on my machine, 2 of them belonged to the "daemon"
> example class from above and both were vulnerable to daemon to root
> privilege escalation, see e.g. [1].

Not uncommon, we pop almost every UNIX box we touch this way, I assume you've 
seen unix-privesc-check?

Tim
-- 
Tim Brown
<mailto:tmb@...35.com>
[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ