[CentOS] Another Fedora decision

[Valeri Galtsev]

On Mon, February 9, 2015 10:55 am, Bowie Bailey wrote:
> On 2/5/2015 8:20 PM, Always Learning wrote:
>> On Fri, 2015-02-06 at 10:50 +1100, Kahlil Hodgson wrote:
>>
>>> On 6 February 2015 at 10:23, Always Learning <centos at u64.u22.net>
>>> wrote:
>>>> Logically ?
>>>>
>>>> 1. to change the permissions on shadow from -rw-x------ or from
>>>> ---------- to -rw-r--r-- requires root permissions ?
>>>>
>>>> 2. if so, then what is the advantage of changing those permissions
>>>> when
>>>> the entity possessing root authority can already read shadow - that
>>>> entity requires neither group nor user permissions to read shadow.
>>> The concept in play here is privilege escalation.
>>>
>>> An exploit may not give you all that root can do, but may be limited
>>> to, say, tricking the system to change file permission.
>>>  From there an attacker could use that and other exploits to escalate
>>> privileges.
>> How could file permission modification of /etc/shadow be used to
>> "escalate privileges" ?
>
> If I can give myself read access to /etc/shadow, then I can grab a copy
> and try to crack the passwords (including the root password). If I can
> give myself r/w access, then I can directly change the password and give
> myself instant access to everything.
>


I guess, this discussion (about security of your system and what affects
it) should be ended by the reference to fundamental book on Unix system
[administration]. One thing I learned: you can not become proficient in
any subject just by reading sparse blogs about it. One thing you
definitely need: very good understanding of underlying fundamentals. For
this reason the most productive would be to think if you have very good
general understanding of how Unix (or Unix-like) system works. The easiest
is to start reading good book about it, and if you see you are making
discoveries, then this is definitely what you are missing, and what you
need to study before diving into discussion what is good for security and
how it affects that. That would be what I would recommend to myself (which
I did way back...). If I were choosing the book to get good start today, I
would choose:

UNIX and Linux System Administration Handbook (4th Edition) 2010 by Evi
Nemeth and Garth Snyder

- don't worry about "outdated...", remember, you first need fundamentals.
It is not as "fundamental" as some of the books of the past I remember,
but I'd rather mention it that those really old books.

I'm sure, someone may suggest better book, maybe even free online book.
Note, your advise of book giving fundamental knowledge of Unix or Linux
system may be really valuable.

Just my $0.02

Valeri

++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++