Identifying the Potential Troublemakers — Fast

439

Just turning on the setuid or setgid bit for a program isn’t enough to let intruders sneak into your system. They still need to have execute privileges, either from their own logins or someone else’s.

Identifying the Potential

Troublemakers — Fast

Search your system with the find command, and you’ll be surprised at how many setuid and setgid programs you have. Most of these programs are benign, but a real troublemaker needs only one good opportunity to get in. Changing the setuid or setgid bit can close a door before a hacker finds it open.

The first step in checking your system for back doors through setuid and setgid is to figure out which programs have setuid and setgid turned on. You have two ways of doing this: By using an easy- to-use program called kfind or by working from the command line. The following sections have all the details.

Finding setuid quickly and easily with kfind

The KDE Desktop includes a great tool called kfind that can help you find the setuid programs on your system in no time. kfind has a friendly graphical interface that leads you to the setuid programs on your system with just a few mouse clicks.

To use the kfind File Finder to locate the setuid programs on your system, follow these steps:

1. Open the Main Menu and choose Run

Command.

2. Enter kfind in the Command field and then click Run.

The kfind Find Files dialog opens, as shown in Figure 57-1.

kfind can find all sorts of files for you. It’s a handy tool worth getting to know.

If you’re running KDE, you can also start kfind by opening the Main Menu and clicking Find Files.

•Figure 57-1: The kfind Find Files dialog.

3.On the Name/Location tab, use the * default entry in the Named field.

This suits our purposes well — we want to find all the files that have the setuid bit set.

4.Enter the directory you want to search in the Look In field.

For a thorough system search, start with a search of the root directory. Just enter a / in the Look In field.

5. Choose the Contents tab and choose SUID

Executable Files from the File Type drop-down list.

440 Technique 57: Search and Destroy setuid and setgid Programs

6. Click the Find button in the upper-right corner of the screen.

The search begins. Depending on how much of your system you’re searching, the process can take a while. Now’s a good time to go get a cup of coffee.

When the search is complete, a list of the files with the setuid bits turned on displays in the results frame, as shown in Figure 57-2.

•Figure 57-2: Search results for setuid programs.

7.Cruising through the list of names in the result set, you should recognize most of the programs as commands you use. If a program is unfamiliar, check it out (see “Deciding to Turn Off setuid or setgid” later in this technique for details).

The File Finder searches only for setuid programs. For a list of the setgid programs on your system, you use the command line. The next section has all the details.

Searching out setuid and setgid programs at the command line can also save you time by showing you a complete list of ownership and privileges at the same time. Use the File Finder for a quick glance, but review any questionable programs in a terminal window.

Finding setuid and setgid programs at the command line

If you don’t have a desktop environment or need more information about a questionable program you found with the KDE File Finder, the command line can give you a more complete rundown on the ownership and privileges of a setuid or setgid program.

To use the command line to generate a complete list of the setuid programs on your system, open the terminal window, give yourself superuser privileges with the su command, and enter the following command:

#find / -perm +u+s -type f -ls

The results look something like Figure 57-3.

• Figure 57-3: The programs in the root directory with the setuid bit turned on.

To locate setgid programs on your system, you use a slight variation on the find command:

#find / -perm +g+s -type f -ls

To use the find command to locate all the setuid and setgid programs on your system, use the following command:

find / -perm +ug+s -type f -ls