Working with the Unix OS

Unix Security
uid=10(pat) gid=10000(ITB100)
$ mkrmdir
! Programming as root
- some routines can only be called from a process whose effective UID is zero (a root process)
- setuid() & setgid() - behaves differently for root
The "init" program is started when the system is started. It is run as a root process with both its effective and
real UIDs set to zero. init starts "getty" on a terminal which starts "login" once a user begins logging in.
Thus, both getty and login run as root processes. So when login is started, it runs with effective and real UIDs of 0.
After the password is validated, login must be able to set effective and real UIDs to that of the user logging in
before the user's shell is started (i.e. setuid(user's UID)).
- chown() - does (not) remove the SUID permissions
- chroot() - changes a process's idea of what the root directory is.
$ cat chrt.c
/* chrt must be SUID to root */
main ()
{
chdir("/restrict");
chroot("/restrict");
setuid(getuid));
execl("/bin/sh", "sh", 0);
}
$ grep chrt /etc/passwd
ruser::900:900:restricted:/restrict:/usr/local/bin/chrt
- mknod() & unlink() - make and remove special files
- mount() & umount() - access to filesystem
Security for Administrators
! Preventing unauthorized access:
user awareness, password management, login activity and reporting, periodic audits of user and network use
! Preventing compromise:
keeping users from accessing each other's sensitive information, file system audits, su logging and reporting, user
awareness, and encryption
! Preventing denial of service:
should be implemented by OS, disk quotas, process limits
! Preventing loss of integrity:
periodic backups of file systems, running fsck, and s/w testing
System Security Officier
- initiates and monitors auditing policy
- determines which users and events are audited
- maintain secure password system
- initialize directory access privileges on files authorizes new user accounts
- checks file system for SUID/SGID programs
- verifies integrity of system executable files
System Administrator
- implements auditing procedures
- inspects and analyzers audit log
- administers group and user accounts
208