[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3412231.rSTmOYfSpU@sarpedon>
Date: Mon, 11 Jan 2016 10:25:11 +0000
From: Tim Brown <tmb@...35.com>
To: oss-security@...ts.openwall.com
Subject: Re: Discuss: Daily/weekly cron jobs best practices
On Wednesday 06 January 2016 23:06:20 halfdog wrote:
> Are there more variants, arguments? In my opinion, b) is a good
> trade-off between maintainability and security.
Create scripts with secure permissions, write only to properly secured
locations and execute as dedicated users with minimal privileges. Yes, there
will still be problems but a lot of the most significant pain points go away.
> Currently the cron scripts seem to be a weak point. I looked at the 8
> daily scripts on my machine, 2 of them belonged to the "daemon"
> example class from above and both were vulnerable to daemon to root
> privilege escalation, see e.g. [1].
Not uncommon, we pop almost every UNIX box we touch this way, I assume you've
seen unix-privesc-check?
Tim
--
Tim Brown
<mailto:tmb@...35.com>
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
