Ability to escalate to root privileges
Posted: Wed May 23, 2018 8:01 am
We recently had a security audit and pen test completed against our network and below is one of the findings for our Nagios server. I was hoping I could get some direction on securing the install without breaking any of the functionality. Below is a description of what the auditor found.
Description The nagios user on the internal Nagios server is allowed to execute numerous
scripts as root that it also has the ability to modify. This defeats the purpose of restricted
sudo permissions, because those scripts can be modified to contain arbitrary commands. For
example, we temporarily replaced one of the scripts with the following
contents, which granted unrestricted sudo access to the nagios user when the script was
executed via sudo:
#!/bin/bash
echo -e "nagios\tALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
Description The nagios user on the internal Nagios server is allowed to execute numerous
scripts as root that it also has the ability to modify. This defeats the purpose of restricted
sudo permissions, because those scripts can be modified to contain arbitrary commands. For
example, we temporarily replaced one of the scripts with the following
contents, which granted unrestricted sudo access to the nagios user when the script was
executed via sudo:
#!/bin/bash
echo -e "nagios\tALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers