3 ms·

Use the absolute path to any */sbin utilities :-)

• jwilk 9y ago
  Doesn't help much. Once the attacker took over the account, nothing you do or see can be assumed to be real. For example, the attacker could inject a LD_PRELOAD library that redirects execve() calls from /usr/bin/sudo to a fake version of sudo.
  • icebraining 9y ago
    You can't LD_PRELOAD on a SUID binary like sudo. That said, I agree with your main point - one should use a different account altogether.
    • jwilk 9y ago
      I meant preloading it in the shell. The real /usr/bin/sudo would be never executed, so it wouldn't matter if it's suid or not.
      • icebraining 9y ago
        How can you preload in the shell? Isn't it launched by sshd, which you can't configure?
        • jwilk 9y ago
          You can't configure which shell is run, but you can usually configure the shell (in ~/.profile or a similar file). Or, if the server is running Debian, you can set environment variables the .pam_environment file: https://bugs.debian.org/761600 https://bugs.debian.org/761600
          • icebraining 9y ago
            I don't think .profile runs before the shell is spawned, does it? The .pam_environment one is interesting, thanks for the link.
            • lvh 9y ago
              You can still exec into a new shell, for example.