4 ms·
This would be execve() that did not go through PAM dance and end up being privileged process. I _think_ it’ll look very different in ps —-forest output.
by ivlad 3y ago
This would be execve() that did not go through PAM dance and end up being privileged process.
I _think_ it’ll look very different in ps —-forest output.
- amscanne 3y agoIt’s true that there’s a precise set of circumstances that would be different for the RCE (the lack of a PAM dance prior, same process group & session, no allocation of a pseudo-terminal, etc.). My point was merely that I don’t think they are commonly encoded in rule sets or detection systems. It’s certainly possible, but my guess is sshd is likely to have a lot of open policy. I’m really curious if someone knows different and there are hard detection for those things. (Either way, I bet there will be in the future!)
- ivlad 3y agoI am trying to figure out if auditctl is expressive enough to catch unexpected execve() from sshd: basically anything other than /usr/bin/sshd (for privsep) executed with auid=-1 should be suspicious.