4 ms·
and how would the "benign attacker" know the super user password that sudo will ask for? its not like this is a logged in ssh session.
by metaphorm 12y ago
and how would the "benign attacker" know the super user password that sudo will ask for? its not like this is a logged in ssh session.
- nacnud 12y agoExtremely good point, thank you. :)
- jtheory 12y agosudo can be set up lots of different ways -- including such that there's no password needed. > its not like this is a logged in ssh session That's not correct -- whatever user is executing your CGI scripts is the "logged-in" user in bash, right? Obviously that user should be quite locked down, and should not be allowed to run sudo at all, let alone without a password... but there are so many amateur server admins out there that I imagine there are quite a few servers where this is a serious problem (with or without sudo access enabled for the executing user).