Non-root users need to tcpdump, arping, etc)

[Nick Marsh]

I have a specific need for a troubleshooting application. How can I give non-root users access to tcpdump, tethereal and arping? They can already use ping, nmap, arp, ethereal and traceroute... Why not tcpdump, tethereal and arping?

Example...

$ /usr/sbin/tcpdump -a -i eth1 -c 5
tcpdump: socket: Operation not permitted


$ /usr/sbin/tethereal -i eth1 -c 5 -V
tethereal: The capture session could not be initiated (socket: Operation not permitted).
Please check to make sure you have sufficient permissions, and that
you have the proper interface specified.


$ /sbin/arping -c 1 rfu-1
arping: socket: Operation not permitted



nick marsh
***@mac.com

[Kenneth Goodwin]

Post by Nick Marsh
I have a specific need for a troubleshooting application.
How can I give non-root users access to tcpdump, tethereal
and arping? They can already use ping, nmap, arp, ethereal
and traceroute... Why not tcpdump, tethereal and arping?

They all use the priviledged port range accessible by ROOT only
You either need to setup SUDO to allow those specific users
access to those specific commands to keep control over them
and who can execute them.

-OR-

throw caution to the wind and make sure the owner of those files
is ROOT and turn on the SETUID bit in the file mode. I believe
the syntax is chmod +su [filename]. This opens the command for use
by every user on the system unless you put those people into a command
group and chgrp these programs to the same group and chmod the filenames
to eliminate all but user and group access rights.
See man or info chmod, chgrp, chown. The danger here is if the
command has the ability to fork a shell
your user can then end up with full root access on your system.
So you might want to also check out what the command is capable of
and that you are running the latest releases.

Post by Nick Marsh
Example...
$ /usr/sbin/tcpdump -a -i eth1 -c 5
tcpdump: socket: Operation not permitted
$ /usr/sbin/tethereal -i eth1 -c 5 -V
tethereal: The capture session could not be initiated
(socket: Operation not permitted).
Please check to make sure you have sufficient permissions, and that
you have the proper interface specified.
$ /sbin/arping -c 1 rfu-1
arping: socket: Operation not permitted
nick marsh

[Andrew Williams]

Post by Kenneth Goodwin

Post by Nick Marsh
I have a specific need for a troubleshooting application.
How can I give non-root users access to tcpdump, tethereal
and arping? They can already use ping, nmap, arp, ethereal
and traceroute... Why not tcpdump, tethereal and arping?

They all use the priviledged port range accessible by ROOT only
You either need to setup SUDO to allow those specific users
access to those specific commands to keep control over them
and who can execute them.

I would go with sudo. Setting these things setuid is asking to get
rooted imo. Not that sudo solves it, but you can at least try to
control who can run the thing.

Post by Kenneth Goodwin
-OR-
throw caution to the wind and make sure the owner of those files
is ROOT and turn on the SETUID bit in the file mode. I believe
the syntax is chmod +su [filename]. This opens the command for use
by every user on the system unless you put those people into a command
group and chgrp these programs to the same group and chmod the filenames
to eliminate all but user and group access rights.
See man or info chmod, chgrp, chown. The danger here is if the
command has the ability to fork a shell
your user can then end up with full root access on your system.
So you might want to also check out what the command is capable of
and that you are running the latest releases.

Post by Nick Marsh
Example...
$ /usr/sbin/tcpdump -a -i eth1 -c 5
tcpdump: socket: Operation not permitted
$ /usr/sbin/tethereal -i eth1 -c 5 -V
tethereal: The capture session could not be initiated
(socket: Operation not permitted).
Please check to make sure you have sufficient permissions, and that
you have the proper interface specified.
$ /sbin/arping -c 1 rfu-1
arping: socket: Operation not permitted
nick marsh

...

[Ed Wilts]

Post by Nick Marsh
I have a specific need for a troubleshooting application. How can I
give non-root users access to tcpdump, tethereal and arping? They can
already use ping, nmap, arp, ethereal and traceroute... Why not
tcpdump, tethereal and arping?

Are you *really* sure you want non-root access to tcpdump? With access
to tcpdump, those users have the ability to read everything coming
across the wire, including any passwords that may be sent from one
system to another unrelated to your Linux system.

So, the answer the why not, it's quite different between telling if a
system is alive, and reading and analyzing packets not even meant for
your host. Capture the packets with tcpdump, through them into
Ethereal, do a few quick searches, and every host on the network segment
could potentially be compromised.
--
Ed Wilts, Mounds View, MN, USA
mailto:***@ewilts.org
Member #1, Red Hat Community Ambassador Program