“ALL ALL=(ALL) NOPASSWD:ALL” was auto added in my /etc/sudoers file. Is this a Security Breach?
ALL ALL=(ALL) NOPASSWD:ALLline was auto added twice at the end of my/etc/sudoersfile.
- My linux suddenly stopped asking for a password every time I ran a sudo command. This made me investigate the issue.
- Even after running
sudo -kto reset the grace time it would not ask for my password. - I figured out the meaning of that line and commented out the 2 lines to fix the issue and things were back to normal.
But as per my searches the sudoers file is only edited manually and no way I could have given ALL users NOPASSWD permissions to ALL commands.
Could this mean that a script I executed changed the sudoers file? Is this a cause of concern?
OS : Linux Mint 18.3 Cinnamon
security sudo
asked Aug 16 '18 at 11:27
Neon44Neon44
315
|
show 1 more comment
ALL ALL=(ALL) NOPASSWD:ALLline was auto added twice at the end of my/etc/sudoersfile.
- My linux suddenly stopped asking for a password every time I ran a sudo command. This made me investigate the issue.
- Even after running
sudo -kto reset the grace time it would not ask for my password. - I figured out the meaning of that line and commented out the 2 lines to fix the issue and things were back to normal.
But as per my searches the sudoers file is only edited manually and no way I could have given ALL users NOPASSWD permissions to ALL commands.
Could this mean that a script I executed changed the sudoers file? Is this a cause of concern?
OS : Linux Mint 18.3 Cinnamon
security sudo
asked Aug 16 '18 at 11:27
Neon44Neon44
315
3
Whoever, or whatever, added that line tosudoersneeded to have root privileges to do so.
– roaima
Aug 16 '18 at 11:32
4
That's certainly a cause of concern. Can you tie in the last modification time of /etc/sudoers to some event (in logs or modification times of some other files)
– Stéphane Chazelas
Aug 16 '18 at 11:33
3
Long shot, but doessudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /rootreturn anything other than /etc/sudoers?
– roaima
Aug 16 '18 at 12:16
@roaima will surely try that.
– Neon44
Aug 16 '18 at 14:55
@roaimasudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /roothas returned the following as of now:/etc/sudoers /usr/lib/snapd/snapd /var/log/auth.log
– Neon44
Aug 16 '18 at 15:10
|
show 1 more comment
ALL ALL=(ALL) NOPASSWD:ALLline was auto added twice at the end of my/etc/sudoersfile.
- My linux suddenly stopped asking for a password every time I ran a sudo command. This made me investigate the issue.
- Even after running
sudo -kto reset the grace time it would not ask for my password. - I figured out the meaning of that line and commented out the 2 lines to fix the issue and things were back to normal.
But as per my searches the sudoers file is only edited manually and no way I could have given ALL users NOPASSWD permissions to ALL commands.
Could this mean that a script I executed changed the sudoers file? Is this a cause of concern?
OS : Linux Mint 18.3 Cinnamon
security sudo
asked Aug 16 '18 at 11:27
Neon44Neon44
315
ALL ALL=(ALL) NOPASSWD:ALLline was auto added twice at the end of my/etc/sudoersfile.
- My linux suddenly stopped asking for a password every time I ran a sudo command. This made me investigate the issue.
- Even after running
sudo -kto reset the grace time it would not ask for my password. - I figured out the meaning of that line and commented out the 2 lines to fix the issue and things were back to normal.
But as per my searches the sudoers file is only edited manually and no way I could have given ALL users NOPASSWD permissions to ALL commands.
Could this mean that a script I executed changed the sudoers file? Is this a cause of concern?
OS : Linux Mint 18.3 Cinnamon
security sudo
security sudo
asked Aug 16 '18 at 11:27
Neon44Neon44
315
asked Aug 16 '18 at 11:27
Neon44Neon44
315
asked Aug 16 '18 at 11:27
Neon44Neon44
315
asked Aug 16 '18 at 11:27
Neon44Neon44
315
asked Aug 16 '18 at 11:27
Neon44Neon44
315
315
3
Whoever, or whatever, added that line tosudoersneeded to have root privileges to do so.
– roaima
Aug 16 '18 at 11:32
4
That's certainly a cause of concern. Can you tie in the last modification time of /etc/sudoers to some event (in logs or modification times of some other files)
– Stéphane Chazelas
Aug 16 '18 at 11:33
3
Long shot, but doessudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /rootreturn anything other than /etc/sudoers?
– roaima
Aug 16 '18 at 12:16
@roaima will surely try that.
– Neon44
Aug 16 '18 at 14:55
@roaimasudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /roothas returned the following as of now:/etc/sudoers /usr/lib/snapd/snapd /var/log/auth.log
– Neon44
Aug 16 '18 at 15:10
|
show 1 more comment
3
Whoever, or whatever, added that line tosudoersneeded to have root privileges to do so.
– roaima
Aug 16 '18 at 11:32
4
That's certainly a cause of concern. Can you tie in the last modification time of /etc/sudoers to some event (in logs or modification times of some other files)
– Stéphane Chazelas
Aug 16 '18 at 11:33
3
Long shot, but doessudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /rootreturn anything other than /etc/sudoers?
– roaima
Aug 16 '18 at 12:16
@roaima will surely try that.
– Neon44
Aug 16 '18 at 14:55
@roaimasudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /roothas returned the following as of now:/etc/sudoers /usr/lib/snapd/snapd /var/log/auth.log
– Neon44
Aug 16 '18 at 15:10
3
3
Whoever, or whatever, added that line to
sudoers needed to have root privileges to do so.– roaima
Aug 16 '18 at 11:32
Whoever, or whatever, added that line to
sudoers needed to have root privileges to do so.– roaima
Aug 16 '18 at 11:32
4
4
That's certainly a cause of concern. Can you tie in the last modification time of /etc/sudoers to some event (in logs or modification times of some other files)
– Stéphane Chazelas
Aug 16 '18 at 11:33
That's certainly a cause of concern. Can you tie in the last modification time of /etc/sudoers to some event (in logs or modification times of some other files)
– Stéphane Chazelas
Aug 16 '18 at 11:33
3
3
Long shot, but does
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root return anything other than /etc/sudoers?– roaima
Aug 16 '18 at 12:16
Long shot, but does
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root return anything other than /etc/sudoers?– roaima
Aug 16 '18 at 12:16
@roaima will surely try that.
– Neon44
Aug 16 '18 at 14:55
@roaima will surely try that.
– Neon44
Aug 16 '18 at 14:55
@roaima
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root has returned the following as of now: /etc/sudoers /usr/lib/snapd/snapd /var/log/auth.log – Neon44
Aug 16 '18 at 15:10
@roaima
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root has returned the following as of now: /etc/sudoers /usr/lib/snapd/snapd /var/log/auth.log – Neon44
Aug 16 '18 at 15:10
|
show 1 more comment
2 Answers
2
active
oldest
votes
After running this command
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root
you advised that several files matched:
/etc/sudoers
/usr/lib/snapd/snapd
/var/log/auth.log
/home/neon/HUAWEI-4g_Dongle/Linux/install
The first three of these files could be reasonably expected to contain a match, and can be safely ignored. The fourth, on the other hand, appears to be a possible culprit and bears further investigation.
Indeed, your pastebin shows these snippets:
SOFTWARENAME="Mobile Partner"
SOFTWARENAME=$(echo $SOFTWARENAME | sed s# #_#g)
TEMPFILE="${SOFTWARENAME}_install_$PPID"
...
grep -v "MobilePartner.sh" /etc/sudoers >/tmp/${TEMPFILE} 2>&1
echo -e "ALL ALL=(ALL) NOPASSWD:ALL" >> /tmp/${TEMPFILE}
...
cp -f /tmp/${TEMPFILE} /etc/sudoers
Yes, I would say that's a (terrible) security hole from fairly lousy quality code.
Having removed (or commented out) the lines from your /etc/sudoers file, I would also recommend you check the permissions on that file. They should be ug=r,o= (0440 = r--r-----), probably owned by root:root.
answered Aug 16 '18 at 16:42
roaimaroaima
44.3k555119
Verified the file permissions to be0440. Seems like it was a really bad install script that came bundled with the dongle. Thanks a lot !
– Neon44
Aug 16 '18 at 18:43
add a comment |
Interesting that its a Huawei dongle!
answered 14 mins ago
oratekoratek
1
New contributor
oratek is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f462957%2fall-all-all-nopasswdall-was-auto-added-in-my-etc-sudoers-file-is-this-a-s%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
After running this command
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root
you advised that several files matched:
/etc/sudoers
/usr/lib/snapd/snapd
/var/log/auth.log
/home/neon/HUAWEI-4g_Dongle/Linux/install
The first three of these files could be reasonably expected to contain a match, and can be safely ignored. The fourth, on the other hand, appears to be a possible culprit and bears further investigation.
Indeed, your pastebin shows these snippets:
SOFTWARENAME="Mobile Partner"
SOFTWARENAME=$(echo $SOFTWARENAME | sed s# #_#g)
TEMPFILE="${SOFTWARENAME}_install_$PPID"
...
grep -v "MobilePartner.sh" /etc/sudoers >/tmp/${TEMPFILE} 2>&1
echo -e "ALL ALL=(ALL) NOPASSWD:ALL" >> /tmp/${TEMPFILE}
...
cp -f /tmp/${TEMPFILE} /etc/sudoers
Yes, I would say that's a (terrible) security hole from fairly lousy quality code.
Having removed (or commented out) the lines from your /etc/sudoers file, I would also recommend you check the permissions on that file. They should be ug=r,o= (0440 = r--r-----), probably owned by root:root.
answered Aug 16 '18 at 16:42
roaimaroaima
44.3k555119
Verified the file permissions to be0440. Seems like it was a really bad install script that came bundled with the dongle. Thanks a lot !
– Neon44
Aug 16 '18 at 18:43
add a comment |
After running this command
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root
you advised that several files matched:
/etc/sudoers
/usr/lib/snapd/snapd
/var/log/auth.log
/home/neon/HUAWEI-4g_Dongle/Linux/install
The first three of these files could be reasonably expected to contain a match, and can be safely ignored. The fourth, on the other hand, appears to be a possible culprit and bears further investigation.
Indeed, your pastebin shows these snippets:
SOFTWARENAME="Mobile Partner"
SOFTWARENAME=$(echo $SOFTWARENAME | sed s# #_#g)
TEMPFILE="${SOFTWARENAME}_install_$PPID"
...
grep -v "MobilePartner.sh" /etc/sudoers >/tmp/${TEMPFILE} 2>&1
echo -e "ALL ALL=(ALL) NOPASSWD:ALL" >> /tmp/${TEMPFILE}
...
cp -f /tmp/${TEMPFILE} /etc/sudoers
Yes, I would say that's a (terrible) security hole from fairly lousy quality code.
Having removed (or commented out) the lines from your /etc/sudoers file, I would also recommend you check the permissions on that file. They should be ug=r,o= (0440 = r--r-----), probably owned by root:root.
answered Aug 16 '18 at 16:42
roaimaroaima
44.3k555119
Verified the file permissions to be0440. Seems like it was a really bad install script that came bundled with the dongle. Thanks a lot !
– Neon44
Aug 16 '18 at 18:43
add a comment |
After running this command
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root
you advised that several files matched:
/etc/sudoers
/usr/lib/snapd/snapd
/var/log/auth.log
/home/neon/HUAWEI-4g_Dongle/Linux/install
The first three of these files could be reasonably expected to contain a match, and can be safely ignored. The fourth, on the other hand, appears to be a possible culprit and bears further investigation.
Indeed, your pastebin shows these snippets:
SOFTWARENAME="Mobile Partner"
SOFTWARENAME=$(echo $SOFTWARENAME | sed s# #_#g)
TEMPFILE="${SOFTWARENAME}_install_$PPID"
...
grep -v "MobilePartner.sh" /etc/sudoers >/tmp/${TEMPFILE} 2>&1
echo -e "ALL ALL=(ALL) NOPASSWD:ALL" >> /tmp/${TEMPFILE}
...
cp -f /tmp/${TEMPFILE} /etc/sudoers
Yes, I would say that's a (terrible) security hole from fairly lousy quality code.
Having removed (or commented out) the lines from your /etc/sudoers file, I would also recommend you check the permissions on that file. They should be ug=r,o= (0440 = r--r-----), probably owned by root:root.
answered Aug 16 '18 at 16:42
roaimaroaima
44.3k555119
After running this command
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root
you advised that several files matched:
/etc/sudoers
/usr/lib/snapd/snapd
/var/log/auth.log
/home/neon/HUAWEI-4g_Dongle/Linux/install
The first three of these files could be reasonably expected to contain a match, and can be safely ignored. The fourth, on the other hand, appears to be a possible culprit and bears further investigation.
Indeed, your pastebin shows these snippets:
SOFTWARENAME="Mobile Partner"
SOFTWARENAME=$(echo $SOFTWARENAME | sed s# #_#g)
TEMPFILE="${SOFTWARENAME}_install_$PPID"
...
grep -v "MobilePartner.sh" /etc/sudoers >/tmp/${TEMPFILE} 2>&1
echo -e "ALL ALL=(ALL) NOPASSWD:ALL" >> /tmp/${TEMPFILE}
...
cp -f /tmp/${TEMPFILE} /etc/sudoers
Yes, I would say that's a (terrible) security hole from fairly lousy quality code.
Having removed (or commented out) the lines from your /etc/sudoers file, I would also recommend you check the permissions on that file. They should be ug=r,o= (0440 = r--r-----), probably owned by root:root.
answered Aug 16 '18 at 16:42
roaimaroaima
44.3k555119
edited Aug 16 '18 at 19:10
answered Aug 16 '18 at 16:42
roaimaroaima
44.3k555119
answered Aug 16 '18 at 16:42
roaimaroaima
44.3k555119
answered Aug 16 '18 at 16:42
roaimaroaima
44.3k555119
44.3k555119
Verified the file permissions to be0440. Seems like it was a really bad install script that came bundled with the dongle. Thanks a lot !
– Neon44
Aug 16 '18 at 18:43
add a comment |
Verified the file permissions to be0440. Seems like it was a really bad install script that came bundled with the dongle. Thanks a lot !
– Neon44
Aug 16 '18 at 18:43
Verified the file permissions to be
0440. Seems like it was a really bad install script that came bundled with the dongle. Thanks a lot !– Neon44
Aug 16 '18 at 18:43
Verified the file permissions to be
0440. Seems like it was a really bad install script that came bundled with the dongle. Thanks a lot !– Neon44
Aug 16 '18 at 18:43
add a comment |
Interesting that its a Huawei dongle!
answered 14 mins ago
oratekoratek
1
New contributor
oratek is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Interesting that its a Huawei dongle!
answered 14 mins ago
oratekoratek
1
New contributor
oratek is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Interesting that its a Huawei dongle!
answered 14 mins ago
oratekoratek
1
New contributor
oratek is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Interesting that its a Huawei dongle!
answered 14 mins ago
oratekoratek
1
New contributor
oratek is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 14 mins ago
oratekoratek
1
New contributor
oratek is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 14 mins ago
oratekoratek
1
answered 14 mins ago
oratekoratek
1
1
New contributor
oratek is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
oratek is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
oratek is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f462957%2fall-all-all-nopasswdall-was-auto-added-in-my-etc-sudoers-file-is-this-a-s%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
3
Whoever, or whatever, added that line to
sudoersneeded to have root privileges to do so.– roaima
Aug 16 '18 at 11:32
4
That's certainly a cause of concern. Can you tie in the last modification time of /etc/sudoers to some event (in logs or modification times of some other files)
– Stéphane Chazelas
Aug 16 '18 at 11:33
3
Long shot, but does
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /rootreturn anything other than /etc/sudoers?– roaima
Aug 16 '18 at 12:16
@roaima will surely try that.
– Neon44
Aug 16 '18 at 14:55
@roaima
sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /roothas returned the following as of now:/etc/sudoers /usr/lib/snapd/snapd /var/log/auth.log– Neon44
Aug 16 '18 at 15:10