[SANS ISC] Using Sudo with Python For More Security Controls, (Thu, Jul 8th)

I’m a big fan of the Sudo[1] command. This tool, available on every UNIX flavor, allows system administrators to provide access to certain users/groups to certain commands as root or another user. This is performed with a lot of granularity in the access rights and logging/reporting features. I’m using it for many years and I’m still learning great stuff about it. Yesterday, at the Pass-The-Salt[2] conference, Peter Czanik presented a great feature of Sudo (available since version 1.9): the ability to extend features using Python modules! There are several scenarios where Python can be used: 


As usual, Python support is not enabled by default on many Linux distributions. You will have to recompile a local Sudo instance with the ‘–enable-python’ flag:

./configure –prefix=/usr/local –enable-python && make && make install

Once your new Sudo is ready, you just have to enable the Python interface you’d like to use. Edit your sudo.conf file and add a line like this one:

Plugin python_io python_plugin.so ModulePath=/usr/local/lib/sudo/sudo_isc_test.py ClassName=MyIOPlugin

ModulePath specifies the location of the Python script that will contain our code and ClassName is the class that will be defined in the script. In this case, I’m enabling the support for I/O operations.

Let’s have a look at the script now:

# cat /usr/local/lib/sudo/sudo_isc_test.py
import sudo


class MyIOPlugin(sudo.Plugin):
def log_ttyout(self, buf: str) -> int:
if “root:x:0:” in buf:
sudo.log_info(“WARNING: Suspicious activity on passwd file detected!”)
return sudo.RC.REJECT
  if “” in buf:
  sudo.log_info(“WARNING: Suspicious network activity detected!”)
  return sudo.RC.REJECT

And in practice, how it works:

# sudo cat /etc/passwd
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin

WARNING: Suspicious activity on passwd file detected!

# sudo host domain name pointer dns.google.

WARNING: Suspicious network activity detected!

Of course, you can do much more and also generate events. This is really powerful and helpful to better control what users/scripts do with Sudo. More information about the integration with python is available on the website[3].

[1] https://www.sudo.ws
[2] https://www.pass-the-salt.org
[3] https://www.sudo.ws/man/1.9.0/sudo_plugin_python.man.html

Xavier Mertens (@xme)
Senior ISC Handler – Freelance Cyber Security Consultant

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Source: Read More (SANS Internet Storm Center, InfoCON: green)

You might be interested in …

[BleepingComputer] ADATA suffers 700 GB data leak in Ragnar Locker ransomware attack

The Ragnar Locker ransomware gang have published download links for more than 700GB of archived data stolen from Taiwanese memory and storage chip maker ADATA. […] Source: Read More (BleepingComputer)

Read More

[SecurityWeek] MITRE, CISA Announce 2021 List of Most Common Hardware Weaknesses

All posts, Security Week

MITRE and the DHS’s Cybersecurity and Infrastructure Security Agency (CISA) have announced the release of the “2021 Common Weakness Enumeration (CWE) Most Important Hardware Weaknesses” list. read more Source: Read More (SecurityWeek RSS Feed)

Read More

[ZDNet] Australia’s ‘hacking’ Bill passes the Senate after House made 60 amendments

All posts, ZDNet

Shadow Home Affairs Minister declared the Bill before the Senate was a better Bill because of amendments, and as such, Labor threw its support behind it. Greens, however, took issue with cops being able to take over a person’s social media. Source: Read More (Latest topics for ZDNet in Security)

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.