bugGNU Screen - Bugs: bug #45381, sudo screen - bash logs root...

 
 

bug #45381: sudo screen - bash logs root commands to user .bash_history

Submitter:  None
Submitted:  Tue 23 Jun 2015 12:54:57 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Invalid
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Release:  4.2.1
Fixed Release:  None Planned Release:  None
Work Required:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 25 Jun 2015 09:32:58 AM UTC, comment #2: 

I think we can close this report. This "problem" exist independently from GNU screen.

The workaround in this case will be just reconfigure sudo.

Alexander Naumov <anaumov>
Group administrator
Thu 25 Jun 2015 04:49:25 AM UTC, comment #1: 

It's not screen specific problem, try with
sudo -s
it should have same problem.

you may want to check up your $HISTFILE and how you set it up.


Amadeusz Sławiński <amade>
Group administrator
Tue 23 Jun 2015 12:54:57 PM UTC, original submission:  

If screen is started via sudo, then the bash logs all commands typed by root to the .bash_history file of the user that issued the sudo command. They are then readable by that user.

This is a security issue.

Observed both in the latest commit (d77e2be25149c8593c611bc785e16fc062cb26c4) as well as in Ubuntu 14.04 (Screen version 4.01.00devel (GNU) 2-May-06).

Example:

user@host:/mnt/medium/user/git/screen$ sudo src/screen

[screen is starting]

root@host:/mnt/medium/user/git/screen# echo THIS_IS_SECRET__R_O_O_T__STUFF
THIS_IS_SECRET__R_O_O_T__STUFF
root@host:/mnt/medium/user/git/screen#

[screen is terminating]

user@host:/mnt/medium/user/git/screen$ tail -1 ~/.bash_history
echo THIS_IS_SECRET__R_O_O_T__STUFF

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by anaumov (Posted a comment)
  • -email is unavailable- added by amade (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-06-25 anaumov Open/ClosedOpen Closed
    2015-06-25 amade StatusNone Invalid

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code