How does the su program block automated input from bash?

[null_reflections]

As a novice programmer, I would think that this would put a password into the "su" command in linux and then validate the password:

echo <my-password> | su | echo

However, i've tried many variations of this (even using printf) and for some reason at best the password prints on the screen and then su asks me for the password again. I just thought it would be interesting to be able to automatically be superuser at startup, but unfortunately things are not always as straightforward as they seem! Doesn't piping mean converting one programs output into another program's input? I suppose i'd have to change "su" itself if I wanted this to work, does anyone know why?

 

[Deleted member 2829]

Yes, piping works like this, and any normal Linux program will work when part of a pipe. But su is not normal ! For obvious security reasons, it demands that you physically type on the keyboard, reading the keyboard directly without echoing, rather than using the standard I/O streams. I believe that is functionality is actually built into the kernel. You may think of writing your own su, but there comes the inevitable moment you need to call setuid(0), and that will fail unless you are already root. You can't do this with normal programming tools, so unless you want to grab and tweak the Linux source code, you're out of luck.

Not sure what you mean if you say you If you want to "automatically be superuser at startup". You want Linux to bypass the login process and dump you straight into a root shell ? Bad Idea. But since you were using shell commands I guess you want to build this into your .profile or .bashrc ? Equally bad idea. You don't put any unencrypted password in a file, least of all the root password.

Last option : always login as root. Bad idea again. Even seasoned sysadmins don't do that. My advice is: use su sparingly, and only for one very specific task which you really cannot do otherwise. Walk on eggshells, think thrice about every command, and get the hell out of there when you've done what you came for. Even the pros work like that, so it's all the more important for a novice programmer.

I sure hope I've talked you out of this idea by now 😁

 

[Deleted member 2829]

Oh, and also check out sudo. A much better choice if you just need to do execute a command (or a couple of them) with root permission.

 

[null_reflections]

Yes, piping works like this, and any normal Linux program will work when part of a pipe. But su is not normal ! For obvious security reasons, it demands that you physically type on the keyboard, reading the keyboard directly without echoing, rather than using the standard I/O streams. I believe that is functionality is actually built into the kernel. You may think of writing your own su, but there comes the inevitable moment you need to call setuid(0), and that will fail unless you are already root. You can't do this with normal programming tools, so unless you want to grab and tweak the Linux source code, you're out of luck.

Walk on eggshells, think thrice about every command, and get the hell out of there when you've done what you came for. Even the pros work like that, so it's all the more important for a novice programmer.

Thats typically what i do, yet there is such a thing as virtual machines. I even turned off my ability to overwrite text files through the command line, luckily i can easily turn it back on.

You can also easily exit super user status when you are not using it. I posted this in the C forum so i could maybe have the question answered, i wasnt really looking for a PSA or "im reporting you to the admin!" type deal...

 

[Deleted member 2829]

Report to admin ? PSA ? I was just telling you what I know from long experience. Take it or leave it.

 

[null_reflections]

Report to admin ? PSA ? I was just telling you what I know from long experience. Take it or leave it.

I was interested in this mostly because thats what debian tells you by default until you learn that they simply dont have a sudo program by default, there's really no need to be defensive, only my data is at risk here.

 

[Deleted member 2829]

Well I did not really dig your last sentence, pardon me for being just a little miffed with it.
If you don't have sudo on your Debian, you didn't install it. But you can still do so if you want, say this page https://wiki.debian.org/sudo/
However it seems many people these days prefer not to use or even install it, and rather start a root shell. Whatever works for you.

 

[null_reflections]

Well I did not really dig your last sentence, pardon me for being just a little miffed with it.
If you don't have sudo on your Debian, you didn't install it. But you can still do so if you want, say this page https://wiki.debian.org/sudo/
However it seems many people these days prefer not to use or even install it, and rather start a root shell. Whatever works for you.

Its fine for you to not like what i post, but the question was "how" and not "why". I had absolutely no malicous intentions with asking this question, and maybe later today i will look at ubuntus "su" src to see if that brings me any closer to understanding this.

 

[Deleted member 2829]

I never assumed any malicious intentions. Just thought it would be good to pass on (for what it's worth) the perceived wisdom, handed down from days of yore, about when to be superuser and when not to. Sorry I could not actually help, and good luck in finding a solution for your issue.

 

[null_reflections]

i was able to get the source code for the su program here:

Index of /pub/linux/utils/util-linux/

however, nothing i found in the .c file clues me in to how the program asks for input...i found no signs of "scanf" or "Password: " and any other variations of "password" in the file. These system utilities tend to have a ton of headers, the su command is rather intimidating and probably could only be understood by someone with both advanced C and linux knowledge, neither fields excluded.

 

[Antero360]

As a novice programmer, I would think that this would put a password into the "su" command in linux and then validate the password:

echo <my-password> | su | echo

However, i've tried many variations of this (even using printf) and for some reason at best the password prints on the screen and then su asks me for the password again. I just thought it would be interesting to be able to automatically be superuser at startup, but unfortunately things are not always as straightforward as they seem! Doesn't piping mean converting one programs output into another program's input? I suppose i'd have to change "su" itself if I wanted this to work, does anyone know why?

Using su will automatically prompt you to enter a password. For security reasons, you wouldn't want to pipe a password onto commands like su

i was able to get the source code for the su program here:

Index of /pub/linux/utils/util-linux/

however, nothing i found in the .c file clues me in to how the program asks for input...i found no signs of "scanf" or "Password: " and any other variations of "password" in the file. These system utilities tend to have a ton of headers, the su command is rather intimidating and probably could only be understood by someone with both advanced C and linux knowledge, neither fields excluded.

Again, there should be no reason for someone to want to know how root commands are prompting nonroot users for credentials lol...that would defeat the purpose of security, wouldn't it? 😉 and also, would you personally want someone to be able to alter how root commands prompt for credentials?

 

[null_reflections]

Using su will automatically prompt you to enter a password. For security reasons, you wouldn't want to pipe a password onto commands like su

Again, there should be no reason for someone to want to know how root commands are prompting nonroot users for credentials lol...that would defeat the purpose of security, wouldn't it? 😉 and also, would you personally want someone to be able to alter how root commands prompt for credentials?

Yes but i didn't think they'd also be using security by obfuscation as well as security by design, i suppose using both at once is best.

 

[Antero360]

Yes but i didn't think they'd also be using security by obfuscation as well as security by design, i suppose using both at once is best.

there is a switch you can pass into su in order to pass in the password, but at the same time, you're better off just running whatever script you are trying to build as root already. Like myself, and others have, and will continue to advice you and many others who want to take an approach like this...UNLESS YOU KNOW WHAT YOU ARE DOING, AVOID going down that path. Yes, you may think that only your system will be compromised, but as a dev, and as someone who does info/cyber sec for a hobby, you are literally asking to get pwned at that point.

 

[Deleted member 2829]

Source code may be easy to obtain, but just try and make sense of it... Like all source code of matured software, it is at least 10 times more complicated than you anticipated. For anything security-related, probably more. I think the Force is against you in this case.

 

[null_reflections]

I think the Force is against you in this case.

Noted, i haven't made a c program in years anyway...one time when i was originally using linux, i made a command to give every file 777 permissions, and it completely ruined the OS! I have no regrets though, security is worth being sacrificed sometimes in the name of learning.

 

[Antero360]

Noted, i haven't made a c program in years anyway...one time when i was originally using linux, i made a command to give every file 777 permissions, and it completely ruined the OS! I have no regrets though, security is worth being sacrificed sometimes in the name of learning.

Back in the day, yes, lol. Nowadays, you have VMs to use as sandboxes. Play all you like in the sandbox...just for the sake of your own sanity, don't do it on your primary OS. If you wanna make the sandbox go BSOD, go for it lol. Just keep it contained to it. Last thing anyone needs is to get backdoored just because they wanted to go play "Dan the Destroyer and Bob the Builder"

 

[null_reflections]

there is a switch you can pass into su in order to pass in the password, but at the same time, you're better off just running whatever script you are trying to build as root already. Like myself, and others have, and will continue to advice you and many others who want to take an approach like this...UNLESS YOU KNOW WHAT YOU ARE DOING, AVOID going down that path. Yes, you may think that only your system will be compromised, but as a dev, and as someone who does info/cyber sec for a hobby, you are literally asking to get pwned at that point.

Yes, but the problem with security policies is they fail to adapt to different situations, and the "just don't do it unless you know exactly what will happen" approach has led to security compromises at the hands of naive security experts.

Let's say I did figure out a way to pipe or "inject" my root password into the "su" program. This will probably never happen because learning web development online for free requires a huge amount of deductive ability that i just don't seem to be capable of...plus, nuclear weapons, diseases, and natural disasters might kill us all so i can't bother superior programmers online for information anymore.

In that astronomically unlikely situation, the hypothetical black/grey hat who would design the perfect software that I would foolishly download wouldn't even need my script anymore because I already gave them the password through downloading software since linux always asks for your sudo password when you install something on your computer.

Even if I were a system administrator, i could make the shell script a hidden file buried somewhere within the thousands of files of any linux operating system...you could refrain from using the .sh extension, not put the shebang in your script because you don't need to do that anyway especially if you only have one shell interpreter installed, AND make it seem like it's some other type of file that has nothing to do with login in or passwords. Of course, that's still a problem if you assume your co-workers have a high degree of scripting and linux knowledge, and/or they're disgruntled with you or some other miserable aspect about the company you both work for.

I don't understand how my hypothetical script is a problem when software and websites now a days constantly implore you to save your passwords inside of someone else's code, it doesn't even seem like there was any point at all in me trying to protect my information...i'm just a lazy human, i get frustrated about having to remember too much, but it is nice brain exercise sometimes.

 

[Antero360]

Yes, but the problem with security policies is they fail to adapt to different situations, and the "just don't do it unless you know exactly what will happen" approach has led to security compromises at the hands of naive security experts.

Let's say I did figure out a way to pipe or "inject" my root password into the "su" program. This will probably never happen because learning web development online for free requires a huge amount of deductive ability that i just don't seem to be capable of...plus, nuclear weapons, diseases, and natural disasters might kill us all so i can't bother superior programmers online for information anymore.

In that astronomically unlikely situation, the hypothetical black/grey hat who would design the perfect software that I would foolishly download wouldn't even need my script anymore because I already gave them the password through downloading software since linux always asks for your sudo password when you install something on your computer.

Even if I were a system administrator, i could make the shell script a hidden file buried somewhere within the thousands of files of any linux operating system...you could refrain from using the .sh extension, not put the shebang in your script because you don't need to do that anyway especially if you only have one shell interpreter installed, AND make it seem like it's some other type of file that has nothing to do with login in or passwords. Of course, that's still a problem if you assume your co-workers have a high degree of scripting and linux knowledge, and/or they're disgruntled with you or some other miserable aspect about the company you both work for.

I don't understand how my hypothetical script is a problem when software and websites now a days constantly implore you to save your passwords inside of someone else's code, it doesn't even seem like there was any point at all in me trying to protect my information...i'm just a lazy human, i get frustrated about having to remember too much, but it is nice brain exercise sometimes.

There's reasons why sec policies are the way they are. And as far as your commentary about "...approach has led to security compromises at the hands of naive security experts", lol, the reason we tell people to not go down that path, is for that exact reason. IF you have no idea what you are doing, much less have no idea of how the code works, then chances are you yourself will cause your own pwnship, and as a primary effect, do more damage than good. We also mention this to deter wouldbe and wannabe hax0r 1337s "look mommy I canz hakx0r" from being immature rugrats, with egos bigger than the sahara desert (to put it in very kind words lol) and landing themselves in serious legal trouble. Like I said before, there is nothing wrong with wanting to do it for the sake of learning. But just know you will be met with plenty of resistance. There is nothing wrong with making a vm sandbox and having at it. Just know what the potential risks are... I don't doubt you are a bright and competent person, but I highly doubt you are capable of completely being able to recognize when you have been compromised

 

[Antero360]

Yes, but the problem with security policies is they fail to adapt to different situations, and the "just don't do it unless you know exactly what will happen" approach has led to security compromises at the hands of naive security experts.

Let's say I did figure out a way to pipe or "inject" my root password into the "su" program. This will probably never happen because learning web development online for free requires a huge amount of deductive ability that i just don't seem to be capable of...plus, nuclear weapons, diseases, and natural disasters might kill us all so i can't bother superior programmers online for information anymore.

In that astronomically unlikely situation, the hypothetical black/grey hat who would design the perfect software that I would foolishly download wouldn't even need my script anymore because I already gave them the password through downloading software since linux always asks for your sudo password when you install something on your computer.

Even if I were a system administrator, i could make the shell script a hidden file buried somewhere within the thousands of files of any linux operating system...you could refrain from using the .sh extension, not put the shebang in your script because you don't need to do that anyway especially if you only have one shell interpreter installed, AND make it seem like it's some other type of file that has nothing to do with login in or passwords. Of course, that's still a problem if you assume your co-workers have a high degree of scripting and linux knowledge, and/or they're disgruntled with you or some other miserable aspect about the company you both work for.

I don't understand how my hypothetical script is a problem when software and websites now a days constantly implore you to save your passwords inside of someone else's code, it doesn't even seem like there was any point at all in me trying to protect my information...i'm just a lazy human, i get frustrated about having to remember too much, but it is nice brain exercise sometimes.

Also, if you want mental gymnastics lol... my minimum for passwords is 32 characters, there is no maximum. 1 main password, which all others are derived from (yes, I know, bad practice)... but with that main password being anywhere from between 32 and 60, possibly 😉 I will never tell. characters.... GOOD LUCK HAVE FUN TRYNNA BRUTEFORCE THEM lol. And yes, they are changed every 3 weeks, so again, good luck have fun lol.

 

[null_reflections]

There's reasons why sec policies are the way they are. And as far as your commentary about "...approach has led to security compromises at the hands of naive security experts", lol, the reason we tell people to not go down that path, is for that exact reason. IF you have no idea what you are doing, much less have no idea of how the code works, then chances are you yourself will cause your own pwnship, and as a primary effect, do more damage than good. We also mention this to deter wouldbe and wannabe hax0r 1337s "look mommy I canz hakx0r" from being immature rugrats, with egos bigger than the sahara desert (to put it in very kind words lol) and landing themselves in serious legal trouble. Like I said before, there is nothing wrong with wanting to do it for the sake of learning. But just know you will be met with plenty of resistance. There is nothing wrong with making a vm sandbox and having at it. Just know what the potential risks are... I don't doubt you are a bright and competent person, but I highly doubt you are capable of completely being able to recognize when you have been compromised

That wannabe hacker thing was always a joke anyway because if you're really good at infiltrating other people's stuff then you're probably just going to end up in prison or facing severe bodily injury, i kinda admire kevin mitnick for his ability to socially engineer yet after he got caught he just was giving lectures on pirating.

Wanting to know about security is pretty much a mandatory part of being a programmer nowadays, whatever fears there are of people who can figure out how things work are probably unwarranted, im much more afraid of people with legitamate authority than i am of haxer kids who call me racial/homophobic slurs on the internet. I resent the comparison, and this thread should probably be closed because the responses keep getting further away from the question.