Skip to content
NewA calmer, faster ZeroHour
Researchlow

sudo and OpenDoas timestamp files (2020)

Lobsters · securityby π.duncano.de via dzwdz ()2 min read1 · 1 read
Read at xn--1xa.duncano.de
AI summary · glm-5.3-flashSummaries by Vani AI

A 2020 write-up demonstrates reusing sudo timestamp files across SSH sessions for passwordless sudo, fixed via session-leader start times.

The author contrasts OpenBSD doas(1)'s persist feature, which uses TIOCSETVERAUTH/TIOCCHKVERAUTH/TIOCCLRVERAUTH ioctls to track authenticated TTYs with timeouts, with sudo(8)'s timestamp files bound to PPID or TTY number. A proof-of-concept reused a sudo timestamp file after an SSH session ended by opening a newly recycled pseudo-tty and calling clone(2) in a loop until matching the sshd subprocess's PPID, then ran sudo without a password. The proposed mitigation binds timestamps to the session leader's monotonic start time; this was implemented in OpenDoas and proposed upstream. sudo(8) 1.8.22 (2017) already added the equivalent session start-time check (commit 1709dc7f77).

Key facts
  • doas persist uses TTY ioctls (TIOCSETVERAUTH, TIOCCHKVERAUTH, TIOCCLRVERAUTH); sudo relies on timestamp files tied to PPID or TTY.
  • PoC reuses a sudo timestamp file by claiming a recycled pseudo-tty and cloning until the PPID matches sshd's subprocess.
  • Proposed fix: validate the session leader's monotonic start time, implemented in OpenDoas.
  • sudo 1.8.22 (2017) added equivalent process start-time checks across all supported operating systems.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1548.003 Sudo and Sudo Caching
Tags
authenticationdoaslinuxopenbsdopendoasprivilege-escalationsudotimestamp-reuse
Vendors
sudoOpenDoas
Products
sudodoas
Organizations
OpenBSD

From the original article

2 min read at xn--1xa.duncano.de

which allows to create ( TIOCSETVERAUTH ), clear ( TIOCCLRVERAUTH ) and check ( IOCCHKVERAUTH ) authentications to the specific TTY with a timeout. sudo(8) uses timestamp files to avoid having to enter the password repeatedly,

Lobsters · security

By π.duncano.de via dzwdz · xn--1xa.duncano.de

Read the full article at Lobsters · security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.