Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm running tcpdump on a remote machine, and piping the output to Wireshark on my local machine over SSH. In order to do this, I had to set the SUID bit on tcpdump.

For background, the remote machine is an Amazon EC2 running "Amazon Linux AMI 2012.09". On this image, there is no root password, and it is not possible to log in as root. You can't use sudo without a TTY, and therefore you have to set the SUID.

What are the practical risks of setting this bit on tcpdump? Is there any need to be paranoid? Should I unset it whenever I'm not capturing?

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

That means that everyone who has shell access to this machine may use tcpdump to capture the traffic. The paranoia is not the bad thing when we are talking about security. You may forget eventually that you set it suid and at some day you will give the shell access to someone who you can't trust to the full extent. I believe, you don't want this. I think you should consider to use sudo to run tcpdump from your account. It is possible to set the sudo not to prompt for a password for specific user and for specific commands.

share|improve this answer
    
This is a single purpose machine, and anyone who logs in will need root access. sudo won't work because you can't use it without being logged into the machine (I'm running tcpdump by passing it as an argument to ssh). Thanks, I just wanted to make sure that it didn't pose an external security problem. –  Dean Oct 12 '12 at 1:59
    
then why you can't use ssh user@machine sudo tcpdump eth0 for example? –  Serge Oct 12 '12 at 2:02
    
This returns sudo: sorry, you must have a tty to run sudo –  Dean Oct 12 '12 at 2:13
1  
You need to configure the sudo according to your needs. Take a look at man sudo if you interested in making it working for you –  Serge Oct 12 '12 at 2:16
1  
For the tty issue try this : ssh -t user@machine sudo tcpdump eth0 –  Valor Oct 12 '12 at 14:38
show 1 more comment

Based on your comment request, here is how I have it working to pipe remote tcpdump through sudo to wireshark:

ssh user@host sudo tcpdump -s0 -w - | wireshark -k -i -

Notes: I've added s0 to capture the entire packets.

Just made a wrapper script that runs exactly that but you only need to give the ssh credentials and an optional filter for tcpdump. You can download it from here

share|improve this answer
    
I appreciate the effort Valor, but unfortunately this results in the same error described above (sudo: sorry, you must have a tty to run sudo, or the Wireshark error if I use -t). –  Dean Oct 13 '12 at 1:53
    
@Dean what os and what shell are you running ? I've just tried that from debian & ubuntu against an EC2 Instance (Ubuntu 10.04) and it worked ok. –  Valor Oct 13 '12 at 2:30
    
@Dean Check /etc/sudoers on your EC2 instance, if there it's a line saying requiretty remove it or comment it. –  Valor Oct 13 '12 at 2:32
    
That works. However, it warns that it will show the password in clear. Does this have any advantage over setting the SUID bit on tcpdump? –  Dean Oct 13 '12 at 3:02
    
@Dean "it will show the password" ? Where are you using a password? –  Valor Oct 13 '12 at 4:09
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.