As we all know, is provided with s-bit program is very dangerous, not simply a time bomb. As an administrator, you must find all setui or setgid permissions system.
Script checks the system all setuid command to check writable or group-writable, have not been modified in the last $ mtime days.
#!/bin/bash
# findsuid--Checks all SUID files or programs to see if they're writeable
mtime="7" # How far back (in days) to check for modified cmds
verbose=0 # By default, let's be quiet about things.
if [ "$1" = "-v" ] ; then
verbose=1 # User-specified findsuid –v, so let's be verbose.
be
# "find –perm" looks at the permissions of the file: 4000 and above are setuid/setgid.
find / -type f -perm +4000 -print0 | while read -d '' -r match
do
if [ -x "$match" ] ; then
# Let's split out file owner and permissions from the "ls –ld" output.
owner="$(ls -ld $match | awk '{print $3}')"
perms="$(ls -ld $match | cut -c5-10 | grep 'w')"
if [ ! -z $perms ] ; then
echo "**** $match (writeable and setuid $owner)"
elif [ ! -z $(find $match -mtime -$mtime -print) ] ; then
echo "**** $match (modified within $mtime days and setuid $owner)"
elif [ $verbose -eq 1 ] ; then
# By default, only dangerous scripts are listed. If verbose, show all.
lastmod="$(ls -ld $match | awk '{print $6, $7, $8}')"
echo " $match (setuid $owner, last modified $lastmod)"
be
be
done
exit 0