Conversation

Notices

1. Embed this notice
   Linux Is Best (linux@kitty.social)'s status on Monday, 16-Sep-2024 02:14:56 JST Linux Is Best

   I think I found a security bug in Linux Mint.
   
   Install Linux Mint 22 (Cinnamon) with password requirement to sign in. Using the GUI have Mint update. Reboot. Confirm that you need a password to use sudo (you do).
   
   In the "start menu" (app menu), open "Users and Groups" and create another administrator. Note there is no option to require password sign in, but that is not the greater issue.
   
   Log out, log in as your new user. Open "Users and Groups" again. Delete the 1st user. Reboot.
   
   Guess what, you never need a password, ever again. You can right click and run as root anytime you want, you can run sudo anytime you feel like it. No passwords or prompt warning you of your actions. Install any random DEB file without any prompt.
   
   You're basically root.
   
   #Linux #Mint #LinuxMint #Security

   • Embed this notice
     djsumdog (djsumdog@djsumdog.com)'s status on Monday, 16-Sep-2024 02:14:53 JST djsumdog

     in reply to

     • 【Ξｎｉｇｍａｔｉｃｏ】:misskey:

     But you're not setting a password on the new user (and maybe it's dropping it into wheel or whatever the admin group is in Mint by default). It's probably a bug in that UI where it should be prompting you for a password or not add that user to the admin group.

     Would be curious to see how it changed /etc/{passwd,group,shadow}. Sudo can be configured to not prompt for a password if you're in the admin group, but that's typically not the default on most Linux distributions.

     There might already be an upstream bug for it if you try searching.

   • Embed this notice
     Linux Is Best (linux@kitty.social)'s status on Monday, 16-Sep-2024 02:14:54 JST Linux Is Best

     in reply to

     • 【Ξｎｉｇｍａｔｉｃｏ】:misskey:

     @enigmatico@mk.absturztau.be
     
     Step 1) Download a fresh copy of Linux Mint. I obtained my copy from the torrent link off of Mint's website.
     
     Step 2) Install Linux Mint.
     
     I did this in a hurry, so I used "oz" for everything (username, password, name of system). In my opinion, the 2 character password, should not have been allowed.
     
     Step 3) After installing, use their GUI tool to update Mint.
     
     Step 4) Reboot after updating.
     
     Step 5) Using their "Users and groups" app, create a new administrator. You'll not be asked to enter a password or if you want to include one for the new user (I even shared a video in the thread here (see URL / quote ).
     
     Step 6) Log out as 1st admin (for me that was, oz).
     
     Step 7) Log in as 2nd admin (for me that was, oz2).
     
     Step 8) Using the "Users and groups" tool, delete 1st admin.
     
     Someone reported you may need to reboot, but you've got SUDO rights for now on. You can right click, and select open as root, without any prompts. You can open the terminal and run sudo, without any prompts. It's your universe now!
     
     RE: https://kitty.social/notes/9y7c0pgcagpb00me

   • Embed this notice
     【Ξｎｉｇｍａｔｉｃｏ】:misskey: (enigmatico@mk.absturztau.be)'s status on Monday, 16-Sep-2024 02:14:55 JST 【Ξｎｉｇｍａｔｉｃｏ】:misskey:

     in reply to

     @Linux@kitty.social I would have to test it, but I have a feeling that you are logging in as root or something before creating that account. Otherwise it doesnt make much sense, as the user administration is not done by the distribution itself. They only ship a graphical interface to handle it.
     
     In that case every distribution would be affected. But as I said, you're probably doing something you are not supposed to do.

   • Embed this notice
     Linux Is Best (linux@kitty.social)'s status on Monday, 16-Sep-2024 02:24:51 JST Linux Is Best

     in reply to

     • djsumdog

     @djsumdog@djsumdog.com There are a few things wrong with how Linux Mint does things.
     
     1) When I installed Linux Mint, I only used 2 characters to setup a password. In my opinion, that was the 1st issue, but overlooking that...
     
     2) I could create an admin without being prompted for a password. If I can create an admin without verifying I am the admin, that's an issue.
     
     3) I was never asked to give the new admin a password (as seen in the screenshot and video)
     
     4) I could login with my now no password admin
     
     5) I was never asked for a password or even prompted before deleting the 1st admin.
     
     6) I can now use sudo rights everywhere without any password OR prompts.

     djsumdog likes this.