I am not a security specialist. But being a sysadmin I almost know the basics :-)

First thing that I had to know about security is that security and comfort don't match. So, if you want maximum security you have to make the road that leads root to another user a no-return way.

This means, of course, that for minor configuration changes they will be still able to send a HUP and have them immediately applied. But for changes that need root privileges they'll have to restart the program. Not very comfortable, probably, but more secure.

That shouldn't be a big problem anyway, if you provide a init.d-like shell script along with the perl script. That way an administrator could run a /etc/init.d/assp reload for a minor configuration change, and /etc/init.d/assp restart for major changes.

I hope my 2 cents will help

Ciao!
--bronto

# Another Perl edition of a song:
# The End, by The Beatles
END {
  $you->take($love) eq $you->make($love) ;
}

sub switchUsers { my ($uname,$gname)=@_;
 $>=0;
 if($> != 0) {
  mlog('',"requested to switch to user/group '$uname/$gname' but canno
+t set effective uid to 0 -- quitting; uid is $>");
  die "requested to switch to user/group '$uname/$gname' but cannot se
+t effective uid to 0 -- quitting; uid is $>\n";
 }
 $<=0;
 if($gname) {
  my $gid = getgrnam($gname);
  if(defined $gid) {
   if($switchRealUID) {
    $(=$gid;
    if($(+0==$gid) {
     mlog('',"Switched real gid to $gid ($gname)");
    } else {
     mlog('',"Failed to switch real gid to $gid ($gname) -- real uid=$
+(");
    }
   }
   $)=$gid;
   if($)+0==$gid) {
    mlog('',"Switched effective gid to $gid ($gname)");
   } else {
    mlog('',"Failed to switch effective gid to $gid ($gname) -- effect
+ive gid=$) -- quitting");
    die "Failed to switch effective gid to $gid ($gname) -- effective 
+gid=$) -- quitting";
   }
  } else {
   mlog('',"Could not find gid for group '$gname' -- not switching eff
+ective gid -- quitting");
   die "Could not find gid for group '$gname' -- not switching effecti
+ve gid -- quitting";
  }
 }
 if($uname) {
  my $uid = getpwnam($uname);
  if(defined $uid) {
   if($switchRealUID) {
    $<=$uid;
    if($<==$uid) {
     mlog('',"Switched real uid to $uid ($uname)");
    } else {
     mlog('',"Failed to switch real uid to $uid ($uname) -- real uid=$
+<");
    }
   }
   $>=$uid;
   if($>==$uid) {
    mlog('',"Switched effective uid to $uid ($uname)");
   } else {
    mlog('',"Failed to switch effective uid to $uid ($uname) -- real u
+id=$< -- quitting");
    die "Failed to switch effective uid to $uid ($uname) -- real uid=$
+< -- quitting";
   }
  } else {
   mlog('',"Could not find uid for user '$uname' -- not switching effe
+ctive uid -- quitting");
   die "Could not find uid for user '$uname' -- not switching effectiv
+e uid -- quitting";
  }
 }
}
[download]

I've removed the $switchRealUID condition -- yes one will always want to switch the RealUID. However I'm still having problems testing this script. Changing real and effective UID is no problem. The problem is that I can CHANGE it BACK. Shouldn't that be against the rules, or am I missing something?

john

I found the answer here: http://archive.develooper.com/perl5-changes@perl.org/msg06044.html

Linux and BSD treat this slightly different, and the safe way is like this:

$< = $id; # real uid
$> = $id; # effective uid
$< = $id; # real uid
$> = $id; # effective uid
[download]


If you do it twice, beginning with the real then everybody is happy. So the final answer to my question is here:

sub switchUsers { my ($uname,$gname)=@_;
 eval('getgrnam(root);getpwnam(root);'); 
 if($@) {
  # windows pukes "unimplemented" for these -- just skip it
  mlog('',"Warning: uname and/or gname are set ($uname,$gname) but get
+grnam / getpwnam give errors");
  return;
 }
 $>=0;
 if($> != 0) {
  mlog('',"requested to switch to user/group '$uname/$gname' but canno
+t set effective uid to 0 -- quitting; uid is $>");
  die "requested to switch to user/group '$uname/$gname' but cannot se
+t effective uid to 0 -- quitting; uid is $>\n";
 }
 $<=0;
 if($gname) {
  my $gid = getgrnam($gname);
  if(defined $gid) {
   $)="$gid $gid";
   if($)+0==$gid) {
    mlog('',"Switched effective gid to $gid ($gname)");
   } else {
    mlog('',"Failed to switch effective gid to $gid ($gname) -- effect
+ive gid=$) -- quitting");
    die "Failed to switch effective gid to $gid ($gname) -- effective 
+gid=$) -- quitting";
   }
   $(="$gid $gid";
   if($(+0==$gid) {
    mlog('',"Switched real gid to $gid ($gname)");
   } else {
    mlog('',"Failed to switch real gid to $gid ($gname) -- real uid=$(
+");
   }
  } else {
   mlog('',"Could not find gid for group '$gname' -- not switching eff
+ective gid -- quitting");
   die "Could not find gid for group '$gname' -- not switching effecti
+ve gid -- quitting";
  }
 }
 if($uname) {
  my $uid = getpwnam($uname);
  if(defined $uid) {
   # do it both ways so linux and bsd are happy
   $<=$uid; $>=$uid; $<=$uid; $>=$uid;
   if($>==$uid) {
    mlog('',"Switched effective uid to $uid ($uname)");
   } else {
    mlog('',"Failed to switch effective uid to $uid ($uname) -- real u
+id=$< -- quitting");
    die "Failed to switch effective uid to $uid ($uname) -- real uid=$
+< -- quitting";
   }
   if($<==$uid) {
    mlog('',"Switched real uid to $uid ($uname)");
   } else {
    mlog('',"Failed to switch real uid to $uid ($uname) -- real uid=$<
+");
   }
  } else {
   mlog('',"Could not find uid for user '$uname' -- not switching effe
+ctive uid -- quitting");
   die "Could not find uid for user '$uname' -- not switching effectiv
+e uid -- quitting";
  }
 }
}
[download]