Ubuntu
sysklogd package

remote syslog in feisty not working - syslogd running as root

Bug #117309 reported by Caspar Clemens Mierau
258
Affects Status Importance Assigned to Milestone
sysklogd (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

Binary package hint: sysklogd

I think this is not a duplicate of bug #26986.

Syslog on feisty does not activate its listening udp port when using "-" in /etc/init.d/sysklogd

------------
SYSLOGD="-u syslog -r"
------------

I tried different orders (-r -u and -ru ) due to bug #26986 with no success. lsof and netstat don't show the open udp port after a restart of syslogd.

Revision history for this message
otzenpunk (reisswolf-nospam) wrote :

The reason is, that in /etc/init.d/sysklogd /etc/default/syslogd is sourced after the definition of SYSLOGD, overwriting it. So /etc/default/syslogd is the place where the "-r" belongs.

But apart from that, this is a real security bug, because it causes to start syslogd as root and not as user syslog as expected.

The "-u syslog" should be moved to /etc/default/syslogd and the comment in /etc/init.d/sysklogd should refer to that.

Revision history for this message
Caspar Clemens Mierau (leitmedium) wrote :

Thanks for your comment. You are totally right - this is a severe bug.

The difference:

Ubuntu Dapper:
syslog 11501 0.0 0.1 1768 712 ? Ss 06:25 0:00 /sbin/syslogd -u syslog

Ubuntu Feisty:
root 4649 0.0 0.0 1700 648 ? Ss 13:58 0:00 /sbin/syslogd

So this is definitely security related.

Caspar Clemens Mierau (leitmedium)
Changed in sysklogd:
assignee: nobody → damokles
status: Unconfirmed → Confirmed
assignee: damokles → nobody
Revision history for this message
Graeme Hewson (ghewson) wrote :

See also bug #103232, where I've attached patches to improve the comments in the scripts.

Revision history for this message
otzenpunk (reisswolf-nospam) wrote :

Thank you for the information. I've marked this one as duplicate.

To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.