Is there a way to create a process which can be killed by anyone in Linux?

Firegun

For example, I would like to start running a process in the background SECRETLY on a Ubuntu server , but whenever anybody except me logins to the server, the process must be killed by that user. Is it possible to create a process like this? (I have the sudo account and can modify /etc/bash.bashrc)

Thanks!

user260419

Please note that what follows may compromise your system security in various ways.

Create a script which takes care of killing that process of yours (let us call it process P). Then give all users permission to run this script in sudoers. Finally add suitable call for this script with sudo into /etc/bashrc.

Lets for the sake of example assume that you know your process is started from /usr/local/sbin/myproc and that you want to kill all those processes immediately someone logs in, so you'll going to use simple grep and kill strategy for killing them.

So, first put the following into /usr/local/sbin/killmyprocs:

#!/bin/sh

ps auxw|grep [m]yproc|awk '{ print $2 }'|xargs kill -TERM > /dev/null 2>&1

# end of file.

You probably want to so something slightly more sophisticated if you actually proceed and implement this. So make sure to create a script which traps appropriate signals and in general does things in a secure way.

Second give all users permission to run this script in /etc/sudoers by adding into it:

ALL ALL = (root) NOPASSWD: /usr/local/sbin/killmyprocs

Third, and final step, is to add a sudo call to your script in /etc/bashrc:

[ "`id -n -u`" != "<my_username>" ] && sudo /usr/local/sbin/killmyprocs

Replace with your own account in order to avoid killing your "secret" processes when logging in yourself.

To sum it up: 1) create a script which produces no output but kills processes you wan to kill, 2) add appropriate entry to /etc/sudoers for every user on your system to be able to execute that script as root, 3) add a call to your script via sudo to /etc/bashrc (or /etc/profile).

A caveat: /etc/bashrc (or /etc/profile for that matter) get sourced only for interactive shells. This means it's rather easy for a user to do ssh yourhost 'ps auxw' and find your process from the process table, it will not get killed with the mechanism introduced above because shell initialization files are not consulted. There is a way around that, using ForceCommand in ´sshd_config` but that's left as an exercise for the reader.

To conclude I'd like to remind again that there are obvious security implications with this. This also sounds very much like trying to backdoor a system which you don't have a complete access to but that is not really my concern here (if you have to ask these things on Super User, you'll get caught soon enough anyway).

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

Finding which process was killed by Linux OOM killer

zombie process can't be killed

Can anyone help me to get handle of process which is called by func Process.Start();?

How can I create a file in Linux in a way that when I open it, it is actually running a process

Is there a way to create 1 usb stick which can install multiple versions of windows and linux?

How can I track which process is calling another process (Linux)?

linux mint - android studio emulator process killed

Weblogic process just killed suddenly on redhat linux

Is there any way to find which process utilizing swap memory in Linux OS?

Process of Port 8443 can't be killed

Can a child be killed by a not-parent process?

Why child process still alive after parent process was killed in Linux?

How can I know which type of process of linux will use for these?

Best way to create child process in linux and handle possible failing

Can anyone suggest of a way to group an array of objects by an object key then create a new array of objects based on the grouping in JavaScript?

Can anyone help caching process in webapps?

Is there any way by which a process P2 can access the local variable of another process P1?

Can anyone suggest a simple way to update an SQLite database with changed data using Microsoft.Data.Sqlite which has no DataAdapter?

Linux - process killed when linking section into lowest 2 MB of memory?

Process gets killed in Linux over ssh connection with putty

Process gets Killed by Linux OS - No OOM Log in /var/log files

I am trying create a button in which boolean function should be performed. below is my view code. Can anyone help me

How can I tell in Linux which process sent my process a signal

how many ways we can create a process in linux using c

How Can I Create A Dump File of a Running Process in Linux?

Is there a way to identify which process turns into Zombie process

Process id is constantly changing, and it can't be killed with name

nvidia-smi process hangs and can't be killed with SIGKILL either

Using TaskScheduler.UnobservedTaskException can avoid the process being killed?