sash creates 'sashroot' account

[Steven Black]

Binary package hint: friendly-recovery

When you install sash it clones your root account to create a 'sashroot' account.

This is useless with Ubuntu, as Ubuntu has root's account locked out. This means sash is cloning a locked out acount, which does no one any good.

Additionally, on systems with root account passwords, this is a security concern. Root account passwords are serious business, and they regularly should be changed. By cloning the password, you are effectively by-passing the normal processes in place in an institution to regulate the root password.

As an example:
Company A has a system administrator, Evil-Bill. Now, Evil-Bill knows the institution will change the root passwords on all the systems when he leaves. He also knows that packages are not strictly watched. (How many places actually strictly monitor packages and the user accounts they each create?) Before he leaves, he installs 'sash'. They change all the root accounts, but they miss his backdoor account 'sashroot'. A few weeks after he has left, he logs in and performs his evil.

Note that this security concern occurs on Ubuntu systems in cases where the administrator thought that creating a password for the root user increased security of single-user mode, or in cases where administrative policy at an institution requires setting/changing the root password on a regular basis.

Another solution to the problem addressed by creating the 'sashroot' account would be to use standard package logic to ask the user if their root/single-user sessions should use a potentially more reliable staticly compiled shell. Then all packages providing static shells should offer alternatives. A name such as /bin/static-sh could be used as the common alternative name. Then with the root account set to /bin/static-sh, things should just work. (You could go as far as making /bin/bash a super-low recommendation for /bin/static-sh, so that if things didn't get cleared up properly when all the static shells were removed, the root account would still be accessable.)

[Steven Black (blacks-indiana)]

Correcting the package this affects.

[Steven Black (blacks-indiana)]

I wanted to add that when sash is purged, it does not remove the sashroot account. -- However the shell gets changed to bash.

This means that if packages are being monitored by regular daily reports pulled from a dpkg -l list, you can get around this showing up in logs by installing sash and immediately purging sash.

[Christian Wolf (christianwolf)]

Even worse:

harden-environment has sash as dependency.

This is not good.

[JC Hulce (soaringsky)]

The fixed version appears to have been synced from Debian, so I am closing this bug.