Is there a serious issue with setting the SUID bit on tcpdump?

Posted by Dean on Super User See other posts from Super User or by Dean
Published on 2012-10-12T01:10:04Z Indexed on 2012/10/12 3:39 UTC
Read the original article Hit count: 254

Filed under:

I'm running tcpdump on a remote machine, and piping the output to Wireshark on my local machine over SSH. In order to do this, I had to set the SUID bit on tcpdump.

For background, the remote machine is an Amazon EC2 running "Amazon Linux AMI 2012.09". On this image, there is no root password, and it is not possible to log in as root. You can't use sudo without a TTY, and therefore you have to set the SUID.

What are the practical risks of setting this bit on tcpdump? Is there any need to be paranoid? Should I unset it whenever I'm not capturing?

© Super User or respective owner

Related posts about security

Related posts about permissions