26.6 Defending Against Privilege Escalation
He sagla shiklyacha khara faayda – system asalamat thevne:
| Defence | What it stops |
|---|---|
| Least privilege | Give users/services only what they need; a foothold stays limited |
Careful sudo rules |
Never give broad NOPASSWD or editors/shells via sudo |
| Remove unnecessary SUID bits | Fewer SUID binaries = fewer escalation paths |
| Correct file/dir permissions | No world-writable scripts that root runs |
| Patch the kernel and packages | Closes local exploits (sudo yum update) |
| Separate service accounts | A hacked web app runs as www-data, not root |
| Auditing and monitoring | Detect enumeration and unexpected root shells (Part 11 SOC) |
For your own reels app and servers: run the web server and PHP as a low-privilege user, keep the OS updated with sudo yum update, and never store passwords or AWS keys in world-readable files.
Why this matters for security
A single low-privilege foothold is limited; privilege escalation is what turns a small breach into a full compromise. Enforcing least privilege and patching removes most escalation paths, so even a successful intrusion causes far less damage.
Ravindra Bagale's Tip
The biggest mistake: running a web app as root "because it makes everything easier". Never do this – if that app is hacked, the attacker gets root directly. Always run services as a least-privilege user. This one rule stops a lot of breaches.
Ravindra Bagale's Tip – मराठी
सर्वात मोठी चूक: web app root ने चालवणे "कारण सगळे काम सोपे होते". असे कधीही करू नका – तो app hack झाला तर attacker ला थेट root मिळतो. नेहमी कमी अधिकाराच्या (least privilege) user ने service चालवा. हाच एक नियम खूप breaches थांबवतो.
Ravindra Bagale's Tip – हिंदी
सबसे बड़ी गलती: web app को root से चलाना "क्योंकि सारा काम आसान हो जाता है". ऐसा कभी मत करो – वह app hack हुआ तो attacker को सीधा root मिल जाता है. हमेशा कम अधिकार वाले (least privilege) user से service चलाओ. यही एक नियम बहुत सारे breaches रोकता है.
Lab
On your own EC2 server, list SUID binaries and confirm your web app runs as a non-root user (ps aux | grep -E 'apache|nginx|php'). Then run sudo yum update and, in your notes, write two least-privilege changes you made or would make.