Re: [Tcpreplay-users] Playing pcaps as user (not root)

[Lothar B. <lo...@lo...>]

Andrew Edgecombe wrote:
> Why not set the suid bit on the tcpreplay executable?
> eg.
> sudo chmod a+s /usr/local/bin/tcpreplay
> 
> or am I missing something?

That would work indeed. The problem with this approach is that it does 
allow _every_ user on the system to use tcpreplay as root. If there is a 
bug in tcpreplay (like a buffer overflow), every user on the system 
might be able to gain root on that system.

And there is a reason that a normal user isn't allowed to have access to 
raw sockets. That's because he is able to do nasty things with them. A 
setuid tcpreplay does enable a user to do nasty things. You can for 
example start a DOS attack against any given target on the interet using 
the "send as fast as you can option" with a prepared pcap file. Feel 
free to think of more nasty things that can be done :-)

I'd really go for a solution using sudo if you have to chance to do so. 
It does give you the possibility to enable only one user to use 
tcpreplay as root.

Best regards,
   Lothar