Wireshark-dev: Re: [Wireshark-dev] Wireshark on Kali linux
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Dario Lombardo <lomato@xxxxxxxxx>
Date: Tue, 5 Feb 2019 23:08:53 +0100
Yes. Kali Linux is a very popular distribution for pentesting. Most of the software it ships requires root privileges, hence they just use root. It is basically a live distro run from cd/USB or in a VM. Usually it's not installed on the hard drive and when a new version is available it is just replaced by the new one. The kali community keeps the softwares up to date to their best, so no need for update the packages. The last version I found ships wireshark as packed by Balint, v2.6.3.

Random thoughts:
1) the solution proposed in the post looks like patching wireshark due to a bug of it. The post shows v2.4 so it looks like it is there since forever.

2) due to the "throw and replace" model, patching the Lua file is just a palliative. As long as the user replaces kali, the error is back.

3) kali is debian derivative shipping Balint's package. That means that the solution can be in the software itself (I don't like it very much) or in the packaging system we control directly (much better, IMHO).

4) no way to change their working model. AFAIK kali just runs this way. You can create an unprivileged account and log in with it, but that's not what the manuals say. Upgrade to a new kali and you're back again with just the root account. 

At the moment I'm trying to change debian/rules to implement the patching of the Lua file when the package is installed on kali. Let's see where it goes. 

On Tue, Feb 5, 2019, 19:10 Guy Harris <guy@xxxxxxxxxxxx wrote:
On Feb 5, 2019, at 8:48 AM, Dario Lombardo <lomato@xxxxxxxxx> wrote:

> I know that the problem is how kali runs wireshark (as root) and that it should be avoided, but this is how kali works

Kali Linux has no user accounts, so you log in as root and thus everything runs as root?
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe