OK. I was going to make this post as part of a deeper thread about installer problems, but I feel the need to post this where it will get more visibility:
This script is a huge security risk.
It takes arbitrary commands issued to it via the API and runs those on your system, then uploads the stdout from those commands back to their servers, where it's stored for an indeterminate amount of time with indeterminate security. (Their privacy policy makes no mention of the storage, usage, or dissemination of data collected via this tool)
There is literally no limit to what commands to be run, and you can't easily audit which commands it will run prior to them being executed. There's even a built-in privilege escalation path, via the upgrade script.
You might as well give them a login with passwordless sudo to any system you install this to.
Even without privilege escalation a feel like this is a big security risk.
I can't imagine having dozens of servers bound to a web service, with a user interface accessible from anywhere with a simple login and password. and from that interface you can add any number of arbitrary command.
I've created the account, copy the command, pasted in a terminal but I just couldn't hit enter... and that is in my home computer. I downloaded the link and the target manually, just checkout the content.
This isn't about the installer. It's about allowing arbitrary commands to be executed as specified by the API.
Specifically, lib/authentication.js receives a new command, passes it to addActivity in lib/execute_services.js, which schedules it to `exec` periodically (the period is defined by the API response) via ExecuteCommand.executeCommand.
As for the user that the sealion-agent is run as, it's started as root, then setuid'ed to the sealion user in index.js, so any update can undo the setuid and allow full root access.
Basically, by installing sealion-agent, I have given you, all of your current employees and of your future employees (both in CA and India) full access to the server.
This script is a huge security risk.
It takes arbitrary commands issued to it via the API and runs those on your system, then uploads the stdout from those commands back to their servers, where it's stored for an indeterminate amount of time with indeterminate security. (Their privacy policy makes no mention of the storage, usage, or dissemination of data collected via this tool)
There is literally no limit to what commands to be run, and you can't easily audit which commands it will run prior to them being executed. There's even a built-in privilege escalation path, via the upgrade script.
You might as well give them a login with passwordless sudo to any system you install this to.