RE: NFS Security Question

From: Devey, Rick J. (rick.devey@unisys.com)
Date: 08/13/01 

Message-ID: <245F259ABD41D511A07000D0B71C4CBA58F5E5@us-slc-exch-3.slc.unisys.com>
From: "Devey, Rick J." <rick.devey@unisys.com>
To: "'McGee Olson'" <molson@crystal.cirrus.com>
Subject: RE: NFS Security Question
Date: Mon, 13 Aug 2001 15:28:32 -0500

I would recommend that you remove the su command or remove root access all
together and use either rbac or sudo for the execution of root commands and
not allow people to su to specific users. I currently don't allow any su
access but use NFS for home directories. I give users the ability to
execute commands as root with "sudo" but they never actually become root.
So in you example Joe could never become bob but would still be able to do
his job.

Rick Devey
UNISYS Global Outsourcing
Unix System Analyst
480 N. 2200 West
Salt Lake City, UT 84116-0800

801-594-5802
mailto:rick.devey@unisys.com
www.unisys.com

>
> McGee Olson <molson@crystal.cirrus.com> wrote asking:
>
> >So, the scenario goes like this. You have two users "joe" and "bob".
> >You have two machines "foo" and "bar". "foo" and "bar" both satisfy
> >(3) and (4) above, and each has a different root password. "joe" has
> >root on "foo", and "bob" has root on "bar". "joe" logs in as root on
> >"foo", and then he executes the line "su - bob". Now, "joe" is logged
> >in as "bob" and has all the permissions associated with the "bob"
> >account.
> >
> >Is there anyway to stop this from happening?

Relevant Pages

  • Re: Choosing a distribution
    ... 'sudo bash' where I haven't had a proper root account to work with. ... cracked and hence give the intruder root access. ...
    (Ubuntu)
  • Re: use sudo without having to type password?
    ... > There are lots of very valid reasons for having password-less sudo ... > commands available. ... >> If you have to do anything as root, you should have to type a password ... It should stand as a warning that they're about to ...
    (alt.os.linux)
  • Re: Change Permissions on a new hard drive to allow write...Problem Solved
    ... Please tell how I could have solved the problem without logging in as ... You'd use sudo or one of its graphical derivatives, ... Those three commands could have been used to do everything you did ... logging in as root. ...
    (Ubuntu)
  • Re: Root access loggin
    ... commands with sudo assume that the user actually knows what commands ... Sudo wouldn't be any help here cause I would need to pre approve commands ... You can grant them access to everything that root has simply by adding their account to the wheel group and using visudo to grant wheel access to everything that root has access to. ...
    (freebsd-questions)
  • RE: Root access loggin
    ... commands with sudo assume that the user actually knows what commands ... Sudo wouldn't be any help here cause I would need to pre approve commands ... You can grant them access to everything that root has simply by adding their account to the wheel group and using visudo to grant wheel access to everything that root has access to. ...
    (freebsd-questions)