Re: SUDO vs root account question

From: Louis Lerman (lblerman_at_gmail.com)
Date: 03/23/05

  • Next message: John Pettitt: "Re: Is Dynamic WEP Secure Enough?" 
    Date: Wed, 23 Mar 2005 10:57:47 -0800
To: Tahis Vera <tahis.vera@gmail.com>

    Tahis -

    First off, the "Mr X ALL=(ALL)ALL" line will allow Mr.X to run any
    command as any user on any server. So I do not know if you want to all
    this.

    I recently had to aid some SysAdmins at my company restrict users
    access via SUDO. I found this page, http://www.courtesan.com/sudo/,
    very helpful as it had an example /etc/sudoers file,
    http://www.courtesan.com/sudo/sample.sudoers, that should be able to
    guide you to limit users access via SUDO as it enabled me to create
    the appropriate entries in the /etc/sudoers file.

    Regards,

    Louis

    On Wed, 23 Mar 2005 10:47:30 +0200, Tahis Vera <tahis.vera@gmail.com> wrote:
    > Hi all,
    > I have two quick questions related to the 'sudo' command;
    > putting a certain user Mr.X with ALL=(ALL)ALL permissions in the
    > sudoers file, gives him COMPLETE root previleges? In other words, if I
    > want that some people, for security reasons, stop using the root
    > account/password for accessing the servers, by crating a sudo user
    > with ALL previledges will decrease this risk? If this sudo account is
    > compromised, will the cracker have COMPLETE root previleges?
    >
    > The other questions is how to set the time (in sudoers file) for the
    > user to work with sudo, without having to write the password (let's
    > say that I want to work for 20 minutes without having to write the
    > password again)
    >
    > regards
    >
    > Tahis
    >

  • Next message: John Pettitt: "Re: Is Dynamic WEP Secure Enough?"

    Relevant Pages

    • [UNIX] Sudo Race Condition Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A race condition with the Sudo command pathname handling allows a local ... When a user runs a command via Sudo, the inode and device numbers of the ... listed in the sudoers file is stored in the variable safe_cmnd, ...
      (Securiteam)
    • Re: user login question (summary)
      ... Root can still su, because su is different from sudo: ... I also have an entry in my sudoers file for root: ... his effective user id (using su command). ...
      (SunManagers)
    • Re: SUDO - cant execute chmod command
      ... > My sudoers file contain the following line: ... > When I call the command via sudo: ... Did you wait for sudo to time out between those two commands? ... Is there a line that refers to chmod without ...
      (comp.unix.admin)
    • Re: Group for screen command.
      ... the 'screen' command? ... I can probably sudo it, but thought there was a group I could add the user to that would allow it. ... I can su into one user on a server and have no problems, but can't the same user on a different server. ... Libenter homines id quod volunt credunt -- Caius Julius Caesar ...
      (Fedora)
    • SUDO - cant execute chmod command
      ... My sudoers file contain the following line: ... When I call the command via sudo: ... It prompt me the password. ...
      (comp.unix.admin)
    Loading