Re: Could sudo be an security issue?
Phillip Hofmeister <plhofmei@ip3inc.com> writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Thu, 15 May 2003 at 02:31:22PM +0200, Torbjorn Pettersson wrote:
> > Compare this with a secure, locked down root password in a
> > sealed letter in a safe somewhere that only you now what it is,
> > but everyone know were to find in an emergency + sudo + a sane
> > password aging policy.
>
> Or, assuming all the admins have gpg, encrypt the root password with
> everyone's key, and stick it on a common file share. If it is needed
> they will pull it down to their workstation and decrypt it. Likely to
> be more secured against local attacks than a seal envelope.
>
The idea was that noone is ever going to use the root password
unless the boxen in the serverroom are so broken that they will
not get past fsck, and if you have physical access to the server
room no root password in the world will protect your systems. You
wouldn't want your only instance of your root password/passwords
locked into a broken disk you are trying to salvage...
Regards
Torbjörn
--
######################################################################
Torbjörn Pettersson # Email tobbe@strul.nu
Vattugatan 5 # Web www.strul.nu/~tobbe
S-111 52 Stockholm, Sweden #
######################################################################
Reply to: