Re: Sudo ... use or delete?
On Fri, Jan 29, 2021 at 02:33:49PM -0300, Eike Lantzsch wrote:
> On Friday, 29 January 2021 12:42:19 -03 tomas@tuxteam.de wrote:
> > On Fri, Jan 29, 2021 at 08:12:20AM -0700, Antonio Russo wrote:
> >
> > [...]
> >
> > > But, more specifically to your question about sudo, let me argue
> > > that, at the level of paranoia required to be worried about sudo,
> > > you should also be worried about a LOT of other packages [...]
> >
> > I do appreciate and use sudo -- for me it reduces embarrasing
> > fat-finger mistakes significantly.
> >
> > But it's not everyone cup of tea, and to be fair, there's one
> > current privilege escalation vulnerability [1] around. It seems
> > easily fixable (Debian has a fixed version out, if you do use
> > sudo, check with [2]).
> >
> > So if you aren't using <foo>, it's wise to not install <foo>.
> > Complexity kills :-)
> >
> > Cheers
> >
> Hi,
> IMHO sudo within itself is not dangerous but the user/admin is. Sudo has
> a huge potential to be misconfigured and as a consequence to break down
> all and every safety barrier. Sudo is a very good tool - to shoot
> oneself into the foot.
> Good read: Sudo Mastery by Michael W. Lucas
> Cheers to y'all
>
The recent vulnerability notwhithstanding, the best guideline out there
for sudo access is: don't give access to anyone via sudo if you would
not simply give them the root password.
THe chief benefit of sudo is that it makes seeing who did what much
easier. Imagine admin1 uses su to become root and admin2 uses su to
become root. At that point, it is not possible to tell who did what by
looking at command history. With sudo, the invoking user would be
logged, which could help with troubleshooting and figuring out who to
ask why some specific action was taken.
Those with access could certainly circumvent it (and easily in nearly
every case), but then it goes back to the guideline of not giving sudo
access to anyone who not be tusted with the root password.
Regards,
-Roberto
--
Roberto C. Sánchez
Reply to: