Re: sudoers question
On Sat, May 13 2023 at 01:51:03 AM, Lee <ler762@gmail.com> wrote:
> On 5/12/23, DdB wrote:
>> Am 13.05.2023 um 00:03 schrieb Lee:
>>> On 5/12/23, Stefan Monnier wrote:
>>>>> Or configure sudo to disable tty_tickets, so that the timeout (10
>>>>> minutes by default IIRC) applies to all terminals.
>>>>
>>>> `sudo bash` anyone?
>>>
>>> me! me! but I also have
>> (...)
>>> %adm ALL = (root) NOPASSWD: ADM_COMMANDS
>>
>> Of course, there are ways to allow any/all sudo commands without
>> password. And i also have to cast a warning here:
>>
>> The kind of mistakes, any user (including yourself) can initiate, grows
>> considerably, if he can use any commands without even thinking.
>
> In general, yes, but how much trouble can
> /usr/bin/dmesg,
> /usr/bin/apt list
> /usr/bin/apt update
> /usr/sbin/checkrestart
> /usr/sbin/needrestart
> cause?
>
> OTOH, I like the idea of logging in as root to do admin stuff. But
> that seems to be frowned on now.. I don't know why :( .. unless
> logging? 'sudo bash' or logging in as root doesn't leave an audit
> trail of commands you've done
>
The benefit is that there is no shared password. If one of the people
entrusted with sudo privileges needs to lose those privileges (perhaps
because they leave the organization), removing that user account stops
their access. If, on the other hand, you were allowing admins to login
as root, you now need to change the shared root password. Of course,
this requires a degree of locking down. For example, the set of users
allowed to do day-to-day administration tasks must not overlap with the
set of users permitted to modify the sudo configuration or set root
password. You can also have different sets of users permitted to do
different kinds of administrative tasks: one group might be permitted to
stop/restart a small set of services, for example. And no one can be
permitted to do `sudo bash` or its equivalent.
Logging is a nice additional benefit, and some organizations may be
required to keep audit logs for server configuration changes. sudo
providing this will be a bonus for them.
On single-user systems, the ability to do NOPASSWD for selected commands
is nice. I don't know of any other benefit.
--
regards,
kushal
Reply to: