0

Just wanting a bit of advice. I have root access to a server and I want to create a second user and execute everything via sudo should I need to rather than logging in as root. The file /etc/sudoers reads as:

Defaults        env_reset
root    ALL=(ALL) ALL
%sudo ALL=(ALL) ALL

I have added a second user "bob" to the system and added them to the group sudo which should ensure that they can execute root commands. When attempting any sort of privileged action, I get the following error:

sudo: must be setuid root

My understanding is that I would have to set the SUID with

chmod u+s /usr/bin/sudo (or should this be g+s?)

which will enable me to execute sudo.

Are there are any security considerations I have to consider with this approach and is this correct? A lot of posts regarding this say that this is an error but the set up is a virtual server and I was only provided with root access. I believe /usr/bin/sudo has deliberately not been set SUID to restrict other users from running it and to ensure that I have to explicitly set it.

2
  • 1
    Something seems off with your system. Can you show the exact permissions on the sudo binary, and the exact command you are trying to run?
    – chutz
    Dec 30, 2012 at 16:29
  • -rwxr-xr-x 1 root root 127668 2012-05-16 06:25 sudo This is as expected. I just think it's a security precaution set by my VH provider in the way I described above.
    – Zakalwe
    Dec 30, 2012 at 16:52

2 Answers 2

1

You indeed have to chmod u+s /usr/bin/sudo.

What I found kinda weird is that all my installation of Ubuntu server (from 10.04LTS to 12.04LTS) always came with this +s set. So, yes it is correct. Furthermore, performing actions through sudo rather than using root is a good approach regarding security. The log /var/log/auth.log logs what has been done through sudo calls.

5
  • Just did this and all seems fine. Thank you! My next thought is to remove login access for root which I guess I can do by changing the shell for the user with chsh /usr/sbin/nologin root. Also removing the line root ALL=(ALL) ALL from /etc/sudoers will ensure that should root be able to login, they cannot run privileged commands. (Maybe that last part is superfluous to requirements!)
    – Zakalwe
    Dec 30, 2012 at 17:00
  • To remove root login, you'd better disable it from SSH, put in /etc/ssh/sshd_config: PermitRootLogin no Dec 30, 2012 at 17:12
  • Brilliant! Thanks Heis! I was wondering if it was an SSH restriction thing rather than amending user shells! Much appreciated! :)
    – Zakalwe
    Dec 30, 2012 at 17:25
  • Just in case, you can also restrict root login just using SSH keys by putting: PermitRootLogin without-password Dec 30, 2012 at 17:27
  • I think restricting it altogether is fine. It works much like my other set-up which is what I was looking for.
    – Zakalwe
    Dec 30, 2012 at 17:30
0

I'd advice you to execute the following commands:

chown root /usr/bin/sudo
chgrp root /usr/bin/sudo
chmod 4755 /usr/bin/sudo
chmod 0440 /etc/sudoers
chmod u+s /usr/bin/sudo

Of course you have to run them as root!

1
  • Would I need to execute chmod u+s /usr/bin/sudo if I have already run chmod u+s /usr/bin/sudo? Just clarifying. All permissions and groups are already set as you have advised.
    – Zakalwe
    Dec 30, 2012 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .