Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On Linux we authenticate users against AD. The AD users are not listed on /etc/passwd.

We are about to deploy a NFS solution to mount some extra space for each group of users.

If a user(A) with sudo su privileges goes to root, then he can impersonate user(B) just by su user(B) and going to the NFS.

Is there any way to disallow root to su user if the user is not listed on /etc/passwd ?

share|improve this question
    
You might also find some more answers at security.stackexchange.com –  Josh Brower Dec 23 '10 at 16:28

3 Answers 3

up vote 0 down vote accepted

I think you should re-think your problem. I don't know of any way to achieve what you want but... if you have a user with sudo ALL privileges that you don't completely trust, then you should restrict that privileges.

share|improve this answer

If you're going to give User A root privileges then no, you can't restrict them from doing anything (no matter what blocks you put in place, root can always get around them; with a very few exceptions). You should add User A to sudoers and tightly configure what programs they can or can not run.

share|improve this answer

Doesn't answer your direct question, but I think your issue is with NFS, not sudo/su - you're going to have this problem anytime you use NFSv3 as it relies on UIDs to enforce access permissions.

Even if you did somehow prevent users from switching to root and back to another UID, a malicious user could simply connect their own device or boot a different OS inplace of your specially configured system and overcome the protection.

Have you considered using NFSv4? It uses Kerberos to authenticate mount requests and enforce access permissions so wouldn't be vulnerable to this happening.

share|improve this answer
    
nfs does not depend on me, it will come from an hitachy NAS which give us crossed credentials for samba and nfs to the same filesystem. –  marc.riera Dec 23 '10 at 16:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.