Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We will be creating a new server build model using Solaris 11 and I wanted to know a little more about sudo.

I have had very limited introduction to how it works in Ubuntu Linux, but we only use that for workstations. I wonder is potential in Solaris.

  1. I understand that certain users can be given root access without providing them the root password. I like this.
  2. I also have seen it implied that some kind matchers can be applied to only allow certain access. This of course has limited use, but it can
    • add a layer of work before a user is able to sabotage the system, perhaps delaying the sabotage until his/her access is revoked. (this should never be a problem, but it is good to have measures in place in case there is mis-placed trust a couple years from now)
    • prevent mistakes, for example accidentally shutting down the wrong machine.
    • simplify some processes, for example a user may be charged with keeping the DNS server up to date, in which case they could be given access to specific zone files, as well as permission to run svcadm refresh dns-server.

My questions are

  • What capabilities apply to Solaris, as opposed to either Linux or just myth?
  • Do you have recommended reading material on sudo? (as it relates to Solaris)
  • Would you recommend that I use it, or just stay with su -?
share|improve this question

3 Answers 3

up vote 7 down vote accepted

Sudo works exactly the same with Solaris as it does with Ubuntu etc so any previous experience you have with it is useful. Solaris does though come with Role Based Access Control (RBAC) which gives you quite fine grained control over what people are alowed to run with elevated privileges.

Using sudo or RBAC is preferable to su - as they can be used to log what actions have been taken.

share|improve this answer
    
Have you used RBAC? I read that it was not very beneficial. Perhaps it was just difficult to set up or it has specific use cases. I don't know. –  George Bailey Sep 7 '11 at 22:54
    
I have used RBAC but it was some time ago (Solaris 9). I preferred sudo but I think RBAC has been improved since then. I may look at it again some time. –  Iain Sep 8 '11 at 13:49
    
While they share some common features, sudo and rbac are quite different in their implementation and scope. rbac has a much finer / deeper control about what privileges can be granted, being integrated in the kernel. –  jlliagre Sep 9 '11 at 6:27
    
Yes, it reminds me a lot of the privilege system that OepenVMS uses. –  Iain Sep 9 '11 at 6:47
    
Nice Christmas decoration on your Gravatar! :) –  George Bailey Dec 26 '11 at 18:36

sudo works pretty much identically on Solaris as it does on Linux, FreeBSD, AIX, etc. -- The major caveat being that you will need to install it and configure it on Solaris (You can download it here).

That website also has extensive documentation on sudo, and if you are unfamiliar with it I would suggest that you invest some time in reading about what sudo is and what it can do for you, then think about how best to integrate it into your environment.

Note that I do not believe there are Solaris 11 packages for sudo at this point - you will likely need to compile it yourself (and/or build your own package). This is not horribly complicated: Read the documentation and proceed carefully. If you feel like you are out of your depth there are mailing lists (again, see the site I linked above) that can help you out.
As others have pointed out sudo has apparently been absorbed by Solaris 11 - No compiling, just configuration.
Again the docs at the site linked above will tell you pretty much everything you need to know.


From a security standpoint I would DEFINITELY recommend using sudo - Not giving out the real root password is a huge benefit, and the finer-grained access control is worth the administration required.

share|improve this answer
3  
Actually, sudo is included in Solaris 11 already, no building required. For Solaris 10 and older you would need to get it from somewhere else. –  alanc Sep 7 '11 at 23:31
  • What capabilities apply to Solaris, as opposed to either Linux or just myth?

It is the same code and the compiling options ar similar to what those used on Linux so the setup and purpose is identical. One difference is that root is (by default) a role on Solaris 11 Express, not a user account. That means using either sudo or rbac (pfexec) is now mandatory on Solaris.

  • Do you have recommended reading material on sudo? (as it relates to Solaris)

You'll probably find that document interesting, It explains why sudo was introduced in Solaris: http://mail.opensolaris.org/pipermail/opensolaris-arc/2008-June/009146.html

  • Would you recommend that I use it, or just stay with su -?

sudo or pfexec are better than su - as the less anyone is root the better. Sudo has its own logging feature. pfexec has some extra capabilities and integrates with Solaris auditing so might be a preferred solution in some cases.

Two notes:

  • Solaris 11 express is bundling sudo so you don't need to compile it or even install it on that OS.

  • On default installations, sudo is a required component, given the fact root is by default unsuitable for direct logins and the installer no more use rbac to grant extra privileges to the initial user account.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.