Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several servers where some users require to be sudoers to work. The problem is that when sudoers can run the command sudo su and login as user root. It seems very risky to run that command.

I tried with Command Alias ​​in the file /etc/sudoers but it has not worked. Is there any way that they are sudoers but not run the command sudo su?

share|improve this question

3 Answers 3

% sudo ALL = (ALL) NOPASSWD: ALL

You have effectively given the users in the sudo group full unrestricted control over your system. Trying to deny them access to the su binary is as others have noted futile as they already have root privilege via sudo and membership of the group.

You should analyse the workflow of the users in the sudo group to determine which commands they need to run as root and use sudo to give them privilege access to those commands only. If necessary write scripts and give the sudo group access to run the script (make sure they don't have write access to it though) rather than the individual commands within it.

For example you may determine that your users need to be able to use kill and all of the commands in the directory /usr/local/sudocmds (where your local scripts live) so you would give them sudo access like so

%sudo    ALL=NOPASSWD: /usr/bin/kill, /usr/local/sudocmds

You can use command aliases too

Cmnd_Alias     PRINTING = /usr/sbin/lpc, /usr/bin/lprm
Cmnd_Alias     DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump

%sudo ALL=NOPASSWD: PRINTING, DUMPS, /usr/bin/kill, /usr/local/sudocmds

Which adds the commands in the PRINTING and DUMPS Cmnd_Alias to the list of commands that the sudo group can run.

Take a look at the sudoers man page for more information and examples.

share|improve this answer

In order to properly avoid this you must take a different approach.
If you disallow sudo su I can still run sudo -u root /bin/sh if you disallow this I will write a small wrapper script and execute this...

The only way to solve this is to only allow the needed commands.

share|improve this answer
5  
Whitelisting: good; Blacklisting: bad. –  Ladadadada Jan 23 '12 at 11:12

It is not clear what you have done, but you can grant sudo privilege for certain users/groups and for specific commands. In order to get better help, it will be better to provide more information like the sudoers file content and what you have tried exactly.

share|improve this answer
    
It's simple: In /etc/sudoers I have: % sudo ALL = (ALL) NOPASSWD: ALL The user "user1" belongs to group "sudo". Therefore, the user "user1" can run "sudo <command>". Therefore, "user1" can run the command "sudo su". I need that "user1" is sudoer, but can not execute the command "sudo su". –  Gon Jan 23 '12 at 10:33
    
You should grant the user sudo for all commands if possible. You need to count the commands they need/should execute and then grant them the needed privileges. Otherise, you should either trust your sudoers or not. In the laster case, you should not give them sudo from the first place. –  Khaled Jan 23 '12 at 10:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.