Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Just wanting a bit of advice. I have root access to a server and I want to create a second user and execute everything via sudo should I need to rather than logging in as root. The file /etc/sudoers reads as:

Defaults        env_reset
root    ALL=(ALL) ALL
%sudo ALL=(ALL) ALL

I have added a second user "bob" to the system and added them to the group sudo which should ensure that they can execute root commands. When attempting any sort of privileged action, I get the following error:

sudo: must be setuid root

My understanding is that I would have to set the SUID with

chmod u+s /usr/bin/sudo (or should this be g+s?)

which will enable me to execute sudo.

Are there are any security considerations I have to consider with this approach and is this correct? A lot of posts regarding this say that this is an error but the set up is a virtual server and I was only provided with root access. I believe /usr/bin/sudo has deliberately not been set SUID to restrict other users from running it and to ensure that I have to explicitly set it.

share|improve this question
1  
Something seems off with your system. Can you show the exact permissions on the sudo binary, and the exact command you are trying to run? –  chutz Dec 30 '12 at 16:29
    
-rwxr-xr-x 1 root root 127668 2012-05-16 06:25 sudo This is as expected. I just think it's a security precaution set by my VH provider in the way I described above. –  Tim Smith Dec 30 '12 at 16:52

2 Answers 2

up vote 1 down vote accepted

You indeed have to chmod u+s /usr/bin/sudo.

What I found kinda weird is that all my installation of Ubuntu server (from 10.04LTS to 12.04LTS) always came with this +s set. So, yes it is correct. Furthermore, performing actions through sudo rather than using root is a good approach regarding security. The log /var/log/auth.log logs what has been done through sudo calls.

share|improve this answer
    
Just did this and all seems fine. Thank you! My next thought is to remove login access for root which I guess I can do by changing the shell for the user with chsh /usr/sbin/nologin root. Also removing the line root ALL=(ALL) ALL from /etc/sudoers will ensure that should root be able to login, they cannot run privileged commands. (Maybe that last part is superfluous to requirements!) –  Tim Smith Dec 30 '12 at 17:00
    
To remove root login, you'd better disable it from SSH, put in /etc/ssh/sshd_config: PermitRootLogin no –  Heis Spiter Dec 30 '12 at 17:12
    
Brilliant! Thanks Heis! I was wondering if it was an SSH restriction thing rather than amending user shells! Much appreciated! :) –  Tim Smith Dec 30 '12 at 17:25
    
Just in case, you can also restrict root login just using SSH keys by putting: PermitRootLogin without-password –  Heis Spiter Dec 30 '12 at 17:27
    
I think restricting it altogether is fine. It works much like my other set-up which is what I was looking for. –  Tim Smith Dec 30 '12 at 17:30

I'd advice you to execute the following commands:

chown root /usr/bin/sudo
chgrp root /usr/bin/sudo
chmod 4755 /usr/bin/sudo
chmod 0440 /etc/sudoers
chmod u+s /usr/bin/sudo

Of course you have to run them as root!

share|improve this answer
    
Would I need to execute chmod u+s /usr/bin/sudo if I have already run chmod u+s /usr/bin/sudo? Just clarifying. All permissions and groups are already set as you have advised. –  Tim Smith Dec 30 '12 at 16:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.