Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an LDAP server set up with our Active Directory. When users login to a Linux machine with LDAP client installed as root, they are able to su - into any Active Directory account without needing that users password. This is a big security risk, does anyone know why this is or how to prevent this?

Preventing root access is not an option unfortunately as it is required by some users in some cases.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

This is standard Unix design and you can't really prevent root from doing anything he wants.

A more secure design would have users use sudo and for the sudo configuration to allow users only to perform the specific tasks they need to perform. Unrestricted sudo should be limited to specific IT staff who need it for maintaining the servers, and the actual root password should be kept in a safe somewhere.

share|improve this answer
    
Ah okay. I also wanted to mention that we are using an EMC VNX 5100, but I'm not sure if that is relevant. I guess my question is, why does a local root account have access to AD user accounts through LDAP? –  Steven May 8 '13 at 16:35
    
Because that's how it works. Root's privileges override the LDAP auth when it comes to this. Your compensating control would be to limit ROOT access. –  ewwhite May 8 '13 at 16:44
    
Right, it's inherent to the operating system design. Windows doesn't allow for this, which is probably why you're confused. –  Michael Hampton May 8 '13 at 16:47
    
Okay this makes more sense now. I was told we would sometimes need to give root access. Is there any limitations to having users use sudo instead of using root directly? –  Steven May 8 '13 at 16:57
    
Not really. You can either let people run any command, or specify exactly what commands a user may run with sudo. And the benefits greatly outweigh any small inconvenience. –  Michael Hampton May 8 '13 at 16:58
show 2 more comments

This is how it's supposed to work.

You CAN prevent or restrict root access, though. I work with healthcare systems, and am subject to all sorts of regulatory and compliance tasks. Our auditors are happy with LDAP authentication, but prefer that we enable sudo access to handle regular users who may need root escalation privileges on occasion.

share|improve this answer
    
This seems like it might be the only way to go in our case then. Thanks for the input. I will continue to do a little more research and post an update if I find anything. –  Steven May 8 '13 at 16:45
add comment

My colleague was able to find a solution to the root accessing LDAP user accounts w/o password issue. There is a parameter in /etc/pam.d/su called pam_rootok.so. This needs to be commented out with #. After this is commented out, root will be prompted for the user's password when attempting to su to it.

share|improve this answer
2  
This isn't foolproof; it's pretty trivial to use a su binary or equivalent that doesn't bother with PAM and so uses the original semantics, or just write a trivial bit of C code that calls setuid() and then fork()s a shell. Not to mention that root can just edit /etc/pam.d/su and restore this line. –  Michael Hampton May 15 '13 at 5:03
    
I thought about this after as well, so it seems using sudo is still the most secure in our scenario since there is nothing to really prevent root from just re-editing the parameter again... –  Steven May 15 '13 at 17:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.