2
votes
2answers
41 views

Configuring sudo to not prompt for password on non-allowed commands

There is plenty of information on how to make sudo not prompt for passwords (NOPASSWD). Let's say I have user alice, and this line in my sudoers: alice ALL=(root) NOPASSWD: /bin/myadmintool This ...
-1
votes
2answers
51 views

Security in users having sudo access

How to protect my passwords list (in different databases for example) in a UNIX environment where most of the users have sudo access to other user IDs? I have a script (main.sh) with the following ...
0
votes
1answer
41 views

Upgrading sudo rights

One my server, I've given the main user for the web server, access to /usr/bin and /tmp. I did this so that ceartain scripts could could call exim without this user needing to have full sudo rights. ...
40
votes
6answers
3k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
15
votes
3answers
1k views

How can I implement ansible with per-host passwords, securely?

I would like to use ansible to manage a group of existing servers. I have created an ansible_hosts file, and tested successfully (with the -K option) with commands that only target a single host ...
-3
votes
2answers
488 views

Allow any arguments for a given command with sudo [closed]

I have the following sudo config entry which I added via sudo visudo: mark ALL = NOPASSWD: /usr/bin/lxc-ls* I can run lxc-ls with my user fine but I can't append any parameters without it demanding ...
0
votes
0answers
34 views

visudo passes syntax check but the file fails when put into place

I've been trying to create a modified sudoers file in /etc/sudoers.d/ but am having trouble. visudo -cf /file/path shows no syntax issues, but when i mv /tmp/sudoers/ /etc/sudoers.d/sudoers sudo ...
2
votes
2answers
798 views

Configure Ubuntu to allow ssh login via pulic/private key and sudo without password

I'm setting up a fresh Ubuntu 13.04 server. I created some users and copied their public keys for ssh authentication to their home folders. Login via password will be disabled. Everything works fine ...
-1
votes
2answers
134 views

su command works without prompting password

I'm on a RHEL server where the su command drops the user into root without prompting for a password. Obviously, this is a pretty big cause for concern which I'd like to fix. I'm not in contact with ...
4
votes
4answers
209 views

Disabling ssh as root on Linux boxes and the challenges of writing scripts

It's a common suggestion from security-minded people to disable ssh as root on Linux boxes. My question is this: Let's say you normally write lots of scripts which ssh to a large number of Linux ...
1
vote
1answer
119 views

How can I give tomcat sudo right [duplicate]

Possible Duplicate: No TTY present when running commands over SSH in here-document I installed tomcat7. It is nologin user tomcat7. That said, I need to give tomcat7 sudo rights to run ...
2
votes
1answer
230 views

If sudo is broken, what should be used instead?

I found the following answer to a FAQ question about a security problem in Oprofile: This "problem" only occurs if you actively, and mistakenly, configure access to OProfile via sudo. OProfile ...
2
votes
2answers
332 views

How safe is it to allow www-data to run sudo quota?

I manage the hosting of a custom Software-as-a-Service (SAAS) CMS and Ecommerce system. This system is powered by a cluster of LAMP servers behind an HAproxy instance, and each customer / domain has ...
2
votes
2answers
58 views

What is the best method to define a list of commands and access one would need in order to administer a certain application?

My team needs to install and administer a very big application on Red Hat 5.7, and needs to be able to do so as root. During the project, the Unix support team (which is responsible for the OS ...
4
votes
2answers
164 views

best ways allowing a group to edit some /etc files

we have a group called JBossAdmins and users of this group must edit some /etc files on a RHEL 6: /etc/httpd/* /etc/java/* /etc/jboss/* my first idea was to give the following sudo permissions: ...
7
votes
3answers
409 views

We are transitioning from shared root password to using sudo. How do I audit usage of sudo?

When I came on board, all our SAs had to memorize the root password to the systems. I felt that this was cumbersome (when someone separates from the company, we had to touch every server and change ...
6
votes
1answer
391 views

How do I re-enable an sudo lecture, once it's been seen

I have sudo set to show the usual lecture on its first use by a user. Without thinking, I accidentally triggered its display for a new user as I was setting them up, and now it's been shown, they ...
0
votes
1answer
218 views

allow a user to run command as another user without any password prompt

I'm trying to achieve same result as the answer from that existing SF question without having to enter the password for the original user, that is, I'm userA, and I want to be able to run a command as ...
2
votes
3answers
197 views

How to enable non sudo user access to top with all processes?

I use Ubuntu Server 10.04. I have users that normally don't have access to sudo. When this user is using top command he sees only processes for the current user. I added a line to /etc/sudoers: user ...
2
votes
3answers
198 views

Disallow root to su on a user which is not listed in /etc/passwd

On Linux we authenticate users against AD. The AD users are not listed on /etc/passwd. We are about to deploy a NFS solution to mount some extra space for each group of users. If a user(A) with sudo ...
3
votes
7answers
3k views

security issue of Linux sudo command?

I am using a Red Hat Enterprise 5 Linux box. I find if a user is in /etc/sudoers file, then if the user run command with sudo, the user will run this command with root privilege (without knowing root ...
5
votes
2answers
2k views

sudo chown - prevent ../

Need to allow a user to chown files under a particular directory using sudo. This does the trick: user1 ALL= NOPASSWD: /bin/chown -[RPfchv] user2\:user2 /opt/some/path/[a-zA-Z0-9]* But, does not ...
0
votes
1answer
329 views

Security concerns about giving the apache user a tty

I need to invoke sudo from a PHP script (web-triggered) so as to run a command as another user. However, I get the message "sudo: sorry, you must have a tty to run sudo". Would there be any security ...
5
votes
11answers
4k views

How can you prevent root password change on linux?

I'm setting up a server which other people will have sudo access to via ssh. They can install stuff and make changes as they see fit, however I still need to manage the server, install patches and ...
3
votes
1answer
226 views

Flexible sudo access

I want to be able to give a user on a system I administrate the ability to access file X, using command Y using sudo. Is there a way to do this while allowing some flexibility over the arguments to ...
2
votes
6answers
1k views

How can an attacker gain root next time a compromised account does?

I was reading Ubuntu's documentation about root/sudo when I came across the following: Isn't sudo less secure than su? The basic security model is the same, and therefore these two systems share ...
35
votes
2answers
4k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
23
votes
2answers
47k views

How can I allow one user to su to another without allowing root access?

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root). For instance, I'd like to ...
4
votes
5answers
3k views

Limiting the use of `sudo -s`

I am setting up Nagios on some of my Linux servers and have run into a bit of an issue. The check_ide_smart plugin requires root access to the system to run. To run it, I use the check_by_ssh plugin ...