Tag Info

Hot answers tagged

13

Here's a good reason to not do it: You don't always login with your password. You may be logging in with an SSH key. It may be a passwordless SSH key... and it may not be the right person who's using it. By requiring you to enter a password at least once, the system is protected against such occurrences. If you still want to hack it (which I strongly ...


6

If (as is the default) you have tty_tickets enabled then you will need to provide a password for each tty you are using sudo in. The timeouts for each tty are maintained updating a file named for the tty in your timestamp directory. If you have tty_tickets disabled then it's the timestamp of the directory which is used for all ttys. On a CentOS system I ...


6

sudo does have a mechanism for not asking for the password for either all commands or a certain subset. Simply prepend NOPASSWD: to the command declaration in /etc/sudoers (using visudo). The problem with not requiring a password is that if a user's session is compromised, either physically or through some malicious script/application/etc, you want to make ...


6

Just restarting postgres is not a long term solution, you will hit the limit again, unless you have physical resource constraints on the server such as memory. During the issue the number of processes opened(nproc) by postgres user was 503 and the estimated number of open files(nofile) was 35225 and yet your postgres_limits.conf shows that you have set nproc ...


3

Provided you are using an encrypted ssh key, you can use pam_ssh_agent_auth to authenticate to sudo using an ssh-agent. Forwarding is possible. A precompiled package is available in Fedora. To configure it, modify /etc/pam.d/sudo: #%PAM-1.0 auth [success=2 default=ignore] pam_ssh_agent_auth.so file=/path/to/sudo_authorized_keys @include common-auth ...


3

Importantly, typing "sudo" is a conscious action. If, as a malware author, I know my malicious script can "sudo" right after you log in, I can really easily run stuff as root. I know exactly when to strike, and it happens every login. If I have to wait for you to run "sudo" yourself, it makes my life a lot harder - I have to keep trying, and will get spotted ...


1

You cannot make sudo allow specific users READ-ONLY access to all files on your system. You could try to authorize these users to a specific command that would allow READ-ONLY access. However, remember that any escape into an editor or allowing redirection could using sudo root perms allow file compromise. I might suggest that you group the people who ...


1

In your example the variables ($HOME, $USER, ...) are interpreted before the sudo command is executed. This, in contrast, should work as you'd expect it: sudo -u johnny -i env | grep HOME


1

Be sure to either add another user to sudoers first or set a password on the ubuntu account (I would advise the former). Failure to do that could lock you out of sudo on your instance! So, create a user for yourself, use the ubuntu user to add yourself to sudoers, log back in as yourself and restrict the ubuntu user. You may notice that the ubuntu user is ...



Only top voted, non community-wiki answers of a minimum length are eligible