Upgrading sudo rights

Question

One my server, I've given the main user for the web server, access to /usr/bin and /tmp. I did this so that ceartain scripts could could call exim without this user needing to have full sudo rights.

Now I'm wanting to add full sudo rights to this particular user through the ALL = (ALL) syntax.

My question is this, if I convert the user = /usr/bin, /tmp syntax to the full sudo, will those same scripts work. I know when you enter sudo one the command line you need to enter a password. But the aforementioned scripts are running via cron, and right now they don't require a password when they run. So will granting this user full admin rights, change this?

I know maybe this is a simple question, but I don't want to make an avoidable mistake on something so simple.

Some more details for you. This user account in question, is the same user that 'owns' all of the publicly facing web pages. I just want to have a full sudo user for admin tasks without having to login as root. From a security standpoint, would you ever give full sudo rights to the user that owns the files served by the web server? Or would you just create another user just for administration?

Thanks for your help!

Answer 1

I would think giving precise sudo rights is safer than allowing r/w access to /usr/bin, of course /tmp should be r/w to any user and normally is.

To give full sudo rights something like this works in the sudoers file:

example_name ALL=/bin/bash

Then the user runs:

sudo bash

And will have a full root shell. Very unsafe obviously, only should happen for those who are actually admins and know the root password, in my opinion.

To allow a user to start a service such as exim something such as the following would work:

example_name ALL=/etc/init.d/exim4 start, /etc/init.d/exim4 stop, /etc/init.d/exim4 restart, /etc/init.d/exim4 reload

Anything root can do can be configured and done with sudo, there should never be a need for a user who needs admin rights to perform certain tasks to get access to the root account.

As an aside, granting sudo rights to certain binaries can have unexpected consequences if said binary allows you to start a shell (vim for example). In that case the shell starts with the same elevated privileges and basically gives you root access. A similar thing happens when you grant sudo rights to run make, then a user could abuse make to place files in all kinds of places.

Thus beware of which sudo rights you grant and how you grant them. If the binary, such as vim, has a restricted mode, then it's better to use that instead. It's always better to be on the safe side and grant the least rights possible to get a task done and expand on a case by case basis.