security issue of Linux sudo command?

Question

1. I am using a Red Hat Enterprise 5 Linux box. I find if a user is in /etc/sudoers file, then if the user run command with sudo, the user will run this command with root privilege (without knowing root password, the user runs sudo only need to input the user's own password in order to run a command with sudo). Is that correct understanding?

   2. If yes, then is it a security hole? Since users other than root could run with root privilege?

thanks in advance, George

Answer 1

It is not a security hole, at least no more than su is.

sudo is just of way for an administrator for having a quick root access without using a root shell (which can be dangerous).

sudo just requires the user to enter his own password and will indeed give him root access (try $ sudo whoami). However, not everyone should be in the /etc/sudoers file.

If you take a look at sudo manpage, you'll find how to limit sudo to some simple commands.

You can for instance, only allow the user bob to execute $ sudo poweroff without allowing him to do $ sudo cat /etc/shadow.

So no, it's not a security hole if you configure and use it correctly. If you don't want your users to have a root shell, think of forbidding commands like $ sudo su.

Answer 2

If it were a security hole, sudo would have been taken down already. It's intentional, you can configure it to require the user's password, the root's password or no password at all..

Because only the root can configure it anyways, there's no security hole. The root configures who has access to it, who has to put in which password, for each user, for each group.

Also, about the last part: "since users other than root could run with root privilege": That's the whole point of the sudo program.

Answer 3

sudo is secure - secure enough for some distributions (Ubuntu) to use and recommend it by default.

That said, if you give blanket sudo rights to a user it largely removes the separation you have between that account and a root account. If you give blanket sudo rights to user timmy, for example, the timmy account becomes as privileged as the root account. Anyone who breaks into timmy's account can do anything as root (in most cases, timmy's password is needed).

Pro-sudo arguments

• Usually set up so that nobody can log in as the user called "root". Can make it harder to brute-force a superuser login.
• You can have fine-grained control over which commands a user can execute as superuser (though usually you'd give all privileges to one account, which effectively serves the same role as "root" with a different name).
• Removes the temptation to just stay logged in as root, when not all commands you run need superuser privileges.

Anti-sudo arguments

• sudo might be seen to encourage the practice of handing out superuser-level privileges to users, which is probably not a good idea.
• sudo is a little more complicated to set up because it is so flexible. While this allows you to make it nice and secure, it can also make it easier to inadvertently open up security gaps if you're not careful or don't understand what you're doing.
• It can be seen as a bad idea in general to use an account with superuser privileges for everyday use, and having sudo privileges is the next best thing. A counter-argument to this is that the your user password is (in most cases) still required to elevate to superuser status, and this is not likely to be known to intruders/errant processes running as you.

Essentially they are just two different schools of thought, both valid enough to have whole distributions backing their own approach.

I'm more comfortable with the non-sudo approach, mainly because that's what I'm more familiar with as a Debian user. I find the simplicity of having a root account over the flexibility of sudo wins for me. I don't allow root login remotely (ie via SSH) and I recommend that nobody else should, either.

Answer 4

sudo is secure because:

1. a root user, or another sudo-enabled user (who can run 'visudo' or '$EDITOR /etc/sudoers') has to modify /etc/sudoers to grant the privileges.

2. You can restrict and specify exactly what a person can run with root privileges, which makes it possible to have varying levels of admin users on a server.

3. As a privileged user you can view the existing /etc/sudoers file, to see which users have permissions.

4. You don't have to share the root password amongst a team of administrators.

5. There is full accounting of what is done with the sudo command, providing a clear audit trail

Answer 5

I think it's better for security than being logged in as root, as there isn't convenient to do things as root. It's certainly better for accountability, which is part of security.

You do have to restrict who would use it. Typically, you limit it to people who would know the root password anyway, although it's possible to get fancier and limit what specific people can do.

The security issue that bothers me is that it is not necessary to enter my password for every sudo command; if I enter another few from the same terminal without much time elapsing, it accepts the sudo without the password. This is presumably to avoid making me continuously entering my password, but it's conceivable that some bad-guy userland software could exploit that. I don't know enough to evaluate the risk, personally.

Answer 6

sudoers do not automatically have access as root. They have access as the configured user. It is possible and correct to provide users access to run tools as other non-root usres.

Any users who have access to run a shell or a command that can give shell access should be the users you would trust with the root password. With sudo it is possible to run a system without a root password. All uses of sudo is logged, which is not the case with commands run as root.

As noted it is possble to limit access to specific comands. The example sudoers has a number of command sets you might want to grant to specific users who need to do task requiring root privileges. By using sudo it is possible to allow this without giving them the root password.

Anyone who can run a script or command with root privleges, which they can change has effectively been given root access. You need to trust these people, or don't give them the access.

There are a large number of task which require root access. With sudo you can safely delegate these task to backup operators, webmasters, etc.

Sudo is far more secure that the alternatives. If misconfigured, or if incorrect access is given to untrusted users it is a security risk (hole).

Answer 7

The sudo command allows one user to run commands with the privileges of another. The other user can be root or it can be someone else, but the default is root. It was designed for this purpose, has many configuration options to help lock things down in a variety of ways, and has been vetted over many years by a lot of people. It's not appropriate for all security problems, but used properly, it can be an highly useful tool. However, if not used properly, it can create more problems than it solves.

Answer 8

sudo is not good for security. A privilege delegation software is to help to distinguish who did what, and log activities reliably. But with most sudo setup, the activity log can be easily faked. And its use of user's system password mean if someone steal a user's login password, he would also able to run sudo as that user to do bad thing. Then on UNIX/Linux platforms, it's very easy for any sysadmin to run a script in background to steal other's password. Sysadmin also can do password swap attack to use victim's account to do bad thing. And also can use victim's account to run sudo to do bad thing through sudo timestamp file update.That means when log says A did something at what time, it may not be A. extra investigation is needed to find out what happened, but that may not be always possible.