3

In the /etc/sudoers file on my Red Hat server, I have this line:

%webdevgroup ALL=NOPASSWD: /bin/chmod * /home/http/*

This is clearly a bad idea, since someone could do something like this:

sudo /bin/chmod 777 /home/http/../../etc/sudoers

Is there a safer way to achieve this functionality without opening the server up to this security hole?

  • Why don't you create several groups and add users to a certain group? – 030 Nov 7 '14 at 19:33
  • 4
    Use filesystem ACLs so users don't have to run chmod 777. BTW, chmod 777 is evil, you almost certainly don't want that, if want a half-way secure system. – Zoredache Nov 7 '14 at 19:34
  • utrecht: That doesn't solve the problem of an untrusted user needing to run this command. – Zach Nov 7 '14 at 19:36
1

If I understand your problem correctly, you want to give rights to webdevgroup on the directory /home/http/*

ACL is a good option, but you can also have a look at setgid : What's the purpose of setgid directory?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.