0

For a specific user or list of specific users, I want to make it so they are not even asked for a password but just directly refused.

Although this is after I've allowed them 1 specif command. so the sudoers file would look something like this(example):

testuser ALL = (root) NOPASSWD:NOEXEC: /bin/ls, <REFUSE_EVERYTHING_ELSE_WITHOUT_ASKING_FOR_PASSWORD>

Is this at all possible? Basically, what I want to achieve can be written as:

Allow this 1 command listed in the custom sudoers file, refuse everything else without even asking for a password, if it is this particular user.

Is that possible?

I've gone over this entire page: https://www.sudo.ws/man/1.8.15/sudoers.man.html

And haven't found it. It's just the password asking part. I want that gone. Everything else in terms of properly checking permission, I want that to stay.

Is that possible?

EDIT: The solution was something like this:

##
# User alias specification (Example user, must actually exist)
##
User_Alias      Defaults:TEST_USER = test_user

##
# Cmnd alias specification (Example command, multiple wildcards possible)
##
Cmnd_Alias      TEST_CMD = /bin/ls */home/test_user/

# Don't ask for password on this particular user, just apply the rules.
Defaults:TEST_USER !authenticate

TEST_USER ALL = (root) NOPASSWD:NOEXEC: TEST_CMD

I'm just gonna add here: I read the comment on how this setting would allow an attacker to determine which user can execute sudo and which cannot, and that sounds like the attacker is already at the point where they're in my system and able to jump between accounts. Sounds like they got some kind of elevated access if they're at that point. That sounds worse than 1 limited account being compromised, it sounds like they can access all accounts at this point.

Perhaps I'll realize it later, and be all "oh dammit, that's right" but I don't see it right now. I would honestly prefer it be explained. Should I make a separate question for it? Googling this particular option does no yield many results, it seems relatively unknown.

That being said, this particular situation I created is for a user that doesn't have a password at all. So I think an attacker in that case might try a password a few times, maybe a purpose-crafted string even, and then conclude "oh this user doesn't have a password I can't do anything with this user" and move on. Just the same as with disabling authentication. At least now they can't enter a purpose crafted string at all.

Is that horribly naive?

6
  • Why would you want that? – Tommiie Dec 7 '19 at 23:42
  • @Tommiie Because it would be faster. Just immediately get "your user cannot do this". I mean: why bother asking them if I know I'm going to refuse them anyway? If I know that the sudoers file I made for them allows only 1 thing or a few specific things, and nothing else? Why still ask for a password if I know they're going to be refused? Just refusing them automatically would be so much easier and clear. – KdgDev Dec 8 '19 at 0:05
  • For anyone who stumbles across this question in the future, please note that enabling this allows an attacker to enumerate sudo configuration by seeing which commands ask for a password (== "user can run command") vs return immediately (== "user cannot run command"). Therefore carefully evaluate whether this configuration is appropriate for your environment before enabling it. – womble Dec 10 '19 at 2:52
  • @womble Example and question added. – KdgDev Dec 10 '19 at 9:13
  • @womble you can already do this using the sudo -l option. I understand your concern, but can't see the distinction between the two. – Thomas N Dec 10 '19 at 23:04
1

According to the sudo FAQ documentation at https://www.sudo.ws/troubleshooting.html you can use !authenticate to disable passwords completely on a per-user or per-host basis, so something like

Defaults  !authenticate

In your /etc/sudoers file should work.

1
  • Checked and working as expected. Thanks for that. – KdgDev Dec 10 '19 at 1:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.