Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #1884

Re: Looking at su versus sudo

Show all headers | View raw

On 20/03/14 13:18, RS Wood wrote:
>  From the «sudo make me a sandwich» department:
> Title: Difference Between su Vs sudo and How to Configure sudo in Linux
> Author: Tecmint
> Date: Wed, 19 Mar 2014 13:25:07 -0400
> Link: http://www.linux.com/learn/tutorials/767014-difference-between-su-vs-sudo-and-how-to-configure-sudo-in-linux/
>
> Linux System is much secured than any of its counterpart. One of the way to
> implement security in Linux is the user management policy and user
> permission. normal users are not authorized to perform any system operations.
> If a normal user needs to perform any system wide changes he needs...
>

sudo is both flexible and weak.

Flexible because you can allow "fred" to run "/usr/bin/specific-script" 
as "some-other-user".

Weak because "sudo su -" requires the same password as the user does to 
log in, meaning that if that user's password is stolen, so is their root 
access.

I would rather re-state the thread as:

ksu vs su vs sudo

ksu (aka kerberos-su) is a much better solution to the general problem 
of obtaining root shells. You can (and should) use a different password 
for your root "principle" as kerberos calls your (effectively) "username".

/root/.k5login allows fine grained control over who's root principle(s) 
are allowed to ksu on any particular machine.

"su" of course should almost never be used outside of a small or special 
case environment.

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Looking at su versus sudo RS Wood  <rsw@therandymon.com> - 2014-03-20 13:18 +0000
  Re: Looking at su versus sudo Alan Ralph <alan.ralph@gmail.com> - 2014-03-20 15:24 +0000
    Re: Looking at su versus sudo RS Wood <rsw@therandymon.com> - 2014-03-20 15:45 +0000
  Re: Looking at su versus sudo Alvaro Martínez <alvaro.gmj@gmail.com> - 2014-03-20 23:11 -0300
    Re: Looking at su versus sudo RS Wood <rsw@therandymon.com> - 2014-03-21 09:35 +0000
    Re: Looking at su versus sudo Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-03-21 18:07 +0000
      Re: Looking at su versus sudo Alvaro Martínez <alvaro.gmj@gmail.com> - 2014-03-22 00:23 -0300
  Re: Looking at su versus sudo Tim Watts <tw_usenet@dionic.net> - 2014-03-22 10:07 +0000
    Re: Looking at su versus sudo Dag-Erling Smørgrav <des@des.no> - 2014-03-22 16:32 +0100
      Re: Looking at su versus sudo Tim Watts <tw_usenet@dionic.net> - 2014-03-22 19:18 +0000
        Re: Looking at su versus sudo Marko Rauhamaa <marko@pacujo.net> - 2014-03-23 12:34 +0200
          Re: Looking at su versus sudo Bob Eager <news0002@eager.cx> - 2014-03-23 11:34 +0000
        Re: Looking at su versus sudo Dag-Erling Smørgrav <des@des.no> - 2014-03-23 13:03 +0100

csiph-web