Re: Looking at su versus sudo

Path	csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news2.arglkargh.de!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From	Tim Watts <tw_usenet@dionic.net>
Newsgroups	comp.misc
Subject	Re: Looking at su versus sudo
Date	Sat, 22 Mar 2014 10:07:36 +0000
Lines	35
Message-ID	<80400b-huq.ln1@squidward.local.dionic.net> (permalink)
References	<lgepqt$839$1@solani.org>
Mime-Version	1.0
Content-Type	text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding	8bit
X-Trace	individual.net zQl0tMQ23HoZWrFR/TBLBAooWgGEcvRRgZimvJe0Sk1ViF6nA9
X-Orig-Path	squidward.local.dionic.net!not-for-mail
Cancel-Lock	sha1:4QhdvH+7UzdACvSPZ3kQuqfA42E=
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
In-Reply-To	<lgepqt$839$1@solani.org>
Xref	csiph.com comp.misc:1884

Show key headers only | View raw

On 20/03/14 13:18, RS Wood wrote:
>  From the «sudo make me a sandwich» department:
> Title: Difference Between su Vs sudo and How to Configure sudo in Linux
> Author: Tecmint
> Date: Wed, 19 Mar 2014 13:25:07 -0400
> Link: http://www.linux.com/learn/tutorials/767014-difference-between-su-vs-sudo-and-how-to-configure-sudo-in-linux/
>
> Linux System is much secured than any of its counterpart. One of the way to
> implement security in Linux is the user management policy and user
> permission. normal users are not authorized to perform any system operations.
> If a normal user needs to perform any system wide changes he needs...
>

sudo is both flexible and weak.

Flexible because you can allow "fred" to run "/usr/bin/specific-script" 
as "some-other-user".

Weak because "sudo su -" requires the same password as the user does to 
log in, meaning that if that user's password is stolen, so is their root 
access.

I would rather re-state the thread as:

ksu vs su vs sudo

ksu (aka kerberos-su) is a much better solution to the general problem 
of obtaining root shells. You can (and should) use a different password 
for your root "principle" as kerberos calls your (effectively) "username".

/root/.k5login allows fine grained control over who's root principle(s) 
are allowed to ksu on any particular machine.

"su" of course should almost never be used outside of a small or special 
case environment.

Thread

Looking at su versus sudo RS Wood  <rsw@therandymon.com> - 2014-03-20 13:18 +0000
  Re: Looking at su versus sudo Alan Ralph <alan.ralph@gmail.com> - 2014-03-20 15:24 +0000
    Re: Looking at su versus sudo RS Wood <rsw@therandymon.com> - 2014-03-20 15:45 +0000
  Re: Looking at su versus sudo Alvaro Martínez <alvaro.gmj@gmail.com> - 2014-03-20 23:11 -0300
    Re: Looking at su versus sudo RS Wood <rsw@therandymon.com> - 2014-03-21 09:35 +0000
    Re: Looking at su versus sudo Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-03-21 18:07 +0000
      Re: Looking at su versus sudo Alvaro Martínez <alvaro.gmj@gmail.com> - 2014-03-22 00:23 -0300
  Re: Looking at su versus sudo Tim Watts <tw_usenet@dionic.net> - 2014-03-22 10:07 +0000
    Re: Looking at su versus sudo Dag-Erling Smørgrav <des@des.no> - 2014-03-22 16:32 +0100
      Re: Looking at su versus sudo Tim Watts <tw_usenet@dionic.net> - 2014-03-22 19:18 +0000
        Re: Looking at su versus sudo Marko Rauhamaa <marko@pacujo.net> - 2014-03-23 12:34 +0200
          Re: Looking at su versus sudo Bob Eager <news0002@eager.cx> - 2014-03-23 11:34 +0000
        Re: Looking at su versus sudo Dag-Erling Smørgrav <des@des.no> - 2014-03-23 13:03 +0100

csiph-web