Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #1819 > unrolled thread

Looking at su versus sudo

Back to article view | Back to comp.misc

Contents

  Looking at su versus sudo RS Wood  <rsw@therandymon.com> - 2014-03-20 13:18 +0000
    Re: Looking at su versus sudo Alan Ralph <alan.ralph@gmail.com> - 2014-03-20 15:24 +0000
      Re: Looking at su versus sudo RS Wood <rsw@therandymon.com> - 2014-03-20 15:45 +0000
    Re: Looking at su versus sudo Alvaro Martínez <alvaro.gmj@gmail.com> - 2014-03-20 23:11 -0300
      Re: Looking at su versus sudo RS Wood <rsw@therandymon.com> - 2014-03-21 09:35 +0000
      Re: Looking at su versus sudo Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-03-21 18:07 +0000
        Re: Looking at su versus sudo Alvaro Martínez <alvaro.gmj@gmail.com> - 2014-03-22 00:23 -0300
    Re: Looking at su versus sudo Tim Watts <tw_usenet@dionic.net> - 2014-03-22 10:07 +0000
      Re: Looking at su versus sudo Dag-Erling Smørgrav <des@des.no> - 2014-03-22 16:32 +0100
        Re: Looking at su versus sudo Tim Watts <tw_usenet@dionic.net> - 2014-03-22 19:18 +0000
          Re: Looking at su versus sudo Marko Rauhamaa <marko@pacujo.net> - 2014-03-23 12:34 +0200
            Re: Looking at su versus sudo Bob Eager <news0002@eager.cx> - 2014-03-23 11:34 +0000
          Re: Looking at su versus sudo Dag-Erling Smørgrav <des@des.no> - 2014-03-23 13:03 +0100

#1819 — Looking at su versus sudo

From the «sudo make me a sandwich» department:
Title: Difference Between su Vs sudo and How to Configure sudo in Linux
Author: Tecmint
Date: Wed, 19 Mar 2014 13:25:07 -0400
Link: http://www.linux.com/learn/tutorials/767014-difference-between-su-vs-sudo-and-how-to-configure-sudo-in-linux/

Linux System is much secured than any of its counterpart. One of the way to
implement security in Linux is the user management policy and user
permission. normal users are not authorized to perform any system operations.
If a normal user needs to perform any system wide changes he needs...

[toc] | [next] | [standalone]

#1822

On 20/03/2014 13:18, RS Wood wrote:
>  From the «sudo make me a sandwich» department:
> Title: Difference Between su Vs sudo and How to Configure sudo in Linux
> Author: Tecmint
> Date: Wed, 19 Mar 2014 13:25:07 -0400
> Link: http://www.linux.com/learn/tutorials/767014-difference-between-su-vs-sudo-and-how-to-configure-sudo-in-linux/
>
> Linux System is much secured than any of its counterpart. One of the way to
> implement security in Linux is the user management policy and user
> permission. normal users are not authorized to perform any system operations.
> If a normal user needs to perform any system wide changes he needs...

Not sure why you don't link directly to the actual article at 
http://www.tecmint.com/su-vs-sudo-and-how-to-configure-sudo-in-linux/ - 
the one you posted is just a summary.

Alan

[toc] | [prev] | [next] | [standalone]

#1823

On 3/20/14 3:24 PM, Alan Ralph wrote:
>
>Not sure why you don't link directly to the actual article at 
>http://www.tecmint.com/su-vs-sudo-and-how-to-configure-sudo-in-linux/ - 
>the one you posted is just a summary.
>
>Alan
>

I figured some other kind soul would quickly correct the error in my ways
 and provide the real link.  Thanks for that.

Also: I post this stuff from work and don't have time to vet every link and
 article without my boss showing me the door. Sometimes I goof up.

[toc] | [prev] | [next] | [standalone]

#1840

RS Wood wrote:

> Linux System is much secured than any of its counterpart. One of the way
> to implement security in Linux is the user management policy and user
> permission. normal users are not authorized to perform any system
> operations. If a normal user needs to perform any system wide changes he
> needs...

I believe we should stop promoting FUD like this. The FOSS communities have 
been damaged in the past by FUD from companies like Microsoft, but we have 
our own half-truths that we are used (and like) to say/write.

Every modern OS has privilege separation between users, so starting an 
article implying that user management is a reason why linux "is much secured 
than any of its counterpart" [sic] is just silly.

Besides, while this is obviously aimed at Windows, I'd say that in general 
the first sentence of the summary is not even correct: it is debatable 
whether the default security of a given Linux distribution is on par with 
OpenBSD or systems like AIX


Cheers

[toc] | [prev] | [next] | [standalone]

#1845

On 2014-03-21, Alvaro Martínez <alvaro.gmj@gmail.com> wrote:
> RS Wood wrote:
>
>> Linux System is much secured than any of its counterpart. One of the way
>> to implement security in Linux is the user management policy and user
>> permission. normal users are not authorized to perform any system
>> operations. If a normal user needs to perform any system wide changes he
>> needs...
>
> I believe we should stop promoting FUD like this. The FOSS communities have 

Maybe the lesson here is to stop posting articles from Linux.com.  I have 140+
news sources in my newsreader, including a lot of developers' blogs.  I thought
Linux.com might be good for more general interest stuff, but in fact the
content is not that great.

[toc] | [prev] | [next] | [standalone]

#1865

In message <lgg75d$39d$1@dont-email.me> 
  Alvaro Martínez <alvaro.gmj@gmail.com> wrote:
> RS Wood wrote:

>> Linux System is much secured than any of its counterpart. One of the way
>> to implement security in Linux is the user management policy and user
>> permission. normal users are not authorized to perform any system
>> operations. If a normal user needs to perform any system wide changes he
>> needs...

> I believe we should stop promoting FUD like this. The FOSS communities have 
> been damaged in the past by FUD from companies like Microsoft, but we have 
> our own half-truths that we are used (and like) to say/write.

> Every modern OS has privilege separation between users, so starting an 
> article implying that user management is a reason why linux "is much secured 
> than any of its counterpart" [sic] is just silly.

Setup a new computer with Windows or OS X. You are an admin user with
the ability to escalate privs to 'root'. Your system is vulnerable to
many attacks that it would not be if you used a non-admin user.

Setup a Windows machine with a non-admin user and many things do not
work at all, especially many games.

Setup a OS X machine with a non-admin user and everything pretty much
works as you would expect, with some minor annoyances.

> Besides, while this is obviously aimed at Windows, I'd say that in general 
> the first sentence of the summary is not even correct: it is debatable 
> whether the default security of a given Linux distribution is on par with 
> OpenBSD or systems like AIX

I wouldn't think so, but out-of-the-box it is still a decade or two in
front of Windows.

-- 
When the stars threw down their spears And watered heaven with their
tears, Did He smile his work to see? Did He who made the Lamb make thee?

[toc] | [prev] | [next] | [standalone]

#1878

Lewis wrote:

> Setup a new computer with Windows or OS X. You are an admin user with
> the ability to escalate privs to 'root'. Your system is vulnerable to
> many attacks that it would not be if you used a non-admin user.
> 
> Setup a Windows machine with a non-admin user and many things do not
> work at all, especially many games.

Well, in reality your second sentence applies to most Linux desktop 
installs.

I was not referring to the out of the box experience, although I admit I 
mentioned it. The truth is that even as an admin user you can use a paranoid 
mode of the UAC which gives a fair amount of security without bothering you 
a lot during daily usage. At least that is my experience with Windows 7. I 
find that to be a nice security model for a desktop system: you have 
permission to do whatever you want, but nothing gets executed unless you 
allow it.

It's not my intention to praise Windows, I don't really like it that much. 
But I've been reading the "secure by default" argument for around 15 years 
now, and things are not as they used to be.


Regards

[toc] | [prev] | [next] | [standalone]

#1884

On 20/03/14 13:18, RS Wood wrote:
>  From the «sudo make me a sandwich» department:
> Title: Difference Between su Vs sudo and How to Configure sudo in Linux
> Author: Tecmint
> Date: Wed, 19 Mar 2014 13:25:07 -0400
> Link: http://www.linux.com/learn/tutorials/767014-difference-between-su-vs-sudo-and-how-to-configure-sudo-in-linux/
>
> Linux System is much secured than any of its counterpart. One of the way to
> implement security in Linux is the user management policy and user
> permission. normal users are not authorized to perform any system operations.
> If a normal user needs to perform any system wide changes he needs...
>

sudo is both flexible and weak.

Flexible because you can allow "fred" to run "/usr/bin/specific-script" 
as "some-other-user".

Weak because "sudo su -" requires the same password as the user does to 
log in, meaning that if that user's password is stolen, so is their root 
access.

I would rather re-state the thread as:

ksu vs su vs sudo

ksu (aka kerberos-su) is a much better solution to the general problem 
of obtaining root shells. You can (and should) use a different password 
for your root "principle" as kerberos calls your (effectively) "username".

/root/.k5login allows fine grained control over who's root principle(s) 
are allowed to ksu on any particular machine.

"su" of course should almost never be used outside of a small or special 
case environment.

[toc] | [prev] | [next] | [standalone]

#1896

Tim Watts <tw_usenet@dionic.net> writes:
> [...] "sudo su -" requires the same password as the user does to log
> in, meaning that if that user's password is stolen, so is their root
> access.

Not quite; sudo uses PAM, so you can configure it to require, say, a
one-time password in addition to the user's regular password.

> You can (and should) use a different password for your root
> "principle" [...]

s/principle/principal/

DES
-- 
Dag-Erling Smørgrav - des@des.no

[toc] | [prev] | [next] | [standalone]

#1902

On 22/03/14 15:32, Dag-Erling Smørgrav wrote:
> Tim Watts <tw_usenet@dionic.net> writes:
>> [...] "sudo su -" requires the same password as the user does to log
>> in, meaning that if that user's password is stolen, so is their root
>> access.
>
> Not quite; sudo uses PAM, so you can configure it to require, say, a
> one-time password in addition to the user's regular password.
>
>> You can (and should) use a different password for your root
>> "principle" [...]
>
> s/principle/principal/
>

That may be me "correcting" to Queen's English from an americanism. But 
I'm not totally sure.

Principal = Head/Director - usually of a school or college.

Principle = First/foremost


What does "principle/principal" in terms of kerberos *actually* mean? 
"Foremost identity" in which case it should be "principle" unless 
US-English is different.

"Principal" is usually applied to humans - so that doesn't seem to fit. 
Unless it's used in the adjective?

Just curious...

[toc] | [prev] | [next] | [standalone]

#1908

Tim Watts <tw_usenet@dionic.net>:

> That may be me "correcting" to Queen's English from an americanism. But
> I'm not totally sure.
>
> Principal = Head/Director - usually of a school or college.

<URL: http://www.merriam-webster.com/dictionary/principal>:

   [...]

   1 : a person who has controlling authority or is in a leading
       position: as

       a : a chief or head man or woman
       b : the chief executive officer of an educational institution
       c : one who engages another to act as an agent subject to general
           control and instruction; specifically :  the person from whom
           an agent's authority derives
       d : the chief or an actual participant in a crime
       e : the person primarily or ultimately liable on a legal
           obligationf : a leading performer : star

   2 : a matter or thing of primary importance: as

       a (1) : a capital sum earning interest, due as a debt, or used as
           a fund (2) : the corpus of an estate, portion, devise, or
           bequest
       b : the construction that gives shape and strength to a roof and
           is usually one of several trusses; broadly : the most
           important member of a piece of framing


Marko

[toc] | [prev] | [next] | [standalone]

#1909

On Sun, 23 Mar 2014 12:34:42 +0200, Marko Rauhamaa wrote:

> Tim Watts <tw_usenet@dionic.net>:
> 
>> That may be me "correcting" to Queen's English from an americanism. But
>> I'm not totally sure.
>>
>> Principal = Head/Director - usually of a school or college.
> 
> <URL: http://www.merriam-webster.com/dictionary/principal>:
> 
>    [...]
> 
>    1 : a person who has controlling authority or is in a leading
>        position: as
> 
>        a : a chief or head man or woman b : the chief executive officer
>        of an educational institution c : one who engages another to act
>        as an agent subject to general
>            control and instruction; specifically :  the person from whom
>            an agent's authority derives
>        d : the chief or an actual participant in a crime e : the person
>        primarily or ultimately liable on a legal
>            obligationf : a leading performer : star
> 
>    2 : a matter or thing of primary importance: as
> 
>        a (1) : a capital sum earning interest, due as a debt, or used as
>            a fund (2) : the corpus of an estate, portion, devise, or
>            bequest
>        b : the construction that gives shape and strength to a roof and
>            is usually one of several trusses; broadly : the most
>            important member of a piece of framing

Indeed, and neither of those really fits the area under discussion (OK, 
the second one is nearer). But the definition of 'principle' from the 
same source hits it on the head:

Full Definition of PRINCIPLE
1
a :  a comprehensive and fundamental law, doctrine, or assumption 
b (1) :  a rule or code of conduct (2) :  habitual devotion to right 
principles <a man of principle> 
c :  the laws or facts of nature underlying the working of an artificial 
device 
2
:  a primary source :  origin 
3
a :  an underlying faculty or endowment <such principles of human nature 
as greed and curiosity> 
b :  an ingredient (as a chemical) that exhibits or imparts a 
characteristic quality 
4
capitalized Christian Science :  a divine principle :  god 
— in principle 
:  with respect to fundamentals <prepared to accept the proposition in 
principle>



-- 
Use the BIG mirror service in the UK: http://www.mirrorservice.org
My posts (including this one) are my copyright and if @diy_forums on
Twitter wish to tweet them they can pay me £30 a post
*lightning surge protection* - a w_tom conductor

[toc] | [prev] | [next] | [standalone]

#1910

Tim Watts <tw_usenet@dionic.net> writes:
> Dag-Erling Smørgrav <des@des.no> writes:
> > Tim Watts <tw_usenet@dionic.net> writes:
> > > You can (and should) use a different password for your root
> > > "principle" [...]
> > s/principle/principal/
> That may be me "correcting" to Queen's English from an
> americanism. But I'm not totally sure.

No, principle and principal are entirely different words in both UK and
US English.  The correct word in this context is principal.

> Principal = Head/Director - usually of a school or college.

One of many meanings of that word, yes.

> Principle = First/foremost

No, that's also "principal".  A "principle" is a rule, tenet, precept,
or assumption.

> What does "principle/principal" in terms of kerberos *actually* mean?

A principal in Kerberos is an identity to which a ticket can be granted.
I say identity and not entity because the same entity can have multiple
separate identities for separate purposes, and each will be a separate
principal.

DES
-- 
Dag-Erling Smørgrav - des@des.no

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web