Re: [OT] sudo: restrict to physical console only?

From	<tomas@tuxteam.de>
Newsgroups	linux.debian.user
Subject	Re: [OT] sudo: restrict to physical console only?
Date	2020-08-04 19:00 +0200
Message-ID	<AA8sb-2nO-11@gated-at.bofh.it> (permalink)
References	(1 earlier) <AA0XE-6al-13@gated-at.bofh.it> <AA1K1-6Ic-7@gated-at.bofh.it> <AA3Ca-7RJ-13@gated-at.bofh.it> <AA4Rz-lt-13@gated-at.bofh.it> <AA733-1DZ-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Tue, Aug 04, 2020 at 10:24:16AM -0500, John Hasler wrote:
> tomas writes:
> > OTOH practice has shown: if you're doing sudo, you will have forgotten
> > your root password anyway when you need it (I have, it's some horrible
> > "pwgen -n 16" or something), and it' back to...
> 
> It should be written down somewhere secure.  Depending on your threat
> model this can be on a note taped to the inside of the machine, in your
> safe, or even in the notebook where you keep all your other passwords.

It's in a file on the encrypted harddisk. Now you may ask... ;-)

Yes, of course. It's in a backup, on an (also) encrypted medium. But all
those possibilities (the ones you mention no less) mean that "init=/bin/sh"
or rescue medium are less work (I haven't a safe).

This is the point I was trying to make: a password you don't use often
isn't that useful if there are perfectly viable alternatives. Thus, /if/
you are using sudo, root password loses much of its glamour. This is
something I learnt slowly.

Cheers
 - t

Thread

[OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 09:50 +0200
  Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 11:00 +0200
    Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 11:50 +0200
      Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 12:20 +0200
      Re: [OT] sudo: restrict to physical console only? Greg Wooledge <wooledg@eeg.ccf.org> - 2020-08-04 13:50 +0200
        Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 14:30 +0200
        Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 15:10 +0200
          Re: [OT] sudo: restrict to physical console only? John Hasler <jhasler@newsguy.com> - 2020-08-04 17:30 +0200
            Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 19:00 +0200
      Re: [OT] sudo: restrict to physical console only? Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-04 16:00 +0200
        Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 16:10 +0200
          Re: [OT] sudo: restrict to physical console only? Michael Stone <mstone@debian.org> - 2020-08-04 17:10 +0200
  Re: [OT] sudo: restrict to physical console only? Keith bainbridge <keithrbau@gmail.com> - 2020-08-04 11:00 +0200
    Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 11:10 +0200
  Re: [OT] sudo: restrict to physical console only? Andy Smith <andy@strugglers.net> - 2020-08-04 18:50 +0200
  Re: [OT] sudo: restrict to physical console only? Reco <recoverym4n@enotuniq.net> - 2020-08-04 20:50 +0200
    Re: [OT] sudo: restrict to physical console only? Dan Ritter <dsr@randomstring.org> - 2020-08-04 22:30 +0200
      Re: [OT] sudo: restrict to physical console only? Reco <recoverym4n@enotuniq.net> - 2020-08-05 08:40 +0200

csiph-web