Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #231257 > unrolled thread

Sudo ... use or delete?

Back to article view | Back to linux.debian.user

Contents

  Sudo ... use or delete? Peter Ehlert <peter@sdi-baja.com> - 2021-01-29 16:00 +0100
    Re: Sudo ... use or delete? Greg Wooledge <wooledg@eeg.ccf.org> - 2021-01-29 16:00 +0100
    Re: Sudo ... use or delete? Antonio Russo <aerusso@aerusso.net> - 2021-01-29 16:20 +0100
      Re: Sudo ... use or delete? <tomas@tuxteam.de> - 2021-01-29 16:50 +0100
        Re: Sudo ... use or delete? Eike Lantzsch <zp6cge@gmx.net> - 2021-01-29 18:40 +0100
          Re: Sudo ... use or delete? Roberto C. Sánchez <roberto@debian.org> - 2021-01-29 19:30 +0100
            Re: Sudo ... use or delete? Andrei POPESCU <andreimpopescu@gmail.com> - 2021-01-29 20:50 +0100
    Re: Sudo ... use or delete? Teemu Likonen <tlikonen@iki.fi> - 2021-01-29 17:00 +0100
      Re: Sudo ... use or delete? john doe <johndoe65534@mail.com> - 2021-01-29 17:00 +0100
        Re: Sudo ... use or delete? Antonio Russo <aerusso@aerusso.net> - 2021-01-29 17:00 +0100
          Re: Sudo ... use or delete? john doe <johndoe65534@mail.com> - 2021-01-29 17:30 +0100
      Re: Sudo ... use or delete? Peter Ehlert <peter@sdi-baja.com> - 2021-01-29 18:10 +0100
    Re: Sudo ... use or delete? Andrei POPESCU <andreimpopescu@gmail.com> - 2021-01-29 20:50 +0100
      Re: Sudo ... use or delete? Peter Ehlert <peter@sdi-baja.com> - 2021-01-30 14:30 +0100

#231257 — Sudo ... use or delete?

I don't use sudo

The systems I use and the systems I setup for others never have sudo 
users setup ... unneeded.


Should I delete the sudo package? Would that cause some internal conflicts?
they all have Debian Mate desktops... if that makes any difference, I 
think not.

[toc] | [next] | [standalone]

#231258

On Fri, Jan 29, 2021 at 06:34:34AM -0800, Peter Ehlert wrote:
> I don't use sudo

Then it shouldn't be installed.  Unless it was brought in as an optional
dependency by some Desktop Environment.

> The systems I use and the systems I setup for others never have sudo users
> setup ... unneeded.
> 
> 
> Should I delete the sudo package? Would that cause some internal conflicts?
> they all have Debian Mate desktops... if that makes any difference, I think
> not.

If you try to delete it, apt will tell you what else must be deleted
in order to preserve dependencies.  If you can live with whatever
deletions are required, then go ahead and delete it.

[toc] | [prev] | [next] | [standalone]

#231259

[Multipart message — attachments visible in raw view] — view raw

On 1/29/21 7:34 AM, Peter Ehlert wrote:
> I don't use sudo
> 
> The systems I use and the systems I setup for others never have sudo users setup ... unneeded.
> 
> 
> Should I delete the sudo package? Would that cause some internal conflicts?
> they all have Debian Mate desktops... if that makes any difference, I think not.
> 

As a general rule, if there are no depends or recommends (or suggests) on a
package, you should be safe to remove a package you don't directly call. 
(If not, it's a bug.).

You can easily view this with aptitude:

0. Install aptitude and open it up.
1. Find the package: type /^sudo$ <return>
2. Hit return again to bring up details of the selected package
3. Use the down arrow key to go to "packages which depend on sudo"
4. Hit enter to open up the list of packages.
5. Browse the list to see which packages may be affected.

But, more specifically to your question about sudo, let me argue that, at the
level of paranoia required to be worried about sudo, you should also be
worried about a LOT of other packages.  For instance, if you are worried about
the "opaque" ACLs used in sudoers*, I encourage you to look in
/etc/dbus-1/system.d .  I think there are other places where these kinds of
files live, but I haven't yet gotten around to understanding how to easily
audit these settings.

Similarly, the logic associated with authentication (and message passing)
could easily be more susceptible to buffer overflows than sudo.

But yeah, generically, if you really do not use a piece of software, it's
safer not to have it installed.

Antonio


 

[toc] | [prev] | [next] | [standalone]

#231261

[Multipart message — attachments visible in raw view] — view raw

On Fri, Jan 29, 2021 at 08:12:20AM -0700, Antonio Russo wrote:

[...]

> But, more specifically to your question about sudo, let me argue that, at the
> level of paranoia required to be worried about sudo, you should also be
> worried about a LOT of other packages [...]

I do appreciate and use sudo -- for me it reduces embarrasing
fat-finger mistakes significantly.

But it's not everyone cup of tea, and to be fair, there's one
current privilege escalation vulnerability [1] around. It seems
easily fixable (Debian has a fixed version out, if you do use
sudo, check with [2]).

So if you aren't using <foo>, it's wise to not install <foo>.
Complexity kills :-)

Cheers

[1] https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
[2] https://security-tracker.debian.org/tracker/CVE-2021-3156
 - t

[toc] | [prev] | [next] | [standalone]

#231273

On Friday, 29 January 2021 12:42:19 -03 tomas@tuxteam.de wrote:
> On Fri, Jan 29, 2021 at 08:12:20AM -0700, Antonio Russo wrote:
>
> [...]
>
> > But, more specifically to your question about sudo, let me argue
> > that, at the level of paranoia required to be worried about sudo,
> > you should also be worried about a LOT of other packages [...]
>
> I do appreciate and use sudo -- for me it reduces embarrasing
> fat-finger mistakes significantly.
>
> But it's not everyone cup of tea, and to be fair, there's one
> current privilege escalation vulnerability [1] around. It seems
> easily fixable (Debian has a fixed version out, if you do use
> sudo, check with [2]).
>
> So if you aren't using <foo>, it's wise to not install <foo>.
> Complexity kills :-)
>
> Cheers
>
Hi,
IMHO sudo within itself is not dangerous but the user/admin is. Sudo has
a huge potential to be misconfigured and as a consequence to break down
all and every safety barrier. Sudo is a very good tool - to shoot
oneself into the foot.
Good read: Sudo Mastery by Michael W. Lucas
Cheers to y'all

--
Eike Lantzsch ZP6CGE

[toc] | [prev] | [next] | [standalone]

#231275

On Fri, Jan 29, 2021 at 02:33:49PM -0300, Eike Lantzsch wrote:
> On Friday, 29 January 2021 12:42:19 -03 tomas@tuxteam.de wrote:
> > On Fri, Jan 29, 2021 at 08:12:20AM -0700, Antonio Russo wrote:
> >
> > [...]
> >
> > > But, more specifically to your question about sudo, let me argue
> > > that, at the level of paranoia required to be worried about sudo,
> > > you should also be worried about a LOT of other packages [...]
> >
> > I do appreciate and use sudo -- for me it reduces embarrasing
> > fat-finger mistakes significantly.
> >
> > But it's not everyone cup of tea, and to be fair, there's one
> > current privilege escalation vulnerability [1] around. It seems
> > easily fixable (Debian has a fixed version out, if you do use
> > sudo, check with [2]).
> >
> > So if you aren't using <foo>, it's wise to not install <foo>.
> > Complexity kills :-)
> >
> > Cheers
> >
> Hi,
> IMHO sudo within itself is not dangerous but the user/admin is. Sudo has
> a huge potential to be misconfigured and as a consequence to break down
> all and every safety barrier. Sudo is a very good tool - to shoot
> oneself into the foot.
> Good read: Sudo Mastery by Michael W. Lucas
> Cheers to y'all
> 
The recent vulnerability notwhithstanding, the best guideline out there
for sudo access is: don't give access to anyone via sudo if you would
not simply give them the root password.

THe chief benefit of sudo is that it makes seeing who did what much
easier.  Imagine admin1 uses su to become root and admin2 uses su to
become root.  At that point, it is not possible to tell who did what by
looking at command history.  With sudo, the invoking user would be
logged, which could help with troubleshooting and figuring out who to
ask why some specific action was taken.

Those with access could certainly circumvent it (and easily in nearly
every case), but then it goes back to the guideline of not giving sudo
access to anyone who not be tusted with the root password.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]

#231278

[Multipart message — attachments visible in raw view] — view raw

On Vi, 29 ian 21, 13:23:19, Roberto C. Sánchez wrote:
> 
> THe chief benefit of sudo is that it makes seeing who did what much
> easier.  Imagine admin1 uses su to become root and admin2 uses su to
> become root.  At that point, it is not possible to tell who did what by
> looking at command history.  With sudo, the invoking user would be
> logged, which could help with troubleshooting and figuring out who to
> ask why some specific action was taken.

For me as sole user the benefits are added safety[1] for the ability to 
easily mix root and non-root commands as well as the convenience of 
running select commands without a password (e.g. 'apt update').

It also enables safe editing of system files via 'sudoedit' with my 
preferred editor fully configured, add-ons, etc.[2], as opposed to 
choosing between either running the editor as root (safety/security 
concerns and at least partial duplication of configuration) or using a 
lesser editor (that might be unsafe/vulnerable as well).

[1] arguably added security as well, since previously I might have kept 
a root shell open all the time.
[2] it does mangle filenames though, which may affect file type 
detection

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#231263

[Multipart message — attachments visible in raw view] — view raw

* 2021-01-29 06:34:34-0800, Peter Ehlert wrote:

> I don't use sudo
>
> The systems I use and the systems I setup for others never have sudo 
> users setup ... unneeded.

> Should I delete the sudo package? Would that cause some internal
> conflicts? they all have Debian Mate desktops... if that makes any
> difference, I think not.

You can delete package but some package may depend on it. With "aptitude
why" you can see if some other package needs "sudo" package. Here's an
example:

    $ aptitude why sudo
    i   kde-plasma-desktop Depends plasma-desktop (>= 4:5.10)
    i A plasma-desktop     Depends kde-cli-tools (>= 4:5.14) 
    i A kde-cli-tools      Depends libkf5su5 (>= 4.96.0)     
    i A libkf5su5          Depends sudo                      

-- 
/// Teemu Likonen - .-.. https://www.iki.fi/tlikonen/
// OpenPGP: 4E1055DC84E9DFF613D78557719D69D324539450

[toc] | [prev] | [next] | [standalone]

#231264

On 1/29/2021 4:50 PM, Teemu Likonen wrote:
> * 2021-01-29 06:34:34-0800, Peter Ehlert wrote:
>
>> I don't use sudo
>>
>> The systems I use and the systems I setup for others never have sudo
>> users setup ... unneeded.
>
>> Should I delete the sudo package? Would that cause some internal
>> conflicts? they all have Debian Mate desktops... if that makes any
>> difference, I think not.
>
> You can delete package but some package may depend on it.  >

In the case of sudo, you could deny the use of sudo by removing all
users from the sudoers file or by denying sudo access  explicitly in the
sudoers file.

--
John Doe

[toc] | [prev] | [next] | [standalone]

#231265

[Multipart message — attachments visible in raw view] — view raw

On 1/29/21 8:54 AM, john doe wrote:
> In the case of sudo, you could deny the use of sudo by removing all
> users from the sudoers file or by denying sudo access  explicitly in the
> sudoers file.
> 
> -- 
> John Doe
> 

As I understand it, this would not have protected against the recent local
privilege escalation bug in sudo.  If you're interested in improving
security, the desire is to reduce the total amount of privileged code on
the machine.

(Though removing people from sudoers obviously helps.)

Antonio

[toc] | [prev] | [next] | [standalone]

#231266

On 1/29/2021 4:57 PM, Antonio Russo wrote:
>
>
> On 1/29/21 8:54 AM, john doe wrote:
>> In the case of sudo, you could deny the use of sudo by removing all
>> users from the sudoers file or by denying sudo access  explicitly in the
>> sudoers file.
>>

Also, removing all users from the sudo group.

>> --
>> John Doe
>>
>
> As I understand it, this would not have protected against the recent local
> privilege escalation bug in sudo.  If you're interested in improving
> security, the desire is to reduce the total amount of privileged code on
> the machine.
>

The bug you are referring to is already corrected (1).

1)  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156

--
John Doe

[toc] | [prev] | [next] | [standalone]

#231270

On 1/29/21 7:50 AM, Teemu Likonen wrote:
> * 2021-01-29 06:34:34-0800, Peter Ehlert wrote:
>
>> I don't use sudo
>>
>> The systems I use and the systems I setup for others never have sudo
>> users setup ... unneeded.
>> Should I delete the sudo package? Would that cause some internal
>> conflicts? they all have Debian Mate desktops... if that makes any
>> difference, I think not.
> You can delete package but some package may depend on it. With "aptitude
> why" you can see if some other package needs "sudo" package. Here's an
> example:
>
>      $ aptitude why sudo
>      i   kde-plasma-desktop Depends plasma-desktop (>= 4:5.10)
>      i A plasma-desktop     Depends kde-cli-tools (>= 4:5.14)
>      i A kde-cli-tools      Depends libkf5su5 (>= 4.96.0)
>      i A libkf5su5          Depends sudo
$  aptitude why sudo
i   inxi Recommends sudo

!!! thanks

[toc] | [prev] | [next] | [standalone]

#231279

[Multipart message — attachments visible in raw view] — view raw

On Vi, 29 ian 21, 06:34:34, Peter Ehlert wrote:
> I don't use sudo
> 
> The systems I use and the systems I setup for others never have sudo users
> setup ... unneeded.
> 
> 
> Should I delete the sudo package? Would that cause some internal conflicts?
> they all have Debian Mate desktops... if that makes any difference, I think
> not.
 
Why are you considering removing it? 

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#231288

On 1/29/21 11:47 AM, Andrei POPESCU wrote:
> On Vi, 29 ian 21, 06:34:34, Peter Ehlert wrote:
>> I don't use sudo
>>
>> The systems I use and the systems I setup for others never have sudo users
>> setup ... unneeded.
>>
>>
>> Should I delete the sudo package? Would that cause some internal conflicts?
>> they all have Debian Mate desktops... if that makes any difference, I think
>> not.
>   
> Why are you considering removing it?
mainly I don't like cruft.
partly paranoia after reading about the bugs

*actually my "consumer" (a friend with a business I set up 
workstations/systems for) asked about it.
given that neither of us ever create a sudoers file it's really a non issue.
>
> Kind regards,
> Andrei

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web