Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #258161 > unrolled thread

sudoers question

Back to article view | Back to linux.debian.user

Contents

  sudoers question "Tom Reed" <tom@dkinbox.com> - 2023-05-12 13:40 +0200
    Re: sudoers question Greg Wooledge <greg@wooledge.org> - 2023-05-12 14:00 +0200
      Re: sudoers question "Tom Reed" <tom@dkinbox.com> - 2023-05-12 14:10 +0200
        Re: sudoers question Nicolas George <george@nsup.org> - 2023-05-12 14:10 +0200
          Re: sudoers question "Tom Reed" <tom@dkinbox.com> - 2023-05-12 14:20 +0200
            Re: sudoers question Nicolas George <george@nsup.org> - 2023-05-12 14:30 +0200
            Re: sudoers question Greg Wooledge <greg@wooledge.org> - 2023-05-12 14:30 +0200
            Re: sudoers question Michel Verdier <mv524@free.fr> - 2023-05-12 14:40 +0200
            Re: sudoers question Curt <curty@free.fr> - 2023-05-12 18:20 +0200
        Re: sudoers question Hanno 'Rince' Wagner <wagner@rince.de> - 2023-05-12 14:20 +0200
        Re: sudoers question Greg Wooledge <greg@wooledge.org> - 2023-05-12 14:20 +0200
          Re: sudoers question Nicolas George <george@nsup.org> - 2023-05-12 14:30 +0200
            Re: sudoers question Nicolas George <george@nsup.org> - 2023-05-12 14:30 +0200
            Re: sudoers question Stefan Monnier <monnier@iro.umontreal.ca> - 2023-05-12 14:30 +0200
              Re: sudoers question Byung-Hee HWANG (황병희)   <soyeomul@doraji.xyz> - 2023-05-12 16:10 +0200
                Re: sudoers question Max Nikulin <manikulin@gmail.com> - 2023-05-12 16:40 +0200
              Re: sudoers question Michel Verdier <mv524@free.fr> - 2023-05-12 17:50 +0200
                Re: sudoers question <tomas@tuxteam.de> - 2023-05-12 17:50 +0200
                  Re: sudoers question Michel Verdier <mv524@free.fr> - 2023-05-13 10:40 +0200
                    Re: sudoers question <tomas@tuxteam.de> - 2023-05-13 12:30 +0200
                      Re: sudoers question debian-user@howorth.org.uk - 2023-05-13 14:20 +0200
                      Re: sudoers question Dan Ritter <dsr@randomstring.org> - 2023-05-13 16:20 +0200
              Re: sudoers question Lee <ler762@gmail.com> - 2023-05-13 00:10 +0200
                Re: sudoers question Lee <ler762@gmail.com> - 2023-05-13 08:00 +0200
                  Re: sudoers question Kushal Kumaran <kushal@locationd.net> - 2023-05-13 18:10 +0200
                    Re: sudoers question <tomas@tuxteam.de> - 2023-05-13 18:50 +0200
                Re: sudoers question Nicolas George <george@nsup.org> - 2023-05-13 12:40 +0200
    Re: sudoers question "Andrew M.A. Cater" <amacater@einval.com> - 2023-05-12 14:30 +0200

Page 1 of 2  [1] 2  Next page →

#258161 — sudoers question

Hello

what's the right way to add an user to run sudo without password?
I have to edit /etc/sudoers by manual. But I don't think it's a grace way.

Thanks.
Tom

[toc] | [next] | [standalone]

#258164

On Fri, May 12, 2023 at 07:27:25PM +0800, Tom Reed wrote:
> what's the right way to add an user to run sudo without password?
> I have to edit /etc/sudoers by manual. But I don't think it's a grace way.

*Without password*??  Yes, that will require a manual edit.

There is no "graceful way" to grant that power to users, because that's
an obscene amount of power without a check.  Usually one would only
do this for a non-interactive account (some sort of service/daemon
account that does an automated backup, or something of that nature).

[toc] | [prev] | [next] | [standalone]

#258165

> On Fri, May 12, 2023 at 07:27:25PM +0800, Tom Reed wrote:
>> what's the right way to add an user to run sudo without password?
>> I have to edit /etc/sudoers by manual. But I don't think it's a grace
>> way.
>
> *Without password*??  Yes, that will require a manual edit.
>
> There is no "graceful way" to grant that power to users, because that's
> an obscene amount of power without a check.  Usually one would only
> do this for a non-interactive account (some sort of service/daemon
> account that does an automated backup, or something of that nature).
>
>

Hello Greg,

for a common account, such as tom, a nopasswd sudo also makes sense?
otherwise every time i have to input password for sudo.

Thanks

[toc] | [prev] | [next] | [standalone]

#258166

Tom Reed (12023-05-12):
> otherwise every time i have to input password for sudo.

Yes, that is the point.

If “every time” is a lot for you, maybe your use habits need to be
reviewed.

Regards,

-- 
   Nicolas George

[toc] | [prev] | [next] | [standalone]

#258169

> Tom Reed (12023-05-12):
>> otherwise every time i have to input password for sudo.
>
> Yes, that is the point.
>
> If “every time” is a lot for you, maybe your use habits need to be
> reviewed.
>

that's normal. for example, I have to check every kind of logs (mail,
webserver, systems etc). They require sudo then.

regards

[toc] | [prev] | [next] | [standalone]

#258171

Tom Reed (12023-05-12):
> that's normal. for example, I have to check every kind of logs (mail,
> webserver, systems etc). They require sudo then.

No they do not. You just have to adjust files permissions if they are
not correct by default, which they usually are.

My crystal ball tells me you neglected to add yourself to the adm group.

Regards,

-- 
  Nicolas George

[toc] | [prev] | [next] | [standalone]

#258173

On Fri, May 12, 2023 at 08:13:31PM +0800, Tom Reed wrote:
> that's normal. for example, I have to check every kind of logs (mail,
> webserver, systems etc). They require sudo then.

If you check the logs all at once, as part of a daily routine, then you
only have to type the password one time, at the beginning of your
log-checking session.  The second, third, fourth, etc. sudo commands
will all use the cached credentials that you supplied the first time.

You might also consider adding "tom" to the "adm" group, so that "tom"
can read most of the system log files without needing sudo.

[toc] | [prev] | [next] | [standalone]

#258176

Le 12 mai 2023 Tom Reed a écrit :

> that's normal. for example, I have to check every kind of logs (mail,
> webserver, systems etc). They require sudo then.

Logs are with adm gid, so just add your user to the group adm to be able
to consult logs.

[toc] | [prev] | [next] | [standalone]

#258184

On 2023-05-12, Tom Reed <tom@dkinbox.com> wrote:
>> Tom Reed (12023-05-12):
>>> otherwise every time i have to input password for sudo.
>>
>> Yes, that is the point.
>>
>> If “every time” is a lot for you, maybe your use habits need to be
>> reviewed.
>>
>
> that's normal. for example, I have to check every kind of logs (mail,
> webserver, systems etc). They require sudo then.
>
> regards
>
>

Certain people here who don't use sudo on single human user systems used
to say they'd keep a root terminal open at all times (with some kind of
cautionary reddish prompt to remind them of the inherent power) for
convenient switching to administrative work.

That's if you have no cat or child or other malicious creature in the
vicinity, of course.

[toc] | [prev] | [next] | [standalone]

#258167

Hi Tom,

On Fri, 12 May 2023, Tom Reed wrote:

> for a common account, such as tom, a nopasswd sudo also makes sense?
> otherwise every time i have to input password for sudo.

that is what one expects you to do if you need to use sudo.
The reason is that sudo grants you high privileges on your computer
system, including damaging your filesystems or all the data you have
stored there. Not only yours but from everyone who is using this
computer. Therefore, you need to have precautions against accidentally
doing things you may not want to do.
the second reason is that sudo wants to make sure that _only_ you are
sitting on that computer right now and _you_ are typing these
commands. since only your should know your password, your legitimacy
will be checked by asking for your password.
So, there is good sense to have this request.

of course, there are possibilities to change this behaviour. But
either you know very well what you are doing in every situation or you
should be careful.

best regards, Hanno Wagner
-- 
|  Hanno Wagner  | Member of the HTML Writers Guild  | Rince@IRC      |
| Eine gewerbliche Nutzung meiner Email-Adressen ist nicht gestattet! |
| 74 a3 53 cc 0b 19 - we did it!          |    Generation @           |
#"Ich bin ein .signature Virus. Mach' mit und kopiere mich in Deine .signature."

[toc] | [prev] | [next] | [standalone]

#258168

On Fri, May 12, 2023 at 08:03:00PM +0800, Tom Reed wrote:
> for a common account, such as tom, a nopasswd sudo also makes sense?
> otherwise every time i have to input password for sudo.

Within a given terminal session, you only have to enter your passwors
once.  This will allow passwordless sudo on that terminal for the next
15 minutes (by default).

If you're launching a terminal, running a single sudo command, closing
the terminal, opening a new terminal, etc. ... then perhaps you should
stop doing that.  Leave your terminal open, at least until you're done
with whatever administrative task you're doing.

[toc] | [prev] | [next] | [standalone]

#258170

Greg Wooledge (12023-05-12):
> If you're launching a terminal, running a single sudo command, closing
> the terminal, opening a new terminal, etc. ... then perhaps you should
> stop doing that.  Leave your terminal open, at least until you're done
> with whatever administrative task you're doing.

Or configure sudo to disable tty_tickets, so that the timeout (10
minutes by default IIRC) applies to all terminals.

Regards,

-- 
  Nicolas George

[toc] | [prev] | [next] | [standalone]

#258172

Stefan Monnier (12023-05-12):
> `sudo bash` anyone?

Why not “sudo start-gnome” or logging as root on the display manager
while you are at it?

Regards,

-- 
  Nicolas George

[toc] | [prev] | [next] | [standalone]

#258174

> Or configure sudo to disable tty_tickets, so that the timeout (10
> minutes by default IIRC) applies to all terminals.

`sudo bash` anyone?


        Stefan

[toc] | [prev] | [next] | [standalone]

#258179

Hi Stefan,

On Fri, 2023-05-12 at 08:25 -0400, Stefan Monnier wrote:
> > Or configure sudo to disable tty_tickets, so that the timeout (10
> > minutes by default IIRC) applies to all terminals.
> 
> `sudo bash` anyone?
> 

AMAZING! Thanks for tip, Stefan ^^^


Sincerely, Byung-Hee

-- 
^고맙습니다 _布德天下_ 감사합니다_^))//

[toc] | [prev] | [next] | [standalone]

#258180

On 12/05/2023 21:00, Byung-Hee HWANG (황병희) wrote:
> On Fri, 2023-05-12 at 08:25 -0400, Stefan Monnier wrote:
>>
>> `sudo bash` anyone?
> 
> AMAZING! Thanks for tip, Stefan ^^^

Isn't it a way to get e.g. ~/.bash_history owned by root?

     sudo -i

should be better

[toc] | [prev] | [next] | [standalone]

#258181

Le 12 mai 2023 Stefan Monnier a écrit :

>> Or configure sudo to disable tty_tickets, so that the timeout (10
>> minutes by default IIRC) applies to all terminals.
>
> `sudo bash` anyone?

also quicker done with
su -

[toc] | [prev] | [next] | [standalone]

#258182

[Multipart message — attachments visible in raw view] — view raw

On Fri, May 12, 2023 at 05:46:21PM +0200, Michel Verdier wrote:
> Le 12 mai 2023 Stefan Monnier a écrit :
> 
> >> Or configure sudo to disable tty_tickets, so that the timeout (10
> >> minutes by default IIRC) applies to all terminals.
> >
> > `sudo bash` anyone?
> 
> also quicker done with
> su -

But not the same.

Cheers
-- 
t

[toc] | [prev] | [next] | [standalone]

#258192

Le 12 mai 2023 tomas a écrit :

>> > `sudo bash` anyone?
>> 
>> also quicker done with
>> su -
>
> But not the same.

Which differences do you see ?

[toc] | [prev] | [next] | [standalone]

#258207

[Multipart message — attachments visible in raw view] — view raw

On Sat, May 13, 2023 at 10:35:31AM +0200, Michel Verdier wrote:
> Le 12 mai 2023 tomas a écrit :
> 
> >> > `sudo bash` anyone?
> >> 
> >> also quicker done with
> >> su -
> >
> > But not the same.
> 
> Which differences do you see ?

For su, you have to enter the root password. For sudo, there
are many options, depending on config. Typically you enter
yours.

Plus, you can configure which commands (and args) can be done
by whom, based on user id, local or remote, etc.

OTOH the sudo system is way more complex than simple su, so
there's more place where bugs can hide (it has had actual
issues, btw).

Security is engineering: always looking for a good tradeoff.
Not magic.

(That's why I cringe when people around here scaremonger about
"you NEED to have a password" and things. People should know
what they are getting into, for sure, but at the same time they
should take their own decisions).

Cheers
-- 
t

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web