Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #198352 > unrolled thread

As seen above: use of su vs sudo

Back to article view | Back to linux.debian.user

Contents

  As seen above: use of su vs sudo Martin Drescher <keine-eile@online.de> - 2018-08-07 12:00 +0200
    Re: As seen above: use of su vs sudo Joe <joe@jretrading.com> - 2018-08-07 12:50 +0200
      Re: As seen above: use of su vs sudo Jonathan Dowland <jmtd@debian.org> - 2018-08-07 13:20 +0200
        Re: As seen above: use of su vs sudo Martin Drescher <keine-eile@online.de> - 2018-08-07 13:30 +0200
          Re: As seen above: use of su vs sudo David Wright <deblis@lionunicorn.co.uk> - 2018-08-07 17:20 +0200
            Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 17:40 +0200
              Re: As seen above: use of su vs sudo Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2018-08-07 18:20 +0200
        Re: As seen above: use of su vs sudo Joe <joe@jretrading.com> - 2018-08-07 14:10 +0200
          Re: As seen above: use of su vs sudo likcoras <likcoras@riseup.net> - 2018-08-07 14:40 +0200
      Re: As seen above: use of su vs sudo likcoras <likcoras@riseup.net> - 2018-08-07 14:00 +0200
    Re: As seen above: use of su vs sudo Richard Owlett <rowlett@cloud85.net> - 2018-08-07 13:00 +0200
    Re: As seen above: use of su vs sudo Stephan Seitz <stse+debian@fsing.rootsland.net> - 2018-08-07 13:20 +0200
      Re: As seen above: use of su vs sudo James Allsopp <jamesaallsopp@googlemail.com> - 2018-08-07 13:30 +0200
        Re: As seen above: use of su vs sudo Curt <curty@free.fr> - 2018-08-07 13:50 +0200
          Re: As seen above: use of su vs sudo Stephan Seitz <stse+debian@fsing.rootsland.net> - 2018-08-07 14:30 +0200
            Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 14:30 +0200
          Re: As seen above: use of su vs sudo Jonathan Dowland <jmtd@debian.org> - 2018-08-07 15:20 +0200
            Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 15:50 +0200
        Re: As seen above: use of su vs sudo <tomas@tuxteam.de> - 2018-08-07 14:20 +0200
        Re: As seen above: use of su vs sudo Dave Sherohman <dave@sherohman.org> - 2018-08-07 15:30 +0200
      Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 13:40 +0200
        Re: As seen above: use of su vs sudo Stephan Seitz <stse+debian@fsing.rootsland.net> - 2018-08-07 14:30 +0200
    Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 13:30 +0200
      Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 13:50 +0200
        Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 14:10 +0200
          Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 14:30 +0200
            Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 15:00 +0200
              Re: As seen above: use of su vs sudo Nicolas George <george@nsup.org> - 2018-08-07 15:10 +0200
                Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 15:30 +0200
                  Re: As seen above: use of su vs sudo Nicolas George <george@nsup.org> - 2018-08-07 15:40 +0200
                    Re: As seen above: use of su vs sudo David Wright <deblis@lionunicorn.co.uk> - 2018-08-07 18:20 +0200
                      Re: As seen above: use of su vs sudo Nicolas George <george@nsup.org> - 2018-08-07 18:40 +0200
                        Re: As seen above: use of su vs sudo Greg Wooledge <wooledg@eeg.ccf.org> - 2018-08-07 18:50 +0200
                      Re: As seen above: use of su vs sudo Michael Stone <mstone@debian.org> - 2018-08-07 19:10 +0200
                        Re: As seen above: use of su vs sudo Curt <curty@free.fr> - 2018-08-07 20:10 +0200
                          Re: As seen above: use of su vs sudo Nicolas George <george@nsup.org> - 2018-08-07 20:10 +0200
                            Re: As seen above: use of su vs sudo Curt <curty@free.fr> - 2018-08-07 20:20 +0200
                          Re: As seen above: use of su vs sudo Michael Stone <mstone@debian.org> - 2018-08-07 20:50 +0200
              Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 15:10 +0200
                Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 15:30 +0200
                  Re: As seen above: use of su vs sudo Michael Stone <mstone@debian.org> - 2018-08-07 15:50 +0200
                  Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 15:50 +0200
              Re: As seen above: use of su vs sudo Nemeth Gyorgy <friczy@freemail.hu> - 2018-08-07 21:10 +0200
                Re: As seen above: use of su vs sudo Gene Heskett <gheskett@shentel.net> - 2018-08-07 22:10 +0200
            Re: As seen above: use of su vs sudo Michael Stone <mstone@debian.org> - 2018-08-07 15:20 +0200
            Re: As seen above: use of su vs sudo Stephan Seitz <stse+debian@fsing.rootsland.net> - 2018-08-07 16:10 +0200
          Re: As seen above: use of su vs sudo Dave Sherohman <dave@sherohman.org> - 2018-08-07 15:30 +0200
            Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 15:40 +0200
          Re: As seen above: use of su vs sudo David Wright <deblis@lionunicorn.co.uk> - 2018-08-07 18:10 +0200
    Re: As seen above: use of su vs sudo Eike Lantzsch <zp6cge@gmx.net> - 2018-08-07 14:30 +0200
    Re: As seen above: use of su vs sudo mick crane <mick.crane@gmail.com> - 2018-08-07 16:00 +0200
    Re: As seen above: use of su vs sudo mick crane <mick.crane@gmail.com> - 2018-08-07 18:30 +0200

Page 3 of 3 — ← Prev page 1 2 [3]

#198408

On Tue, Aug 07, 2018 at 09:22:07AM -0400, The Wanderer wrote:
>Or, rather, that you can do elevated-access things with the same
>credentials as are used to permit non-elevated access.
>
>I consider that to be, by definition, a security hole.

That can be addressed three ways: first, you can have sudo require the 
root password instead of the user password; second, you can use pam to 
have sudo require different credentials than the login password; third, 
you can use pam to have sudo require multi-factor authentication. The 
configuration that makes the most sense depends heavily on the local 
environment. I'd personally consider a well-implemented multi-factor 
scheme to be much more secure (and easier to manage) than discrete 
root passwords, and much easier to implement safely (including emergency 
access) using sudo rather than su. I tend to agree that just replacing 
su with sudo doesn't buy much security and may be a net negative if done 
carelessly; to really get value from sudo requires a good bit of 
customization--and it's hard to see a return on that work in a small 
environment. If the security factors are the same and the workflow is 
functionally identical except that instead of "su -" someone uses "sudo 
-s" or prefixes every command with sudo, it seems clearly a matter of 
preference and muscle memory rather than substance.

Mike Stone

[toc] | [prev] | [next] | [standalone]

#198409

>> Once you let a user run an editor with escalated privileges, you're
>> fu**ed. In almost every editor, you can load a different file, save
>> the buffer with a different file name.
> 
> Of course.
> 
> Again, that comes down to: do you trust this user with elevated access,
> or not?


It is not about trust. It is about authorisation. About privileges and how to control them effectively.
You may trust your friend not to crash your shiny new car. But would you just give the key and let go?

[toc] | [prev] | [next] | [standalone]

#198431

2018-08-07 14:50 keltezéssel, The Wanderer írta:
>
> But it's more secure to require a second password to do elevated things
> than to permit doing those things with the same password as is used for
> ordinary activities.

Then use other pam backend module for sudo and not the 'common-auth'.
There are lot of pam auth methods. You only have to create a second
database which is supported by some of the libpam modules and modify
/etc/pam.d/sudo

In this case you still don't have to share a common root password (which
is really bad) and can require a second password for doing elevated things.

[toc] | [prev] | [next] | [standalone]

#198435

On Tuesday 07 August 2018 15:08:34 Nemeth Gyorgy wrote:

> 2018-08-07 14:50 keltezéssel, The Wanderer írta:
> > But it's more secure to require a second password to do elevated
> > things than to permit doing those things with the same password as
> > is used for ordinary activities.
>
> Then use other pam backend module for sudo and not the 'common-auth'.
> There are lot of pam auth methods. You only have to create a second
> database which is supported by some of the libpam modules and modify
> /etc/pam.d/sudo
>
> In this case you still don't have to share a common root password
> (which is really bad) and can require a second password for doing
> elevated things.

How to do that should be written up and published at a google findable 
site as this idea seems to offer an additional layer of security.  But 
one that you can still remember w/o painting it on the wall. I have one 
jessie machine that has a long root pw,  but sudo hasn't needed a pw 
since a long time. Nor does it advise you in the shell prompt that its a 
sudo -i empowered shell, and that bothers the hell outta me. Haveing 
sudo ask for yet a 3rd password phrase of 60 or more chars (with no 
objections to a word separating space here and there) to become active 
seems like a good thing for security.


-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#198399

On Tue, Aug 07, 2018 at 02:27:48PM +0200, Martin wrote:
>Am 07.08.2018 um 14:07 schrieb The Wanderer:
>> On 2018-08-07 at 07:47, Martin wrote:
>>> As a system operator, you need some elevated privileges on a daily
>>> basis. How do you do that without sudo?
>>
>> No, I don't. I only need them when I'm doing elevated things, such as
>> installs or upgrades. (In practice on some machines, I do those on
>> around a weekly basis or slightly more frequently, but it can be argued
>> that that's overkill.) The overwhelming majority of what I do does not
>> require elevated privileges, and the few things which do are not needed
>> anywhere near daily.
>
>Starting and stopping services (e.g. running systemctl), changing configurations, all things you, where individual decisions have to be made, reuire elevated privileges. root in many cases.

It's ironic that while forcefully telling people they're doing it wrong, 
you're managing a bunch of machines with no configuration management, 
manually editing files directly on systems. You have your preferred way 
of doing things, other people do things other ways. I don't think there 
are any new points here, so please stop repeating that yours is the only 
correct way to operate so the thread can die a natural death.

Mike Stone

[toc] | [prev] | [next] | [standalone]

#198411

[Multipart message — attachments visible in raw view] — view raw

On Di, Aug 07, 2018 at 02:27:48 +0200, Martin wrote:
>Come on. You are telling me, it is more secure to share one secret among 
>multiple people against every person having it own?

If the password is stored in a password safe, and everyone in the IT has 
access to it, where is the problem?

>First you have to log in to a user's account. And I'm quite sure, you 
>will use ssh with keys that, right?

I do it (at least in most cases, my key is not on every system I may need 
to login). Others don’t, they use their LDAP password.

>Yes, this is way more complex than su. But it will improve system 
>security by far, when in good hands.

If this security isn’t needed why bother?

Shade and sweet water!

	Stephan

-- 
| Public Keys: http://fsing.rootsland.net/~stse/keys.html |

[toc] | [prev] | [next] | [standalone]

#198403

On Tue, Aug 07, 2018 at 08:07:56AM -0400, The Wanderer wrote:
> On 2018-08-07 at 07:47, Martin wrote:
> > The point is not, that ONE person needs a root password. All people
> > intended to do privileged things will have to share this password.
> > This is a security nightmare!
> 
> If they're all trusted enough to be trusted with that password in the
> first place, this isn't a problem, any more than the one person having
> it is.
> 
> If they aren't trusted enough to have that password, why are we
> permitting them to do anything root-level in the first place?

It's not just a question of trust, but also one of maintenance.  What
happens when one of the people with root access gets a new job?

Using su and a shared root password:
- Disable the person's account.
- Change the root password.
- Find a secure way to distribute the new password to all the people
  it's shared by.

Using sudo:
- Disable the person's account.
- Remove the account from /etc/sudoers and/or the sudo group.

Everyone else with root access is completely unaffected by the
departure.

-- 
Dave Sherohman

[toc] | [prev] | [next] | [standalone]

#198406

[Multipart message — attachments visible in raw view] — view raw

On 2018-08-07 at 09:22, Dave Sherohman wrote:

> On Tue, Aug 07, 2018 at 08:07:56AM -0400, The Wanderer wrote:
> 
>> On 2018-08-07 at 07:47, Martin wrote:
>> 
>>> The point is not, that ONE person needs a root password. All
>>> people intended to do privileged things will have to share this
>>> password. This is a security nightmare!
>> 
>> If they're all trusted enough to be trusted with that password in
>> the first place, this isn't a problem, any more than the one person
>> having it is.
>> 
>> If they aren't trusted enough to have that password, why are we 
>> permitting them to do anything root-level in the first place?
> 
> It's not just a question of trust, but also one of maintenance.
> What happens when one of the people with root access gets a new job?
> 
> Using su and a shared root password:
> - Disable the person's account.
> - Change the root password.
> - Find a secure way to distribute the new password to all the people
>   it's shared by.
> 
> Using sudo:
> - Disable the person's account.
> - Remove the account from /etc/sudoers and/or the sudo group.
> 
> Everyone else with root access is completely unaffected by the
> departure.

That's a valid point.

I'm not sure it's enough to outweigh the other factors underlying my
opinion on the subject (especially not since the computers I'm working
with in the cases at hand aren't work machines, they're home systems,
and the "other users" are either family members or close friends -
although I'll admit the scope of the discussion is broader than that),
but it's definitely an important consideration, and there are contexts
in which it could trump.

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man.         -- George Bernard Shaw

[toc] | [prev] | [next] | [standalone]

#198414

On Tue 07 Aug 2018 at 08:07:56 (-0400), The Wanderer wrote:

> I'm fairly sure that when I did (some of) my existing installs - which,
> to be fair, was years and years ago - sudo came with the system, even
> though I didn't even consider the concept of setting the machine up with
> no root password. Maybe this has changed at some point.

sudo was optional even in buzz (1.1):

Package: sudo
priority: optional
section: admin
maintainer: Michael Meskes <meskes@debian.org>
version: 1.4.2-2

AFAICT No Root Password arrived with wheezy (7).

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#198388

On Tuesday, August 7, 2018 11:58:48 AM -04 Martin Drescher wrote:
> Hi members,
> 
> I'm a little... lets say thoughtful, about the use of 'su' discussed at some
> points in this list. I have a strong opinion about su, which is, avoid it
> whenever it is possible and use 'sudo' instead. This is the case in close
> to a 100% in all cases I can think of. This opinion is based on how both
> programs work and deal with pam and environmental variables. Not to forget:
> You will not need to share (or in my case, not even set, but lock that
> account) a root password.
> 
> And I'm curious why Debian still prefers the use of su over sudo?
> 
> 
> Martin.

What ever one prefers, I recommend the following discussion:
https://www.youtube.com/watch?v=o0purspHg-o

and this book:
https://www.michaelwlucas.com/tools/sudo

Cheers
Eike

[toc] | [prev] | [next] | [standalone]

#198410

On 2018-08-07 10:58, Martin Drescher wrote:
> Hi members,
> 
> I'm a little... lets say thoughtful, about the use of 'su' discussed
> at some points in this list.
> I have a strong opinion about su, which is, avoid it whenever it is
> possible and use 'sudo' instead. This is the case in close to a 100%
> in all cases I can think of.
> This opinion is based on how both programs work and deal with pam and
> environmental variables. Not to forget: You will not need to share (or
> in my case, not even set, but lock that account) a root password.
> 
> And I'm curious why Debian still prefers the use of su over sudo?
> 
> 
> Martin.
I'm probably the average home user with a couple of servers and an 
interest.
Early on I did type "rm -rf ./*" as root when at that time su put you in 
"/"

I use[d] su to change file permissions and ownership on files in a 
directory for apache and for "make install" on the rare occasions I 
compile something from source and that's about it.
Was updating Brave browser the other day and ran into this "can't find 
ldconfig"
So now I know what's happened I'm cheerful enough.
mick
-- 
Key ID    4BFEBB31

[toc] | [prev] | [next] | [standalone]

#198417

I think as a general philosophy it used to be
this is your computer, as user we make sure it works and you can do some 
things.
You can also be root but if you break it you get to keep the bits.

mick



-- 
Key ID    4BFEBB31

[toc] | [prev] | [standalone]

Page 3 of 3 — ← Prev page 1 2 [3]

Back to top | Article view | linux.debian.user

csiph-web