Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #225846

Re: [OT] sudo: restrict to physical console only?

Show all headers | View raw

Hi Marco,

On Tue, Aug 04, 2020 at 09:47:24AM +0200, Marco Möller wrote:
> Is it possible (how?) to restrict a user to only be allowed to make use of
> its sudo usage permission if working at the physical console, not granting
> to this user sudo permission when i.e. logged in via ssh?

I was intrigued by this question so I tried to find out how to do
it. I was unsuccessful and only got as far as:

    https://www.sudo.ws/pipermail/sudo-users/2009-April/004015.html

Probably the feature has not been added to sudo in the last 11 years
either.

Perhaps using pam_group.so you could force users on certain ttys
into a specific group, and allow that group (only) to use sudo?

    http://www.linux-pam.org/Linux-PAM-html/sag-pam_group.html

I've never done it but the above seems to imply that putting
something like:

     *;tty*;*;*;mysudogroup

into /etc/security/group.conf would put any user logging in on tty*
into the group "mysudogroup". If you allowed "mysudogroup" to use
sudo in /etc/sudoers then maybe that works.

I would be interested to know if that is a workable solution.

Cheers,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 09:50 +0200
  Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 11:00 +0200
    Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 11:50 +0200
      Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 12:20 +0200
      Re: [OT] sudo: restrict to physical console only? Greg Wooledge <wooledg@eeg.ccf.org> - 2020-08-04 13:50 +0200
        Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 14:30 +0200
        Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 15:10 +0200
          Re: [OT] sudo: restrict to physical console only? John Hasler <jhasler@newsguy.com> - 2020-08-04 17:30 +0200
            Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 19:00 +0200
      Re: [OT] sudo: restrict to physical console only? Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-04 16:00 +0200
        Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 16:10 +0200
          Re: [OT] sudo: restrict to physical console only? Michael Stone <mstone@debian.org> - 2020-08-04 17:10 +0200
  Re: [OT] sudo: restrict to physical console only? Keith bainbridge <keithrbau@gmail.com> - 2020-08-04 11:00 +0200
    Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 11:10 +0200
  Re: [OT] sudo: restrict to physical console only? Andy Smith <andy@strugglers.net> - 2020-08-04 18:50 +0200
  Re: [OT] sudo: restrict to physical console only? Reco <recoverym4n@enotuniq.net> - 2020-08-04 20:50 +0200
    Re: [OT] sudo: restrict to physical console only? Dan Ritter <dsr@randomstring.org> - 2020-08-04 22:30 +0200
      Re: [OT] sudo: restrict to physical console only? Reco <recoverym4n@enotuniq.net> - 2020-08-05 08:40 +0200

csiph-web