Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #225853

Re: [OT] sudo: restrict to physical console only?

Show all headers | View raw

	Hi.

On Tue, Aug 04, 2020 at 09:47:24AM +0200, Marco Möller wrote:
> Is it possible (how?) to restrict a user to only be allowed to make use of its sudo usage permission if working at the physical console, not granting to this
> user sudo permission when i.e. logged in via ssh? To keep it simple, I could imagine to even have all sudo for all users deactivated automatically as soon as
> a remote connection by ANY user is detected.

Yes. It's an unusual (some may say - dangerous) thing that you're
asking, so prepare to the unusual side effects.

--- a/etc/pam.d/sudo   2020-08-04 18:40:26.528699633 +0000
+++ b/etc/pam.d/sudo   2020-08-04 18:40:26.296579395 +0000
@@ -1,5 +1,6 @@
 #%PAM-1.0

 @include common-auth
+auth required pam_succeed_if.so tty =~ /dev/tty*
 @include common-account
 @include common-session-noninteractive


I'm assuming that by "physical console" you mean that lovely
conventional virtual terminal kernel facility (i.e. that funny letters
that appear on your screen then you press Ctrl+Alt+F2). Be warned that
in the current form it *will* break sudo for anyone, root included, for
any process which "tty" attribute does not match /dev/tty*, be it ssh,
screen, tmux, and (possibly) X/Wayland sessions.
Worked for me in the case of real servers, just in case.

Reco

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 09:50 +0200
  Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 11:00 +0200
    Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 11:50 +0200
      Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 12:20 +0200
      Re: [OT] sudo: restrict to physical console only? Greg Wooledge <wooledg@eeg.ccf.org> - 2020-08-04 13:50 +0200
        Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 14:30 +0200
        Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 15:10 +0200
          Re: [OT] sudo: restrict to physical console only? John Hasler <jhasler@newsguy.com> - 2020-08-04 17:30 +0200
            Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 19:00 +0200
      Re: [OT] sudo: restrict to physical console only? Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-04 16:00 +0200
        Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 16:10 +0200
          Re: [OT] sudo: restrict to physical console only? Michael Stone <mstone@debian.org> - 2020-08-04 17:10 +0200
  Re: [OT] sudo: restrict to physical console only? Keith bainbridge <keithrbau@gmail.com> - 2020-08-04 11:00 +0200
    Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 11:10 +0200
  Re: [OT] sudo: restrict to physical console only? Andy Smith <andy@strugglers.net> - 2020-08-04 18:50 +0200
  Re: [OT] sudo: restrict to physical console only? Reco <recoverym4n@enotuniq.net> - 2020-08-04 20:50 +0200
    Re: [OT] sudo: restrict to physical console only? Dan Ritter <dsr@randomstring.org> - 2020-08-04 22:30 +0200
      Re: [OT] sudo: restrict to physical console only? Reco <recoverym4n@enotuniq.net> - 2020-08-05 08:40 +0200

csiph-web