Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #225870

Re: [OT] sudo: restrict to physical console only?

Show all headers | View raw

	Hi.

On Tue, Aug 04, 2020 at 04:20:58PM -0400, Dan Ritter wrote:
> Reco wrote: 
> > On Tue, Aug 04, 2020 at 09:47:24AM +0200, Marco M?ller wrote:
> > > Is it possible (how?) to restrict a user to only be allowed to make use of its sudo usage permission if working at the physical console, not granting to this
> > > user sudo permission when i.e. logged in via ssh? To keep it simple, I could imagine to even have all sudo for all users deactivated automatically as soon as
> > > a remote connection by ANY user is detected.
> > 
> > Yes. It's an unusual (some may say - dangerous) thing that you're
> > asking, so prepare to the unusual side effects.
> > 
> > --- a/etc/pam.d/sudo   2020-08-04 18:40:26.528699633 +0000
> > +++ b/etc/pam.d/sudo   2020-08-04 18:40:26.296579395 +0000
> > @@ -1,5 +1,6 @@
> >  #%PAM-1.0
> > 
> >  @include common-auth
> > +auth required pam_succeed_if.so tty =~ /dev/tty*
> >  @include common-account
> >  @include common-session-noninteractive
> > 
> > 
> > I'm assuming that by "physical console" you mean that lovely
> > conventional virtual terminal kernel facility (i.e. that funny letters
> > that appear on your screen then you press Ctrl+Alt+F2). Be warned that
> > in the current form it *will* break sudo for anyone, root included, for
> > any process which "tty" attribute does not match /dev/tty*, be it ssh,
> > screen, tmux, and (possibly) X/Wayland sessions.
> > Worked for me in the case of real servers, just in case.
>  
> It should also match for serial connections, including modem users,
> should you have any of such. And USB serial terminals.

I consider it a feature, not a deficiency. It cannot be called a server
unless it features a RS-232-based console connection typically assigned
to ttyS0, and locking myself out of it is not something that I'd do.
But, as they say, patches are welcome.

Reco

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 09:50 +0200
  Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 11:00 +0200
    Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 11:50 +0200
      Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 12:20 +0200
      Re: [OT] sudo: restrict to physical console only? Greg Wooledge <wooledg@eeg.ccf.org> - 2020-08-04 13:50 +0200
        Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 14:30 +0200
        Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 15:10 +0200
          Re: [OT] sudo: restrict to physical console only? John Hasler <jhasler@newsguy.com> - 2020-08-04 17:30 +0200
            Re: [OT] sudo: restrict to physical console only? <tomas@tuxteam.de> - 2020-08-04 19:00 +0200
      Re: [OT] sudo: restrict to physical console only? Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-04 16:00 +0200
        Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 16:10 +0200
          Re: [OT] sudo: restrict to physical console only? Michael Stone <mstone@debian.org> - 2020-08-04 17:10 +0200
  Re: [OT] sudo: restrict to physical console only? Keith bainbridge <keithrbau@gmail.com> - 2020-08-04 11:00 +0200
    Re: [OT] sudo: restrict to physical console only? Marco Möller <talby@debianlists.mobilxpress.net> - 2020-08-04 11:10 +0200
  Re: [OT] sudo: restrict to physical console only? Andy Smith <andy@strugglers.net> - 2020-08-04 18:50 +0200
  Re: [OT] sudo: restrict to physical console only? Reco <recoverym4n@enotuniq.net> - 2020-08-04 20:50 +0200
    Re: [OT] sudo: restrict to physical console only? Dan Ritter <dsr@randomstring.org> - 2020-08-04 22:30 +0200
      Re: [OT] sudo: restrict to physical console only? Reco <recoverym4n@enotuniq.net> - 2020-08-05 08:40 +0200

csiph-web