Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #198404
| From | The Wanderer <wanderer@fastmail.fm> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: As seen above: use of su vs sudo |
| Date | 2018-08-07 15:30 +0200 |
| Message-ID | <wkadH-1ac-11@gated-at.bofh.it> (permalink) |
| References | (2 earlier) <wk8EW-5t-17@gated-at.bofh.it> <wk8Yh-se-11@gated-at.bofh.it> <wk9hE-zx-9@gated-at.bofh.it> <wk9KF-JR-7@gated-at.bofh.it> <wk9Um-13f-29@gated-at.bofh.it> |
| Organization | This space intentionally left blank. |
[Multipart message — attachments visible in raw view] - view raw
On 2018-08-07 at 09:04, Martin wrote: > Am 07.08.2018 um 14:50 schrieb The Wanderer: > >> On 2018-08-07 at 08:27, Martin wrote: >>> So, what is bad with 'sudo -u TARGETUSER YOUR_COMMEND'? How do >>> you edit a file with su? Invoke a shell? Take a look at >>> sudoedit! >> >> "su OPTIONAL_USERNAME -c 'YOUR_COMMAND'", or similar, where >> 'YOUR_COMMAND' could be 'nano /path/to/file-to-be-edited' - or >> could be 'sh', if it weren't possible to get a root shell by just >> running straight 'su' instead. > > Ouch! > > Once you let a user run an editor with escalated privileges, you're > fu**ed. In almost every editor, you can load a different file, save > the buffer with a different file name. Of course. Again, that comes down to: do you trust this user with elevated access, or not? If you don't, you shouldn't be giving them elevated access of any kind. If you do, then giving them this access doesn't hurt. If you trust them with only limited elevated access, you should be giving them access to a more limited role, not to root itself. It may be reasonable to do that via sudoers (probably with targetpw, though I haven't finished considering that subject), but it's also reasonable to do it with separate users for each role. (Combined with the fact that I didn't say I'd let most users do this; I said this is what I do myself.) > That is, why I pointed out the use of 'sudoedit'. You need to warp > your mind around it, from a security standpoint, the use of 'su' is > not a good idea in almost all cases. I'm aware of this tool. It's not something I've ever needed, but it's certainly valid for its purpose. > And I still have no idea, what the single case would be, where sudo > would not be able to do, what you may accomplish using su. It's not that you can do something with su that you can't do with sudo. It's that you can do things with sudo that you can't do with su. Or, rather, that you can do elevated-access things with the same credentials as are used to permit non-elevated access. I consider that to be, by definition, a security hole. -- The Wanderer The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man. -- George Bernard Shaw
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
As seen above: use of su vs sudo Martin Drescher <keine-eile@online.de> - 2018-08-07 12:00 +0200
Re: As seen above: use of su vs sudo Joe <joe@jretrading.com> - 2018-08-07 12:50 +0200
Re: As seen above: use of su vs sudo Jonathan Dowland <jmtd@debian.org> - 2018-08-07 13:20 +0200
Re: As seen above: use of su vs sudo Martin Drescher <keine-eile@online.de> - 2018-08-07 13:30 +0200
Re: As seen above: use of su vs sudo David Wright <deblis@lionunicorn.co.uk> - 2018-08-07 17:20 +0200
Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 17:40 +0200
Re: As seen above: use of su vs sudo Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2018-08-07 18:20 +0200
Re: As seen above: use of su vs sudo Joe <joe@jretrading.com> - 2018-08-07 14:10 +0200
Re: As seen above: use of su vs sudo likcoras <likcoras@riseup.net> - 2018-08-07 14:40 +0200
Re: As seen above: use of su vs sudo likcoras <likcoras@riseup.net> - 2018-08-07 14:00 +0200
Re: As seen above: use of su vs sudo Richard Owlett <rowlett@cloud85.net> - 2018-08-07 13:00 +0200
Re: As seen above: use of su vs sudo Stephan Seitz <stse+debian@fsing.rootsland.net> - 2018-08-07 13:20 +0200
Re: As seen above: use of su vs sudo James Allsopp <jamesaallsopp@googlemail.com> - 2018-08-07 13:30 +0200
Re: As seen above: use of su vs sudo Curt <curty@free.fr> - 2018-08-07 13:50 +0200
Re: As seen above: use of su vs sudo Stephan Seitz <stse+debian@fsing.rootsland.net> - 2018-08-07 14:30 +0200
Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 14:30 +0200
Re: As seen above: use of su vs sudo Jonathan Dowland <jmtd@debian.org> - 2018-08-07 15:20 +0200
Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 15:50 +0200
Re: As seen above: use of su vs sudo <tomas@tuxteam.de> - 2018-08-07 14:20 +0200
Re: As seen above: use of su vs sudo Dave Sherohman <dave@sherohman.org> - 2018-08-07 15:30 +0200
Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 13:40 +0200
Re: As seen above: use of su vs sudo Stephan Seitz <stse+debian@fsing.rootsland.net> - 2018-08-07 14:30 +0200
Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 13:30 +0200
Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 13:50 +0200
Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 14:10 +0200
Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 14:30 +0200
Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 15:00 +0200
Re: As seen above: use of su vs sudo Nicolas George <george@nsup.org> - 2018-08-07 15:10 +0200
Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 15:30 +0200
Re: As seen above: use of su vs sudo Nicolas George <george@nsup.org> - 2018-08-07 15:40 +0200
Re: As seen above: use of su vs sudo David Wright <deblis@lionunicorn.co.uk> - 2018-08-07 18:20 +0200
Re: As seen above: use of su vs sudo Nicolas George <george@nsup.org> - 2018-08-07 18:40 +0200
Re: As seen above: use of su vs sudo Greg Wooledge <wooledg@eeg.ccf.org> - 2018-08-07 18:50 +0200
Re: As seen above: use of su vs sudo Michael Stone <mstone@debian.org> - 2018-08-07 19:10 +0200
Re: As seen above: use of su vs sudo Curt <curty@free.fr> - 2018-08-07 20:10 +0200
Re: As seen above: use of su vs sudo Nicolas George <george@nsup.org> - 2018-08-07 20:10 +0200
Re: As seen above: use of su vs sudo Curt <curty@free.fr> - 2018-08-07 20:20 +0200
Re: As seen above: use of su vs sudo Michael Stone <mstone@debian.org> - 2018-08-07 20:50 +0200
Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 15:10 +0200
Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 15:30 +0200
Re: As seen above: use of su vs sudo Michael Stone <mstone@debian.org> - 2018-08-07 15:50 +0200
Re: As seen above: use of su vs sudo Martin <keine-eile@online.de> - 2018-08-07 15:50 +0200
Re: As seen above: use of su vs sudo Nemeth Gyorgy <friczy@freemail.hu> - 2018-08-07 21:10 +0200
Re: As seen above: use of su vs sudo Gene Heskett <gheskett@shentel.net> - 2018-08-07 22:10 +0200
Re: As seen above: use of su vs sudo Michael Stone <mstone@debian.org> - 2018-08-07 15:20 +0200
Re: As seen above: use of su vs sudo Stephan Seitz <stse+debian@fsing.rootsland.net> - 2018-08-07 16:10 +0200
Re: As seen above: use of su vs sudo Dave Sherohman <dave@sherohman.org> - 2018-08-07 15:30 +0200
Re: As seen above: use of su vs sudo The Wanderer <wanderer@fastmail.fm> - 2018-08-07 15:40 +0200
Re: As seen above: use of su vs sudo David Wright <deblis@lionunicorn.co.uk> - 2018-08-07 18:10 +0200
Re: As seen above: use of su vs sudo Eike Lantzsch <zp6cge@gmx.net> - 2018-08-07 14:30 +0200
Re: As seen above: use of su vs sudo mick crane <mick.crane@gmail.com> - 2018-08-07 16:00 +0200
Re: As seen above: use of su vs sudo mick crane <mick.crane@gmail.com> - 2018-08-07 18:30 +0200
csiph-web