Re: Re: qx//, ssh -t (pseudo-tty) and sudo

Way OT here, but there is a huge difference between using ssh as root and using ssh as a normal user who has sudo privileges.

While the differences are too numerous to mention, it is important to remember root is all-powerful. Period. No questions asked.

sudo is highly configurable as to which user/group can do what. You can fine-tune which user can do X, which group can do Y, etc.

I'll take 1,000 users with sudo privileges over 1,000 users logging in as root any day. At a minimum, I can look at the logs and see who did what, as opposed to thousands of entries showing root logging in, and then one entry where root rm -rf /.

If things get any worse, I'll have to ask you to stop helping me.

Comment on Re: Re: qx//, ssh -t (pseudo-tty) and sudo

Replies are listed 'Best First'.
Re: Re: Re: qx//, ssh -t (pseudo-tty) and sudo by Roger (Parson) on Nov 12, 2003 at 01:13 UTC
sudo is highly configurable as to which user/group can do what. You can fine-tune which user can do X, which group can do Y, etc. Agreed, but once I convinced the system admin that I had to do `sudo make` to compile some program. Having obtained the sudo access, I made a simple Makefile that called a script that modified the sudoer file, and gave me total control of the system. :-)	[reply] [d/l]
Re: Re: Re: Re: qx//, ssh -t (pseudo-tty) and sudo by shockme (Chaplain) on Nov 12, 2003 at 01:19 UTC
Given that `/etc/sudoers` is supposed to be read-only (444), this smacks of an insecure installation. However, my point was not that `sudo` is perfection, only that it is far more preferable to allowing `root` access to `ssh`. If things get any worse, I'll have to ask you to stop helping me.	[reply]
Re: Re: Re: Re: Re: qx//, ssh -t (pseudo-tty) and sudo by Roger (Parson) on Nov 12, 2003 at 02:31 UTC
Yes I agree with you that sudo is better than direct root acess. And on my system I don't allow remote root login anyway. Given that /etc/sudoers is supposed to be read-only (444), this smacks of an insecure installation. Yes the /etc/sudoers file was read-only, but my script does - `chmod u+w /etc/sudoers ... bits to modify my sudoers entry ... chmod u-w /etc/sudoers` [download] When I do a sudo make, every command inside the Makefile are automatically run with ROOT priviledges, so there is no secure system when I can do "sudo make". :) (I know this is OT, but interesting to know and talk about. So one thing I never do is to give people sudo access on make)	[reply] [d/l]
Re: Re: Re: Re: Re: Re: qx//, ssh -t (pseudo-tty) and sudo by shockme (Chaplain) on Nov 12, 2003 at 03:24 UTC


more useful options
	PerlMonks