<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Mail Disclaimers on 02:21:32 Friday, 16 September 2011 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.33cb67cd-47c7-4452-ac5f-290b0a7e977f {
MARGIN: 0cm 0cm 0pt
}
LI.33cb67cd-47c7-4452-ac5f-290b0a7e977f {
MARGIN: 0cm 0cm 0pt
}
DIV.33cb67cd-47c7-4452-ac5f-290b0a7e977f {
MARGIN: 0cm 0cm 0pt
}
TABLE.33cb67cd-47c7-4452-ac5f-290b0a7e977fTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PersonName" /><!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]--><style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang="EN-US" link="blue" vlink="blue">
<p class="33cb67cd-47c7-4452-ac5f-290b0a7e977f"></p>
<div class="Section1">
<p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:
10.0pt;font-family:Arial;color:navy">And of course you have to be careful with sudo. It amazes me the when people can’t see that granting access to something like “sudo
vi” is a bad idea. Any command that has a shell access sequence (e.g. “:/bin/bash” in vi) gives such users complete root access because the shell is started by the root user since the parent was.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:
10.0pt;font-family:Arial;color:navy"><o:p> </o:p></span></font></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><font size="3" face="Times New Roman"><span style="font-size:12.0pt"></span></font></div>
</div>
</div>
<p></p>
<p class="33cb67cd-47c7-4452-ac5f-290b0a7e977f"> </p>
<p class="33cb67cd-47c7-4452-ac5f-290b0a7e977f"> </p>
<p class="33cb67cd-47c7-4452-ac5f-290b0a7e977f"></p>
<div class="Section1">
<div>
<div class="MsoNormal" align="center" style="text-align:center"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">
<hr size="2" width="100%" align="center" tabindex="-1">
</span></font></div>
<p class="MsoNormal"><b><font size="2" face="Tahoma"><span style="font-size:10.0pt;
font-family:Tahoma;font-weight:bold">From:</span></font></b><font size="2" face="Tahoma"><span style="font-size:10.0pt;font-family:Tahoma"> ale-bounces@ale.org [mailto:ale-bounces@ale.org]
<b><span style="font-weight:
bold">On Behalf Of </span></b>Jim Kinney<br>
<b><span style="font-weight:bold">Sent:</span></b> Friday, September 16, 2011 1:56 PM<br>
<b><span style="font-weight:bold">To:</span></b> <st1:PersonName w:st="on">Atlanta Linux Enthusiasts</st1:PersonName><br>
<b><span style="font-weight:bold">Subject:</span></b> Re: [ale] SSH attempts</span></font><o:p></o:p></p>
</div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt"><o:p> </o:p></span></font></p>
<p><font size="3" face="Times New Roman"><span style="font-size:12.0pt">But if you lock the root account you're hosed in emergency run level 1.<br>
Instead set securetty to only be local console and use sudo for all else.<o:p></o:p></span></font></p>
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt">On Sep 16, 2011 1:47 PM, "Michael B. Trausch" <<a href="mailto:mike@trausch.us">mike@trausch.us</a>> wrote:<br type="attribution">
> On Mon, 2011-09-12 at 17:40 -0400, Bob Toxen wrote:<br>
>> Disabling root ssh and requiring one first to ssh in through another<br>
>> account and su'ing or sudo'ing to root is not as effective as the<br>
>> above solutions and may diminish security, in my opinion. <br>
> <br>
> Okay, so I can understand why that would be the case for giving accounts<br>
> access to su (but if you're doing that, then you haven't locked the<br>
> password for the root user anyway), but sudo is a totally different<br>
> animal.<br>
> <br>
> What I do on all my systems these days is this:<br>
> <br>
> * I run "passwd -l root", so that root cannot login by any means<br>
> (because its password is locked).<br>
> <br>
> * I create a group for full system administrators (that is, people<br>
> that can run "sudo -i" or "sudo -s" to the root user account).<br>
> <br>
> * If the system has subadministrators, I configure sudo for that.<br>
> For example, on a system that runs a phone system (say, FreeSWITCH),<br>
> the phone system runs as a certain user. I'll create a group for<br>
> people who are allowed to become that user, and then configure sudo<br>
> to enable people to change their uid to that user so that they can<br>
> administer the phone system. Same goes for a Web administrator or<br>
> DBA. Such people would, therefore, not allowed to become root<br>
> (because they have no need to do so).<br>
> <br>
> * If there are people who have to run single commands as root, I will<br>
> configure sudo to enable them to do so (as long as it's not a command<br>
> that will spawn a subshell or something). All bets are off if it can<br>
> spawn a subshell, of course, but as long as it is a well-behaved<br>
> single-task program, it is usually fine.<br>
> <br>
> The sudo command can be used to create a very fine-grained system where<br>
> people can only gain access to the privileges that they need in order to<br>
> get their work done. It _can_ take a little bit to engineer an<br>
> appropriate configuration, but once that's done, sudo takes care of the<br>
> logging and all of that for you.<br>
> <br>
> There are even ways to make it possible to have fully functional system<br>
> administrators that can do everything _except_ change the sudo<br>
> configuration or certain items like system logs, though that is slightly<br>
> outside of the scope of sudo itself.<br>
> <br>
> All that to say that proper use of sudo significantly enhances system<br>
> security, not the opposite.<br>
> <br>
> --- Mike<br>
> <br>
> -- <br>
> A man who reasons deliberately, manages it better after studying Logic<br>
> than he could before, if he is sincere about it and has common sense.<br>
> --- Carveth Read, “Logic”<br>
> <br>
> _______________________________________________<br>
> Ale mailing list<br>
> <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
> <a href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a><br>
> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
> <a href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a><o:p></o:p></span></font></p>
</div>
</div>
<p></p>
<p class="33cb67cd-47c7-4452-ac5f-290b0a7e977f"> </p>
<p class="33cb67cd-47c7-4452-ac5f-290b0a7e977f"> </p>
<p class="33cb67cd-47c7-4452-ac5f-290b0a7e977f"> </p>
<p style="MARGIN: 0in 0in 0pt; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto" class="MsoNormal">
<span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">Proud partner. Susan G. Komen for the Cure.</span></p>
<p style="MARGIN: 0in 0in 0pt; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto" class="MsoNormal">
<span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p></o:p></span> </p>
<p style="MARGIN: 0in 0in 0pt" class="MsoNormal"> <i><span style="FONT-FAMILY: Arial; COLOR: green; FONT-SIZE: 7.5pt; mso-bidi-font-size: 12.0pt">Please consider our environment before printing this e-mail or attachments.</span></i>
</p>
<p style="MARGIN: 0in 0in 0pt" class="MsoNormal"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">----------------------------------<br>
CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information
is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.<br>
----------------------------------</span><span style="FONT-FAMILY: 'Courier New'; FONT-SIZE: 9pt"><o:p></o:p></span></p>
<p> </p>
</body>
</html>