<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Mail Disclaimers on 08:44:38 Monday, 21 May 2012 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.3612670b-8da0-4d42-925a-3a891dad0e5d {
MARGIN: 0cm 0cm 0pt
}
LI.3612670b-8da0-4d42-925a-3a891dad0e5d {
MARGIN: 0cm 0cm 0pt
}
DIV.3612670b-8da0-4d42-925a-3a891dad0e5d {
MARGIN: 0cm 0cm 0pt
}
TABLE.3612670b-8da0-4d42-925a-3a891dad0e5dTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
{font-family:"MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"></p>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I disagree with the purpose of sudo stated previously. It was not designed to prevent System Admins from getting root access. It was designed to allow NON-system
admins to access only those few things they need as root without giving them the root password and full root access.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Over time PHBs have somehow decided that even System Admins shouldn’t have root which is why you see abominations like “sudo” only distros. System Admins
do spend a lot of their time as root no matter how much hand wringing is done by people that like to claim it isn’t secure.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The sad thing about sudo is how many admins do not seem to understand what they’re giving to users with it. The first place I saw it they gave users “sudo
vi”. I had to show them what “:!/bin/sh” did in such a session. I also had to explain to them why sudo access to shell scripts that were not writable only by root in a directory only accessible by root was a bad idea.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I’ve only worked one place where I thought they handled sudo for Admins correctly. They had syslog traffic going to a server NOT controlled by the Admins
and any time you used sudo you had to put in a reason why and be prepared for a query from management because they got emails when you did it. You could hide what you did after becoming root but not the fact that you HAD become root.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">We use sudo extensively here mainly for its (IMHO) original purpose. One great use of it is to get rid of purely administrative accounts for applications
where everyone knows the password. By requiring users that need access to such administrative accounts to do “sudo su - <account>” you can log which user became that administrative user right before everything went to hell in a handbasket.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> ale-bounces@ale.org [mailto:ale-bounces@ale.org]
<b>On Behalf Of </b>Wolf Halton<br>
<b>Sent:</b> Monday, May 21, 2012 8:06 AM<br>
<b>To:</b> Atlanta Linux Enthusiasts<br>
<b>Subject:</b> Re: [ale] bash commands<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Mon, May 21, 2012 at 7:29 AM, Matthew <<a href="mailto:simontek@gmail.com" target="_blank">simontek@gmail.com</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">Atm that is the environment I am in. Some machines I have the root<br>
password to, some I don't, some I have to ssh 127.0.0.1 as root. My<br>
PDE I have to wait a bit to get root access, for my job its ironic, I<br>
have to use my work computer to do it, vs my govt provided one.<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
On 5/21/12, Jim Kinney <<a href="mailto:jim.kinney@gmail.com">jim.kinney@gmail.com</a>> wrote:<br>
> In a multi-admin server environment, selinux and auditd can fully track who<br>
> did what. Each admin logs in remotely and then can su to root, do their<br>
> work and log out. Even though they can use su - to fully change to the root<br>
> user with full environment, auditd tracks every command issued with both<br>
> effective ID and original ID. So root from Fred is different from root from<br>
> Sally.<br>
><br>
> The addition of rootsh to the system as the only shell for root will<br>
> provide a full log of keyboard entry and return data. That log can be on a<br>
> remote machine.<br>
><br>
> On Mon, May 21, 2012 at 3:01 AM, Brian Mathis <<br>
> <a href="mailto:brian.mathis%2Bale@betteradmin.com">brian.mathis+ale@betteradmin.com</a>> wrote:<br>
><br>
>> By "desktop" I mean a computer that sits on your desk either at home<br>
>> or work, as opposed to servers that run in a data center. I think<br>
>> most people who don't see the difference between using 'su' vs 'sudo'<br>
>> think that way because they are only playing with Linux on their home<br>
>> desktop so it doesn't really matter. However, in a server environment<br>
>> where you need to manage resources, it does.<br>
>><br>
>> I don't think anyone is using "desktop" to refer to using a GUI<br>
>> instead of a shell prompt; at least that doesn't make sense in the<br>
>> context of this discussion.<br>
>><br>
>><br>
>> <span style="font-family:"MS Mincho"">❧</span> Brian Mathis<br>
>><br>
>><br>
>> On Mon, May 21, 2012 at 2:48 AM, Matthew <<a href="mailto:simontek@gmail.com">simontek@gmail.com</a>> wrote:<br>
>> > I don't usually work in a desktop environment. Even though our project<br>
>> > is using kde, I still do everything from command line.<br>
>> ><br>
>> > On 5/21/12, Brian Mathis <<a href="mailto:brian.mathis%2Bale@betteradmin.com">brian.mathis+ale@betteradmin.com</a>> wrote:<br>
>> >> There is an ENORMOUS difference between using "su" and "sudo -i", and<br>
>> >> it's big enough that any old codgers out there should learn this new<br>
>> >> trick:<br>
>> >><br>
>> >> To use 'su' you need the ROOT password.<br>
>> >> To use 'sudo', you need YOUR password.<br>
>> >><br>
>> >> In any environment outside of your personal desktop, this is a huge<br>
>> >> difference. Securely distributing the root password to any number of<br>
>> >> sysadmins, keeping track of who has it, and changing it every time<br>
>> >> someone leaves (and redistributing the changed password) is a<br>
>> >> nightmare, and it also violates most accepted rules of good security<br>
>> >> (using shared passwords).<br>
>> >><br>
>> >> If you grant root access through sudo, even if admins use 'sudo -i',<br>
>> >> you only need to manage the sudoers file and you can forget about the<br>
>> >> root password issue. You still need to keep track of the root<br>
>> >> password, but now you can set it to some long random string and keep<br>
>> >> it locked in a safe somewhere. You also get an audit trail of who's<br>
>> >> logging in and switching to root, even if you don't get a full audit<br>
>> >> of every command they run.<br>
>> >><br>
>> >><br>
>> >> <span style="font-family:"MS Mincho"">❧</span> Brian Mathis<br>
>> >><br>
>> >><br>
>> >> On Sun, May 20, 2012 at 9:30 PM, matt <<a href="mailto:ur.matt@gmail.com">ur.matt@gmail.com</a>> wrote:<br>
>> >>> Why not just log in as root and stomp around if you're going to use<br>
>> sudo<br>
>> >>> -i?<br>
>> >>><br>
>> >>> On Sun, May 20, 2012 at 6:27 PM, matt <<a href="mailto:ur.matt@gmail.com">ur.matt@gmail.com</a>> wrote:<br>
>> >>>> sudo -i is definitely bad practice, it completely negates the<br>
>> >>>> purpose<br>
>> of<br>
>> >>>> using sudo in the first place.<br>
>> >>>><br>
>> >>>> On Sun, May 20, 2012 at 6:19 PM, Brian Stanaland<br>
>> >>>> <<a href="mailto:brian@stanaland.org">brian@stanaland.org</a><br>
>> ><br>
>> >>>> wrote:<br>
>> >>>>> I use 'sudo su -' which gets you the complete root experience.<br>
>> >>>>><br>
>> >>>>> -- Brian<br>
>> >>>>><br>
>> >>>>> On Sun, May 20, 2012 at 9:10 PM, Mike Harrison <<a href="mailto:cluon@geeklabs.com">cluon@geeklabs.com</a>><br>
>> >>>>> wrote:<br>
>> >>>>>><br>
>> >>>>>> On Sun, 20 May 2012, Jim Lynch wrote:<br>
>> >>>>>> > If that's current thinking, then it's changed. I've been<br>
>> >>>>>> > administrating<br>
>> >>>>>> > Unix systems for about 25 years. Sudo didn't exist and you<br>
>> needed to<br>
>> >>>>>> > su<br>
>> >>>>>> > in order to do admin tasks. It was accepted and expected. You<br>
>> >>>>>> > couldn't<br>
>> >>>>>> > install SunOS, HPUX, UNICOS or Irix without it. I'm afraid this<br>
>> old<br>
>> >>>>>> > dog<br>
>> >>>>>> > isn't learning new tricks, I use sudo -s or sudo -i on a regular<br>
>> >>>>>> > basis<br>
>> >>>>>> > when I don't have su enabled.<br>
>> >>>>>><br>
>> >>>>>> I use sudo -s on my desktop when I need to do root things. Saves a<br>
>> lot<br>
>> >>>>>> of<br>
>> >>>>>> time and typing over "sudo foo" for every command. On a desktop,<br>
>> normal<br>
>> >>>>>> user system.. it seems to be the "right way". Be a user for user<br>
>> >>>>>> things,<br>
>> >>>>>> become almost root for doing admin stuff on my box.<br>
>> >>>>>><br>
>> >>>>>> On a server.. there is only root for most sysadmin tasks. I've<br>
>> >>>>>> only<br>
>> >>>>>> been<br>
>> >>>>>> running Linux since 94.. but have also worked on DG Nova's, SCO<br>
>> unix,<br>
>> >>>>>> Slowlaris, etc.. but it seems to be the right way to admin a<br>
>> >>>>>> server.<br>
>> >>>>>> If you can't handle SSHing in/logging in as root.. you should not<br>
>> be.<br>
>> >>>> --<br>
>> >>>> Matt Urbanski | <a href="http://iflowfor8hours.info" target="_blank">iflowfor8hours.info</a> | @iflowfor8hours<br>
>> >>> --<br>
>> >>> Matt Urbanski | <a href="http://iflowfor8hours.info" target="_blank">iflowfor8hours.info</a> | @iflowfor8hours<br>
>> >><br>
>> >> </p>
</div>
</div>
</div>
</div>
<p></p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"> </p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"> </p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"></p>
<div class="WordSection1">
<div>
<div>
<div>
<p class="MsoNormal">_______________________________________________<br>
>> >> Ale mailing list<br>
>> >> <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
>> >> <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
>> >> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>> >> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
>> >><br>
>> ><br>
>> > --<br>
>> > Sent from my mobile device<br>
>> ><br>
>> > SimonTek<br>
>> > <a href="tel:912-398-6704">912-398-6704</a><br>
>> ><br>
>> > _______________________________________________<br>
>> > Ale mailing list<br>
>> > <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
>> > <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
>> > See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>> > <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
>><br>
>> _______________________________________________<br>
>> Ale mailing list<br>
>> <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
>> <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
>> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
>><br>
><br>
><br>
><br>
> --<br>
> --<br>
> James P. Kinney III<br>
><br>
> As long as the general population is passive, apathetic, diverted to<br>
> consumerism or hatred of the vulnerable, then the powerful can do as they<br>
> please, and those who survive will be left to contemplate the outcome.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">> - *2011 Noam Chomsky<br>
><br>
> <a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">> *<br>
><br>
<br>
--<br>
Sent from my mobile device<br>
<br>
SimonTek<br>
<a href="tel:912-398-6704">912-398-6704</a><br>
<br>
_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br clear="all">
Our general practice is to use sudo and do a few things under the timer. There are install sessions that require changing to user env of 3 different users, all essentially system users, to whose accts, I have the passwords, but it is far quicker to sudo su
- or sudo -i and then su - into the other two accts from root, which requires no password to get into the accounts. The system user passwords, and also the system root user passwords can then be different from machine to machine, and my work is not slowed
down while I get the notebooks with all passwords to search for this or that machine and user.<br>
Those notebooks would be the holy skeleton keys for the entire network (and a huge security vulnerability), but are in a safe buried under 20 feet of concrete, as all any of the admins have to have is their own password to do any of the admin tasks they are
permitted to do on any of the machines.<br>
Sudo can be very granular, allowing some but not all admin tasks. This isn't all that apparent for new users of Ubuntu (which has root login disabled by default in the gui Runlevel 5 login screen (GDM)).<br>
<br>
-Wolf<br>
<br>
PS In the most recent Ubuntu release, the automated update-manager behaviour is to allow updates and safe-upgrades without a password entry, but you still need a password to run aptitude or the Ubuntu software center application.<br>
<br>
-- <br>
This Apt Has Super Cow Powers - <a href="http://sourcefreedom.com" target="_blank">
http://sourcefreedom.com</a><br>
Open-Source Software in Libraries - <a href="http://FOSS4Lib.org" target="_blank">
http://FOSS4Lib.org</a><br>
Advancing Libraries Together - <a href="http://LYRASIS.org" target="_blank">http://LYRASIS.org</a><br>
Apache Open Office Developer <a href="mailto:wolfhalton@apache.org" target="_blank">
wolfhalton@apache.org</a><o:p></o:p></p>
</div>
<p></p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"><font face="Arial"><font color="fuchsia"><font style="FONT-FAMILY: Arial; FONT-SIZE: 10pt" size="2"></font></font></font> </p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"> </p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"><font face="Arial"><font color="fuchsia"><font style="FONT-FAMILY: Arial; FONT-SIZE: 10pt" size="2">Athena<font size="1">®</font>, Created for the Cause</font><font size="1">™
</font></font></font></p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"><font size="2" face="Arial">Making a Difference in the Fight Against Breast Cancer</font></p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"><font size="2" face="Arial"></font> </p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"><font size="2" face="Arial"></font> </p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"><font face="Arial"><font size="2"><strong>How and Why I Should Support Bottled Water!<br>
</strong>Do not relinquish your right to choose bottled water as a healthy alternative to beverages that contain sugar, calories, etc. Your support of bottled water will make a difference! Your signatures count! Go to
<a href="http://www.bottledwatermatters.org/luv-bottledwater-iframe/dswaters">http://www.bottledwatermatters.org/luv-bottledwater-iframe/dswaters</a> and sign a petition to support your right to always choose bottled water. Help fight federal and state issues,
such as bottle deposits (or taxes) and organizations that want to ban the sale of bottled water. Support community curbside recycling programs. Support bottled water as a healthy way to maintain proper hydration. Our goal is 50,000 signatures. Share this petition
with your friends and family today!</font></font></p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"><font size="2" face="Arial"></font> </p>
<p class="3612670b-8da0-4d42-925a-3a891dad0e5d"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">---------------------------------<br>
CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information
is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.<br>
----------------------------------</span><span style="FONT-FAMILY: 'Courier New'; FONT-SIZE: 9pt"><o:p></o:p></span></p>
<p> </p>
<p></p>
<p></p>
</body>
</html>