sudo problems
-
We want to move to using ssh certificates on our servers and remove all passwords.
We have a problem with sudo though - it requires a password and we don't want any passwords anywhere. And it feels insecure to simply remove the password requirement.
What are our options, except removing sudo altogether and require login from a privileged account?
-
@pete-s said in sudo problems:
We have a problem with sudo though - it requires a password and we don't want any passwords anywhere.
Sudo has no such requirement. We don't use it with passwords here.
-
@pete-s said in sudo problems:
We want to move to using ssh certificates on our servers and remove all passwords.
That's what we do.
-
@pete-s said in sudo problems:
And it feels insecure to simply remove the password requirement.
It's not really. It just feels that way.
-
@pete-s said in sudo problems:
What are our options, except removing sudo altogether and require login from a privileged account?
Anything that allows sudo is a privileged account. Sudo isn't an alternative to having separate accounts, it's meant as an additional protection on accounts that are already designated as privileged. Just like on Windows.
-
@scottalanmiller said in sudo problems:
@pete-s said in sudo problems:
What are our options, except removing sudo altogether and require login from a privileged account?
Anything that allows sudo is a privileged account. Sudo isn't an alternative to having separate accounts, it's meant as an additional protection on accounts that are already designated as privileged. Just like on Windows.
Traditionally sudo was written to allow regular users to run commands requiring root. I saw an interview with the guy who made it..
-
@pete-s said in sudo problems:
@scottalanmiller said in sudo problems:
@pete-s said in sudo problems:
What are our options, except removing sudo altogether and require login from a privileged account?
Anything that allows sudo is a privileged account. Sudo isn't an alternative to having separate accounts, it's meant as an additional protection on accounts that are already designated as privileged. Just like on Windows.
Traditionally sudo was written to allow regular users to run commands requiring root. I saw an interview with the guy who made it..
What the guy who made it says doesn't really apply, meaning what his goals were don't change what the product does. But he didn't say anything different, either. The phrase "Traditionally sudo was written to allow regular users to run commands requiring root." means that they are privileged users. Any user, with a mechanism to do what is described there, is by definition, privileged. That he described his goal as making a new way for them to be privileged doesn't even suggest that they are not.
You could say the same thing about su or any other tool that makes regular accounts into privileged ones.
-
@scottalanmiller said in sudo problems:
@pete-s said in sudo problems:
What are our options, except removing sudo altogether and require login from a privileged account?
Anything that allows sudo is a privileged account. Sudo isn't an alternative to having separate accounts, it's meant as an additional protection on accounts that are already designated as privileged. Just like on Windows.
So this is like an admin account that still trips over UAC, but doesn't require a password - just OK to continue?
-
The sudo mechanism is used to make privileged accounts safer. That's all. That's all that it can do, because any account with access to it is, by definition, already a privileged account. The privilege is the access to sudo. Sudo is a great tool that we use all the time because it truly makes privileged accounts dramatically safer than they were before. But it's one of those super dangerous things to start thinking that an account with sudo rights isn't privileged already, because it is.
-
@dashrender said in sudo problems:
@scottalanmiller said in sudo problems:
@pete-s said in sudo problems:
What are our options, except removing sudo altogether and require login from a privileged account?
Anything that allows sudo is a privileged account. Sudo isn't an alternative to having separate accounts, it's meant as an additional protection on accounts that are already designated as privileged. Just like on Windows.
So this is like an admin account that still trips over UAC, but doesn't require a password - just OK to continue?
Exactly! Windows copied it really closely.
-
I can prove the degree to which sudo exposes that it is allowing a privileged account to take an action compared to allowing access to a privileged account (which can be argued is the same thing, both are privileges, but sudo is more extreme of the original account being the privileged one.) Older tools, like su allow the user to move from using their own unprivileged account to using root (or something else) that is privileged. Sudo does not, sudo still acts as the original account which has been given admin level rights.
Here is how you can see it in action...
scott@ntg-scott-lnx-desk:/tmp$ sudo touch test1 scott@ntg-scott-lnx-desk:/tmp$ ll | grep test -rw-rw-r-- 1 scott scott 0 Jul 19 15:34 test0 -rw-rw-r-- 1 scott scott 0 Jul 19 15:34 test1Notice that when I made a file using sudo, it didn't make the file as root or any other account, the action was taken by the same account. Just in one case access to privileges was allowed and in the other case it was protected. But the account itself has the privileges in this case, just administered by the sudo mechanism.
-
@pete-s said in sudo problems:
And it feels insecure to simply remove the password requirement.
The beauty of cert based auth.
But really, any account that isn't allowed to sudo couldn't do it anyways. That sudo doesn't require a pw doesn't matter. Just like in Windows, if you don't have local admin privileges, UAC doesn't matter... unless you have the credentials of or access to an account that does.
-
@obsolesce said in sudo problems:
@pete-s said in sudo problems:
And it feels insecure to simply remove the password requirement.
The beauty of cert based auth.
But really, any account that isn't allowed to sudo couldn't do it anyways. That sudo doesn't require a pw doesn't matter. Just like in Windows, if you don't have local admin privileges, UAC doesn't matter... unless you have the credentials of or access to an account that does.
There IS an argument for sudo with password stopping a physical attack where someone watches you look away from the keyboard, then type while you are not looking. It's valid, but minor in most cases.
-
@scottalanmiller said in sudo problems:
@obsolesce said in sudo problems:
@pete-s said in sudo problems:
And it feels insecure to simply remove the password requirement.
The beauty of cert based auth.
But really, any account that isn't allowed to sudo couldn't do it anyways. That sudo doesn't require a pw doesn't matter. Just like in Windows, if you don't have local admin privileges, UAC doesn't matter... unless you have the credentials of or access to an account that does.
There IS an argument for sudo with password stopping a physical attack where someone watches you look away from the keyboard, then type while you are not looking. It's valid, but minor in most cases.
That's not sudo's responsibility or concern IMO. That's like the lock manufacturer for your front door wanting to keep people out after you already unlock the door and open it.
-
@obsolesce said in sudo problems:
@scottalanmiller said in sudo problems:
@obsolesce said in sudo problems:
@pete-s said in sudo problems:
And it feels insecure to simply remove the password requirement.
The beauty of cert based auth.
But really, any account that isn't allowed to sudo couldn't do it anyways. That sudo doesn't require a pw doesn't matter. Just like in Windows, if you don't have local admin privileges, UAC doesn't matter... unless you have the credentials of or access to an account that does.
There IS an argument for sudo with password stopping a physical attack where someone watches you look away from the keyboard, then type while you are not looking. It's valid, but minor in most cases.
That's not sudo's responsibility or concern IMO. That's like the lock manufacturer for your front door wanting to keep people out after you already unlock the door and open it.
It might not be its responsibility, but that is the top reason that people argue for its use.
-
Just have PAM verify the cert if you want the perceived second layer of auth.
-
@stacksofplates said in sudo problems:
Just have PAM verify the cert if you want the perceived second layer of auth.
Thanks, I had a look at that one before.
But then I had a look at this one as well:
https://engineering.fb.com/2016/09/12/security/scalable-and-secure-access-with-ssh/
Facebook uses shared accounts with ssh certificates. -
@scottalanmiller said in sudo problems:
The sudo mechanism is used to make privileged accounts safer. That's all. That's all that it can do, because any account with access to it is, by definition, already a privileged account. The privilege is the access to sudo. Sudo is a great tool that we use all the time because it truly makes privileged accounts dramatically safer than they were before. But it's one of those super dangerous things to start thinking that an account with sudo rights isn't privileged already, because it is.
Yeah, I like that. I think I've confused myself on what sudo actually does.
-
@pete-s said in sudo problems:
@scottalanmiller said in sudo problems:
The sudo mechanism is used to make privileged accounts safer. That's all. That's all that it can do, because any account with access to it is, by definition, already a privileged account. The privilege is the access to sudo. Sudo is a great tool that we use all the time because it truly makes privileged accounts dramatically safer than they were before. But it's one of those super dangerous things to start thinking that an account with sudo rights isn't privileged already, because it is.
Yeah, I like that. I think I've confused myself on what sudo actually does.
It's a great mechanism, don't get me wrong. I highly recommend it for most cases.
-
@pete-s said in sudo problems:
Facebook uses shared accounts with ssh certificates.
Actually quite common.
