Do I understand sudo correctly?

[Chris Hobbs]

Eric's solution was certainly clever - I didn't realize that you could be
that finegrained with the aliasing. As my student ID's all start with the
same three digit block, this could actually work for us. 

My problem is that there are several tasks that must be done for a new
student, and three for just changing a password (passwd, smbpasswd, remake
the NIS maps). My concern is that if I don't make it relatively easy for
the teachers to do this, they'll screw it up :-)

I guess my question is, on what basis do people feel that scripts are
inherently more dangerous than other programs? Is it because they're
usually just quick hacks where security is an afterthought at best? It
seems this doesn't _have_ to be an issue with a well thought out script.
Logging can be done from within the script as well - Matthew had a good
point there.

I certainly don't mean to call out Eric, who brought up this issue. I had a
long discussion on IRC the other night about this as well, and I'm afraid I
just don't understand the fear. 

Chris

Matthew Hannigan wrote:
> 
> Chris,
> 
> I agree with Eric.   Not only is easier to secure, the logs
> are more precise.
> 
> If you can't use the patterns as Eric suggested, then write
> a minimal wrapper that just makes sure that the uid is not
> root or bin say, or that the UID is in a particular range.
> (e.g. greater than 100).  These wrappers should have a
> 1-1 correspondence to the real programs.
> 
> Regards,
>         -Matt
> 
> eric_forgette at vapower.com on 22/02/2000 21:27:00
> To:     Chris_Hobbs%chobbs%silvervalley.k12.ca.us%SMTP at vapower.com
> cc:     sudo-users at courtesan.com (bcc: Matthew Hannigan/NL/ABNAMRO/NL)
> Subject:        Re: Do I understand sudo correctly?
> 
> Hey Chris.
>      I don't suggest ever giving someone super user access to run a
> script, too
> big of a security hole.
> If you get creative with the students' user names, you wont need a a
> script.  If
> you start your student's user names with stud, you could allow your
> teachers to
> use the following alias:
> 
> Cmnd_Alias      UNIXPASS=/usr/bin/passwd stud????
> Cmnd_Alias      SAMBAPASS=/usr/bin/smbpasswd stud????
> 
> They could then do...
> 
> sudo passwd studmary
 
--
Chris Hobbs       Silver Valley Unified School District
Head geek:              Technology Services Coordinator
webmaster:    http://www.silvervalley.k12.ca.us/chobbs/
postmaster:               chobbs at silvervalley.k12.ca.us
-------------------------------------------------------
PGP Key is available:
    http://www.silvervalley.k12.ca.us/chobbs/pubkey.txt