Objections to sudo
mlh at zip.com.au
Thu Feb 7 16:54:20 EST 2002
Patricia.Naparsteck at kemperinsurance.com wrote:
> Some systems engineers have objected that sudo "may not be flexible enough
> " because each command would need to be wrapped.
> How would you respond to this objection? What's a not so painful way of
> creating the sudoers file?
I think that that has some truth to it. To make
a command truly secure, it is often not enough
to just put it in the sudoers file. You have to make
a wrapper. And for a system engineer or sysadmin to
their job, you would have to wrap or add just about
every command on the machine.
Still sudo can be useful. If you just used sudo instead
of su it would provide a log and it would mean you
don't have to share the root password. This can
mean that removing some as an admin can be done
very quickly and painlessly by removing them from
the sudoers. (Compared to changing the root password
and informing everyone but them of the new one.)
Not entirely secure of course, but combine it with
secure logging (so you have a record of who was root and
when) and a file integrity program (so that things like sudo
itself are not compromised) and you have a far better system
than everyone knowing the root password.
More information about the sudo-users