Disable switching to root alternatives


 
Thread Tools Search this Thread
Operating Systems Linux Disable switching to root alternatives
# 1  
Old 01-17-2013
Disable switching to root alternatives

Hello!

Do anyone have idea how to block switching to root if user have full sudo?

One way is in sudoers file block use of "su", but still it`s possible with sudo -i or sudo -s , sudo bash etc.
Other way is create alias on sudoers and permit only specific commands for user.

Any ideas?
# 2  
Old 01-17-2013
From experience of this situation i would in every case advise to create a command alias for a user to only use sudo for those specific commands and add each command as necessary (obviously dont add commands like su,sh,bash,ksh,visudo,passwd). Much better to have a secure server than give full access to a user and firefight in response to his attempts at gaining root.
# 3  
Old 01-17-2013
Quote:
Originally Posted by jabalv
Do anyone have idea how to block switching to root if user have full sudo?
I don't quite get it: why does the user have "full sudo" (i assume this to mean he can use every command) if he should not be allowed to become root?

If you don't want someone to utilize "full sudo", then just don't give hime "full sudo". If you get into a situation where you have no other choice than to do that you probably have made a serious error in your rights concept long ago. I suggest you reconsider/redo this instead of patching your environment into something which "almost looks like working".

If you bake a cake and you have forgotten the backery improver, you probably end up with a thing of the consistency of a stone. To grind this thing down to powder, add water and the forgotten bakery improver and expecting this to bake to a (tasting) cake is similarly doomed to disenthrall your expectancies. The only way is to start over and do it right this time.

I hope this helps.

bakunin
# 4  
Old 01-17-2013
You cannot prevent root from being root.

If you don't want someone to abuse root, don't give them root.
# 5  
Old 01-17-2013
To control sudo you must edit the suders file. You can also control who can use sudo by only letting users in certain groups use sudo.
To edit sudo you run this command as root.
Code:
visudo

You will have to edit the file to give less rights to a user who can use sudo. Commonly in Linux the wheel group has access to sudo. If you don't want them to have sudo, remove them from the wheel group.
# 6  
Old 01-19-2013
Hi,

Thanks for answers.

Full sudo is for server administrators, but sometimes there are some people who don`t understand what they are doing or just making mistakes.
Also other thing is that, root activities are not logged, but sudo activities are logged under /var/log/secure. How to fight against it?
# 7  
Old 01-19-2013
Quote:
Originally Posted by jabalv
Full sudo is for server administrators, but sometimes there are some people who don`t understand what they are doing or just making mistakes.
These shouldn't be server administrators at all! Admins should only be a VERY FEW select people who have proven their skill, everything else is just plain dangerous.

Quote:
Originally Posted by jabalv
Also other thing is that, root activities are not logged, but sudo activities are logged under /var/log/secure. How to fight against it?
This is a no-brainer: start an interactive program as root which allows a shell escape and then do a shell escape - you have a root shell. For instance: "sudo vi", enter ":!sh" and you have a root shell. What one does inside this shell (and even that he opened the shell) is not seen at all in "/var/log/secure". Or one can trim the file after doing something, because root has write access to the log.

It is an old proverbial truth that root can circumvent absolutely any security mechanism as long as it is server-based. The only thing you can do is to log outside of the area of roots control: on another system, where root is not allowed to become root. See the man page of "syslog" for the possibility to do the logging over the network to a remote system.

I hope this helps.

bakunin
This User Gave Thanks to bakunin For This Post:
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Switching from root to normal user takes me to user's home dir

Whenever i switch from root to another user, by doing su - user, it takes me to home directory of user. This is very annoying as i want to be in same dir to run different commands as root sometimes and sometimes as normal user. How to fix this? (1 Reply)
Discussion started by: syncmaster
1 Replies

2. AIX

AIX Disable direct root login problems

I have disabled rlogin for root successfully , but after that i could not login to root from console and could not su to root from other users as it responded as expired account I did not have any admin user but I have managed to recover the situation by accessing rootvg before mounting it, but... (5 Replies)
Discussion started by: majd_ece
5 Replies

3. Red Hat

SSL/TLS renegotiation DoS -how to disable? Is it advisable to disable?

Hi all Expertise, I have following issue to solve, SSL / TLS Renegotiation DoS (low) 222.225.12.13 Ease of Exploitation Moderate Port 443/tcp Family Miscellaneous Following is the problem description:------------------ Description The remote service encrypts traffic using TLS / SSL and... (2 Replies)
Discussion started by: manalisharmabe
2 Replies

4. UNIX for Dummies Questions & Answers

How to disable root login (Not over SSH)?

I have already disabled root login over the ssh by modifying /etc/ssh/sshd_config. But how would i disable root login on a server itself. We have implemented LDAP in our environment and our security guide states that root login must be obtained by first logging into the host using his/her own... (2 Replies)
Discussion started by: pinga123
2 Replies

5. Linux

ssh - disable direct root login

Hi Guys.... I am a newbie to unix. I have a requirement. I have a server. I have to configure ssh to disable direct root login and then add a user with sudo access to this server.Then change the ssh port to 22315 and the server should permit the ssh only from my local machine ip.I also have to... (1 Reply)
Discussion started by: mahesh_raghu
1 Replies

6. UNIX for Dummies Questions & Answers

Disable root for AIX 5.2

I am able to disable direct root login through telnet. But when I add the rlogin = false into the /etc/security/user file. I am unable to log in as root from ssh. I uncommented the "PermitRootLogin yes" in the sshd_config file. Still can't log in. Can anyone help? (0 Replies)
Discussion started by: james0125
0 Replies

7. Solaris

Root account - disable expiry

I couldnt find this in any other post - so hoping someone can help out. I want to set password expiry (or rather I have to) for a number of users on my solaris 9 system. I know i can set the following options in the /etc/default/passwd file to do it and then just type a passwd -f <username> to... (6 Replies)
Discussion started by: frustrated1
6 Replies

8. Shell Programming and Scripting

switching user from root to ordinary user

Good day Guys!!! I am currently making a script in AIX, the script runs a SAS job, the owner of the script is the root, but the SAS jobs cannot be run by the root, as it should be run by a user 'sasia'. But inside the script, root creates a logfile, so what I need is just to su to sasia for the... (3 Replies)
Discussion started by: sasia
3 Replies

9. Shell Programming and Scripting

switching between root and a normal user

I am writing a script that has some tasks that must be run as root, then set of tasks to be run as normal user, then again as root. is there a way to switch between users in a script? any other alternatives? thx (3 Replies)
Discussion started by: melanie_pfefer
3 Replies

10. UNIX for Dummies Questions & Answers

Disable Root Console login

After Configuring a brand new netraT1, It appears, the only way you can log in as root is throught the Serial Port (console). I believe there is a file in /etc which can be edited to allow root to access login via other methods eg: telnet, ssh, etc. My Question: Which file contains... (2 Replies)
Discussion started by: SmartJuniorUnix
2 Replies
Login or Register to Ask a Question