My friend has found a bug with sudo.
His organization has Linux laptops with no root access to users. Policy pushing is through Puppet.
But doing
twice he is able to access root.
Do you guys have any clue, how's that possible, usually
is restricted.
Can you paste your /etc/sudoers file into the thread wrapped in [CODE] & [/CODE] tags please. It would be useful to know the Linux supplier and version and the sudo version:-
Is your friend's account a member of the admin group?
The group designation is usually preceded by a percent sign as in the way it appears with the admin group. The comment preceding the XXXXXX states that it's a group but it's missing the percent sign.
From this /etc/sudoers, either you have everything or nothing. If you can sudo sudo aaa, then you can just sudo aaa
To have any access, one must either be in the admin group or be the named user obscured by XXXXXX unless this is another group as the comment suggests. If you qualify under either, then you have full access. If you do not, you have no access.
As a simple test, I created a new user on a test server without any sudo rules and got the following:-
Is this the /etc/sudoers file that is being referenced by the user in question? As you can see, I'm not even allowed to read the file, as this could give an attacker a target.
XXXXX is the User ID which I have hidden for the sake of confidentiality, in sudoers it's not explicitly mentioned if it is a part of group or not(may be it done remotely through puppet).
But I tested it on RHEL machine by blocking
by adding
, and
worked in it also, so it accounts to a bug with sudoers, or blocking sudo will require some other alternative.
I have a coworker that has set up some funky aliases in /etc/bash.alias, and he insists on leaving them that way. For example he aliased "ll" to "ls -lahtr", which really bugs me.
Anyway, I was wondering if there were a way for me to sudo to root without reading /etc/bash.alias, or maybe have... (6 Replies)
Hello,
It is Solaris-10. There is a file as /opt/vpp/dom1.2/pdd/today_23. It is always generated by root, so owned by root only.
This file has to be deleted as part of application restart always and that is done by app_user and SA is always involved to do rm on that file.
Is it possible to give... (9 Replies)
i have tried to use a sudo command from a user level . but instead of asking for user password it asked for root password . how should i go about it .
james@opensuse:/etc> sudo ifconfig
root's password:
And i wish to ask how should i allow a list of command to be allowed to used for a... (4 Replies)
I have a set of RHEL 5 boxes running our ERP software on Oracle databases. I need to allow my DBA's to su to oracle and one other account (banner) without knowing the oracle or banner password. But I need to prevent them from su'ing to any other user especially root. I only want them to be able to... (1 Reply)
Anyone able to explain why if i run "sudo -i" or "sudo -s" i am able to get into root by just keying my own password?
How to avoid this from happening coz i need all the users to use su - only. (2 Replies)
I've been through many threads before i decide to create a separate thread.
I can't really find the solution to my (simple) problem.
Here's what I'm trying to achieve:
As "canar" user I want to run a command, let's say "/opt/ocaml/bin/ocaml" as "duck" user.
The only to achieve this is to... (1 Reply)
I'm actually working with a Ubuntu-System here and have a question about executing a command with 'sudo'.
I tried and got a error message like "not allowed".
After this I logged in with 'sudo -s' and typed the command without 'sudo'. This worked well.
Can please somebody explain me this... (0 Replies)
Guy's
I'm trying to add some lines in sudo by useing this command visudo
# User privilege specification
root ALL=(ALL) ALL
# Uncomment to allow people in group wheel to run all commands
# %wheel ALL=(ALL) ALL
# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
#... (5 Replies)
Hi all..
I'm secering a RH 2.1 server, with gnome (not my choice...), as X manager.
Is ther anyway to get sudo ask for root password other then the actual user's password? Like when you launch the graphical IHM to create a new user, it asks for root's password? Is there a way to do the same... (5 Replies)