Ubuntu

-i option in sudo acts similar to "su - username" or login. It changes the environment to that of the user in question. So the UID and EUID will be that of the user you are trying to sudo to (cbttest). To system it's as if cbttest has logged in and it lets you execute the passwd command. Dangerous but this is the fact!!

---------- Post updated at 02:33 PM ---------- Previous update was at 02:21 PM ----------

By the way, allowing all commands and restricting only passwd does not even get closer to secure your cbttest account. For an example, user can run "sudo -u cbttest vi" and then in vi, they can press ESC and execute "!/bin/sh" to get a shell which will run with cbttest's privileges.

My opinion is to allow execute permission on very limited commands which they really need. Restrict vi, etc. commands which can give shell escape.

Thanks Will Do.

---------- Post updated at 09:39 PM ---------- Previous update was at 03:07 PM ----------

Admin,

I have tried the way you want me to do.

My Sudoers file

Code:

# User privilege specification
root    ALL=(ALL:ALL) ALL

alex    ALL=(cbttest:sytgrp) ALL, !/bin/rm

[alex@ubuntu] "/home/alex/Desktop"
$ whoami
alex
[alex@ubuntu] "/home/alex/Desktop"
$ ls -ltr /home/cbttest/sample_file.log
-rw-rw-r--  1 cbttest sytgrp   41 Feb 25 08:33 sample_file.log
[alex@ubuntu] "/home/alex/Desktop"
$ sudo -u cbttest  rm /home/cbttest/sample_file.log
[sudo] password for alex: *******
[alex@ubuntu] "/home/alex/Desktop"
$ ls -ltr /home/cbttest/sample_file.log
ls: sample_file.log: No such file or directory

So the file got deleted... as per the sudoers file it should fail to delete... but it deleted...

can you please advice.

This is weird!
Can you post the sudoers file here? Just want to have a check why it's permitting such explicit denies.

In Ubuntu Linux, this log is located in /var/log/auth.log

may I add another question related to the thread title?

Is there a short and simple way to disable 'sudo' for connections created by 'ssh'?

The simplest way is to make them log in as a user which does not have SUDO access.

I started 'visudo' first time after reading this thread and read it.
To apply the includedir directive I've uncommented the last line.

what a surprise - 'visudo' tells me there is a syntax error in this line! How to enable the includes?

---------- Post updated 28-02-12 at 08:56 AM ---------- Previous update was 27-02-12 at 11:07 AM ----------

I think additionally it's good to deny execution of 'su'.

do you know of a list containing all usual commands installed with unix providing something like this (to block execution)?