UNIX for Dummies Questions & Answers

Hi Expert,

I have 2 questions.

Scenario: Users login via ssh from other location, using putty. or any other equivalent ssh tunnel. All users has been assigned as sudoers due to testing environment.

1. How to disable sudoers from editing /etc/sudoers

e.g

Code:

[admin@testserver~]$ sudo vi /etc/sudoers

2. How to disable sudoers changing root password?

e.g

Code:

[admin@testserver~]$ sudo passwd root

Your assistance in this matter is very much appreciated. Thank you.

what id is sudo then? if it's root, forget it.

else:

make /etc/ directory permissions 1755
make /etc/sudoers owned by someone else and make the perms 444.

btw -- test environment or not . . . i don't think you should ever allow
unqualified testers shells access as root. i mean, that's just asking for trouble.

no matter what rules you apply to prevent either of your desired options will result in circumvention. sudo bash gives them root access and then they can do what they want. If you want to achieve RBAC with sudo you HAVE to isolate users from root such that they are in a wheel group with explicit commands that may not impact privilege escalation on the system.