UNIX for Dummies Questions & Answers

Often I see people offer complicated solutions and advice for problems that can be solved with simple solutions.

Simple solutions are mostly easier to maintain than complicated solutions.

I think you are doing that from the wrong end. Let us take a step back:

There are certain files which are pertinent to the proper operation of the system: operating system binaries, libraries, vital configuration files, ... To identify these seems like a lot of work, but the UNIX filesystem hierarchy, if properly used, will assist by concentrating these vital things into a few directories. Identify all these files/directories. "Normal" users should not have write access to any of these files/directories. Still, every user should be able to modify his own files/directories. Taking away access to "vi" seems like a good idea, but you take away the ability to even take a note with it - and you would have to take away a lot of other commands too, which can modify a file too: dd, cat, ed, ex, cp, paste, join, sort, echo, print, printf, sed, awk, ... this list is endless.

Instead of limiting the tools to modify files it is better to limit the access to the filesy themselves. As long as you are not allowed to modify fileX it doesn't matter if you try to do it with "vi" or any other tool.

Another aspect: you can limit the privilege to modify vital files to certain people but you can't make these behave more responsible by a security measure. In every scenario there will be at least one person who is allowed to wreak havoc on the system. The privilege to use comes always with the privilege to misuse - because the system cannot separate legit and illegitimate use of a resource at all. In a nutshell: you cannot prevent root from being root.

This is the reason why "Sysadmin" is a job usually done by a very small select group of people - specially trained and qualified for the job - and all the others are limited to a small part of the system. Still, even for these goes: if you can use something it is within your power to misuse it and if you are the admin for the "foo" software and can edit its config files you can perhaps misconfigure it in a way that it won't start, won't be accessible or won't work properly in some other respect.

I hope this helps.

bakunin

Something else worth bearing in mind - sudo root access to commands that provide built-in shell execution (like vim or less) is actually root access to everything.

.. and sudo has a log file so you can audit what users are doing...

Security is based on three types of controls... logical (technical), administrative (rules and policies) and physical controls; and it a combination of these three facets of security that create a security policy.

Example:

Normally, it is not cost effective nor prudent to only rely on logical controls.

It's kind of like (well, almost exactly like) your car. Your car can (maybe) drive up to speeds of 200 miles per hour, but the law says you can only drive 60 miles per hour (example). So, the control is administrative (not logical) and there are some physical controls as well; for example if you try to go around a curve at 200 miles per hour, you will fly off the road.

Computer security is based on three controls... logical, physical and administrative and there can be myriad combinations of these three control areas based on the risk profile to create an effective security policy.

In this thread, we have only discussed a few logical controls, we have not discussed administrative or physical controls and we have not examined the risk profile (vulnerability, threat, and criticality); these areas need to be examined before keying in on the right combination of controls.

Interesting approach. sudo complains if you edit its file by outside means however -- how does one avoid this?

I understood Neo's approach as what I used to do with my HP servers when passing from transactional (day) to batch mode (night) by swapping kernels..., that means having different configured sudoers you exchange depending of context...

I don't have any problems using vi to edit the sudoers file. You can create multiple copies , edit them, and user the root crontab to move the config file in and out as the security policy requires.

Crontab also warns against using vi directly, but that has not stopped me from vi'ing the crontab files directly for decades.