Date: Fri, 26 Mar 1999 11:34:47 -0500 (EST) From: Thomas Valentino Crimi <tcrimi+@andrew.cmu.edu> To: Matthew Dillon <dillon@apollo.backplane.com>, Narvi <narvi@haldjas.folklore.ee> Cc: James Wyatt <jwyatt@RWSystems.net>, freebsd-security@FreeBSD.ORG Subject: Re: Kerberos vs SSH Message-ID: <kqyvQbS00Uw=06Taw0@andrew.cmu.edu> In-Reply-To: <Pine.BSF.3.96.990326125814.5291B-100000@haldjas.folklore.ee> References: <Pine.BSF.3.96.990326125814.5291B-100000@haldjas.folklore.ee>
next in thread | previous in thread | raw e-mail | index | archive | help
Excerpts from FreeBSD-Security: 26-Mar-99 Re: Kerberos vs SSH by Narvi@haldjas.folklore.e > And if you are virtually giving the person having sudo capabilities full > root, why not just give them root? Or not give them root, managing the > resources differently (even if with setuid/and or setgid programs) and > avoid sudo? There most definitely is a place for sudo, but it is more of a convienence program than a security tool. Basic rule applies that if you don't trust the person with root, don't give them sudo access. If I were to say, add enough protections to a program so that it can safely run as root by any user, I'd may as well make it suid. All sudo really does it make suid executable available to a closed list of people, yes, I could do it with separate files, but sudo is convienent (and doing it the other way doesn't buy me anymore security from what I can tell, suid vi is just as dangerous as sudo vi). But, if I have a local user at a workstation who would like the ability to say, kill runaway programs, mount a disk, reboot the machine so as to flip OSes, sudo is very convienent. By letting the user in front of the machine I already must implicitly trust them not to be malicious, with minimal skill, or even with a screwdriver or hammer, they have control of the machine. sudo can help you avoid the honest mistakes. Everyone has different situations, and I could hardly advise an ISP to make extensive use of sudo, arguments about how to maintain a large number of people with the root password turn into 'you shouldn't have that many people with root', If you do want to have 5+ people with root, I think sudo is a good answer, you can even use the access control list to give people _advice_ on what they should and shouldn't run (vipw, ok, rm, ok, but it's not your job to reboot - just an example), no use thinking the list will curtail a runaway disgruntled sysadmin, but then again, what does? :) As stated many time, we all have different security situations, and in my loose group of machine, sudo makes sense, barring any buffer overruns or other exploits of sudo, it works perfectly well at letting friends who also use the machines do what they need. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?kqyvQbS00Uw=06Taw0>