Date: Thu, 21 Jul 2005 15:44:50 -0400 From: asym <bsdlists@rfnj.org> To: Stephen Major <smajor@gmail.com>, <freebsd-security@freebsd.org> Subject: Re: FW: FW: FW: Adding OpenBSD sudo to the FreeBSD base system? Message-ID: <6.2.1.2.2.20050721153814.0390a3d8@mail.rfnj.org> In-Reply-To: <42dff45e.41539ce0.3dab.1a53@mx.gmail.com> References: <42dff45e.41539ce0.3dab.1a53@mx.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
At 15:15 7/21/2005, Stephen Major wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA512 > >http://www.freshports.org/security/sudo/ > > >there it is in the ports tree do your research before saying that my claim >is baseless The claim that you'd have to do any configuring at all is "baseless." >And stop before you come back with saying you have to configure it. >Because that is exactly my point I do not have to configure anything to use >su. > >And no you could not make sudo "out of the box" ready, for everyone's >application. Otherwise the default configs would already be that way when >you installed it from ports. Try logic here rather than just spouting the first thing that comes to mind. It can be duplicated. Exactly. The port contains the following line in the default sudoers(5) file: # %wheel ALL = (ALL) ALL All you need to do is uncomment that and viola, you have default su behavior -- anyone in the wheel group allowed to sudo as any other user. The only difference is it asks for their password instead of the root password, which is how sudo works, the entire point some (including myself) might say. >I only want 2 users on my system to be in the wheel group and su to full >root. > >But the next guy might want sudo and be able to give limited access to to >several "sub-admins" Perhaps, but guess what? sudo gives that opportunity, su does not. Coupled with the fact that sudo can be configured (and should be by default, if in the base system) to allow wheel to function as it does for su, and I say again: your concerns in this regard are entirely baseless. >- From my perspective su is more secure than sudo in the fact that an idiot >admin cannot screw it up. Unless they set some dumb root password for >example: 1234admin There is no security against idiocy. If you make combine "idiot" and "admin" in your environment, and make an "idiot admin" shame on you, not shame on sudo.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6.2.1.2.2.20050721153814.0390a3d8>