LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Changing Root and Sudo pass (https://www.linuxquestions.org/questions/linux-newbie-8/changing-root-and-sudo-pass-4175590536/)

linux4evr5581 10-01-2016 01:21 AM
Changing Root and Sudo pass
 
Might be a dumb question but is making the root password different from sudo password a good idea? I read that sudo obfuscates the root's password, so Idk if changing the root pass would interfer with that, or reduce security.. Also how would I know which setuid programs query other setuid programs in order to complete it's operation, is it hinted or referenced somewhere in the man pages? And would the targetpw flag in visudo negate the need for querying passwd? Thank you in advance!!

lazydog 10-01-2016 01:46 AM
The sudo password is that of the user invoking the sudo command so it should not be the root password. In other words if user1 is issuing a command with sudo then user1 would use his/her password not root's. That is the purpose of sudo, so a normal user can execute a command as root without being root and no need to know the root password.

linux4evr5581 10-01-2016 02:11 AM
Thanks for the reply but why then on Ubuntu does the first user that's created with the installation use the default password (pass you setup during installation) for both sudo and root.. Of course I know that other users should not use the root password for their sudo, but for the admin is it ok? I guess it should be since it does this by default, but would changing either the sudo or root pass so that their not the same make it more secure?

Jjanel 10-01-2016 02:31 AM
There's no such thing as a 'sudo password' (as far as I-newbie-too know)!
It is *the user's*, different for each user. (like a website verifying YOUR pwd [to edit profile])
From this (#7) it looks like Ubuntu doesn't ask for a root password!
Strange...other 'distro's do. Can someone explain (what's Ubuntu's *root* password?)
Oh: it's "locked", so *su* (not meaning sudo) &login as root won't work.
Apparently, it's possible to: sudo passwd root (to give root a password you choose)

Turbocapitalist 10-01-2016 03:01 AM
The general idea behind using "sudo" is that of least privilege. Accounts should have just enough access to get their jobs done, no more, no less. The way many distros apply "sudo" doesn't make that obvious because they just open the system wide open by default instead of providing a demo of the granularity available in "sudo"

I have no influence on the direction Ubuntu and Linux Mint take but if I were setting the defaults for /etc/sudoers, I would propose something like this for the initial default:

Code:
%sudo ALL=(root:root) /usr/sbin/visudo ""
However, to have mercy on beginners, it would also have to include something like the following or the graphical equivalent:

Code:
%sudo ALL=(root:root) /usr/bin/apt-get
Those two lines would make users in the group "sudo" able to install or remove packages as well as customize "sudo".

There's more, but "sudo" is surprisingly advanced. Michael W Lucas covers it in his presentation sudo : you're doing it wrong and in his fairly concise book, sudo Mastery. Those two resources can be skimmed quickly to find the parts interesting for you, then you can dig deeper in the manual page for sudoers

Code:
man sudoers

linux4evr5581 10-01-2016 03:11 AM
OK ok mybad I remember sudo is just a group and by default the first user would be in that group (but why if their already in the admin group?) and then you enter your own user password.. And I meant Mint I apologize, but you can login to Ubuntu as root with sudo -i..

Turbocapitalist 10-01-2016 03:19 AM
Quote:
Originally Posted by linux4evr5581 (Post 5612320)
you can login to Ubuntu as root with sudo -i..
Yes, that's an example of it being a bit too loose and not showing what it can do.

For that reason, it is a good idea for Ubuntu users to always make a second account and use that second account for daily activities, leaving the first account only for when administration is necessary. Same for Linux Mint and others that have the same defaults.

linux4evr5581 10-01-2016 03:19 AM
Quote:
Originally Posted by Turbocapitalist (Post 5612317)
The general idea behind using "sudo" is that of least privilege. Accounts should have just enough access to get their jobs done, no more, no less. The way many distros apply "sudo" doesn't make that obvious because they just open the system wide open by default instead of providing a demo of the granularity available in "sudo"

I have no influence on the direction Ubuntu and Linux Mint take but if I were setting the defaults for /etc/sudoers, I would propose something like this for the initial default:

Code:
%sudo ALL=(root:root) /usr/sbin/visudo ""
However, to have mercy on beginners, it would also have to include something like the following or the graphical equivalent:

Code:
%sudo ALL=(root:root) /usr/bin/apt-get
Those two lines would make users in the group "sudo" able to install or remove packages as well as customize "sudo".

There's more, but "sudo" is surprisingly advanced. Michael W Lucas covers it in his presentation sudo : you're doing it wrong and in his fairly concise book, sudo Mastery. Those two resources can be skimmed quickly to find the parts interesting for you, then you can dig deeper in the manual page for sudoers

Code:
man sudoers
Thanks for the tips I might use that policy!

linux4evr5581 10-01-2016 03:24 AM
Quote:
Originally Posted by Turbocapitalist (Post 5612322)
Yes, that's an example of it being a bit too loose and not showing what it can do.

For that reason, it is a good idea for Ubuntu users to always make a second account and use that second account for daily activities, leaving the first account only for when administration is necessary. Same for Linux Mint and others that have the same defaults.
Good to know I was just missing/forgot a few fine points about sudo that you,lazydog, and jjanel mentioned (haven't messed with it in awhile) anyways thanks again

Habitual 10-01-2016 04:58 AM
Sudo: you're doing it wrong.
https://help.ubuntu.com/community/RootSudo
https://wiki.debian.org/sudo
https://wiki.archlinux.org/index.php/Sudo

Every distro ships with sudo?

BW-userx 10-01-2016 01:36 PM
Quote:
Originally Posted by linux4evr5581 (Post 5612310)
Thanks for the reply but why then on Ubuntu does the first user that's created with the installation use the default password (pass you setup during installation) for both sudo and root.. Of course I know that other users should not use the root password for their sudo, but for the admin is it ok? I guess it should be since it does this by default, but would changing either the sudo or root pass so that their not the same make it more secure?
you do not get a root in ubuntututututu they think they know best for everyone .. so they deveate LINUX/GNU ~ UNIX Norms ...

linux4evr5581 10-01-2016 02:16 PM
I think with Debian you have to install it, unless they changed it..

linux4evr5581 10-01-2016 02:17 PM
Quote:
Originally Posted by BW-userx (Post 5612495)
you do not get a root in ubuntututututu they think they know best for everyone .. so they deveate LINUX/GNU ~ UNIX Norms ...
I'm assuming that's why theres quite a few variations of it..

BW-userx 10-01-2016 03:01 PM
Quote:
Originally Posted by linux4evr5581 (Post 5612515)
I'm assuming that's why theres quite a few variations of it..
personaly I think they are trying to mimic Windows a close as possiable without being called a sell out to windows to get more people leaving Windows to use there version then the other ones that are actually more not windows. it is an evil conspiracy plot I TELL YA!!! :doh: from what I've lightly read windows is now trying to widdle its way into the linux world. be carefull they put netscape out of busness by thier pratices of trying to make the windows os a completely internet aware OS, you could actually use the fielmanager to get to in internet instead of their crapy web browser that always crashes and still does, that what I did, anyways, that made too many secritiy leaks so they had to pull back a little, but it was their long enough to put netscape out of bussness.

linux4evr5581 10-01-2016 03:18 PM
Interesting stuff indeed, but I think it would just make people more Linux/GNU aware, and would inspire trying out different distros as a result. But idk everyone seems so content with Mac and Windows regardless..

BW-userx 10-01-2016 03:32 PM
Quote:
Originally Posted by linux4evr5581 (Post 5612525)
Interesting stuff indeed, but I think it would just make people more Linux/GNU aware, and would inspire trying out different distros as a result. But idk everyone seems so content with Mac and Windows regardless..
they're the real slackers ... lol plus the general majority write software for them OS's. they get more support because of the ease of revenue, my option but I think its a good one ..

linux4evr5581 10-01-2016 03:39 PM
Yup, that's just the way it is :/

lazydog 10-02-2016 01:11 AM
Here is another thing about sudo. If you do not want your users to ever become root you need to lock sudo so they cannot sudo into a shell. Reason being is once issuing the command (bash in this example) sudo bash they become root. Sudo is very powerful is used correctly and very dangerous if used incorrectly.

linux4evr5581 10-02-2016 05:45 AM
Quote:
Originally Posted by lazydog (Post 5612639)
Here is another thing about sudo. If you do not want your users to ever become root you need to lock sudo so they cannot sudo into a shell. Reason being is once issuing the command (bash in this example) sudo bash they become root. Sudo is very powerful is used correctly and very dangerous if used incorrectly.
Do you mean lock down sudo? Cus im trying to do that already, like i'm tring to figure out what commands require root priviledges. I know networking commands and commands in /sbin do.. I also want to block commands that dont need root but that still may be a risk for users to use...And im looking into what defualt file permissions are risks, and which ones I can change without hampering the system. I was going to study Damn Vulnerable Linux but I guess their not there anymore?

Turbocapitalist 10-02-2016 05:55 AM
Quote:
Originally Posted by linux4evr5581 (Post 5612686)
Do you mean lock down sudo? Cus im already trying to do that, like i'm tring to figure out what commands require root priviledges.
The only way to lock it down is to whitelist that which you want to allow for the accounts other than the admin account and to not use the admin account except when you need to whitelist specific tasks. Again, I'd recommend the "sudo" resources mentioned above, either the book or the presentation. MWL did a video of the presentation and it can be found under the same name "sudo: you're doing it wrong" on Youtube, and maybe some other places. The book is worth getting, even though it's not long.

linux4evr5581 10-02-2016 06:30 AM
I was aware sudoers had a whitelist in env_keep and env_check but I dont know how to edit that.. I'll look into those resources you mentioned thank you.

BW-userx 10-02-2016 01:07 PM
Quote:
Originally Posted by linux4evr5581 (Post 5612686)
Do you mean lock down sudo? Cus im trying to do that already, like i'm tring to figure out what commands require root priviledges. I know networking commands and commands in /sbin do.. I also want to block commands that dont need root but that still may be a risk for users to use...And im looking into what defualt file permissions are risks, and which ones I can change without hampering the system. I was going to study Damn Vulnerable Linux but I guess their not there anymore?
form my understanding anything on the system side you got a have root preiveges, if you're assigned to a group with said provages well then what does that tell ya?

so the question to that person would then be, how do you lock down a sudo file when the only one allowed to edit it is them that have been given either the root password ot sudo rights. even then within the sudoers file you can limit what a sudo user can do. so all ya got a do is take away, that right to edit the sudo file.

ok I just created a user jumped into that user and did
Code:
sudo bash
and this is what I got.
Code:
[shithead@voided ~]$ sudo bash
Password:
shithead is not in the sudoers file.  This incident will be reported.
so I am still not understanding what he is talking about if someone issues a command sudo bash becacuse I have not given this user any rights whatsoever other then the basic user rights it deafults to.

so what ya mean LOCK DOWN the sudoers file? sounds like a ruse to me.

linux4evr5581 10-02-2016 05:33 PM
Quote:
Originally Posted by BW-userx (Post 5612815)
form my understanding anything on the system side you got a have root preiveges, if you're assigned to a group with said provages well then what does that tell ya?

so the question to that person would then be, how do you lock down a sudo file when the only one allowed to edit it is them that have been given either the root password ot sudo rights. even then within the sudoers file you can limit what a sudo user can do. so all ya got a do is take away, that right to edit the sudo file.

ok I just created a user jumped into that user and did
Code:
sudo bash
and this is what I got.
Code:
[shithead@voided ~]$ sudo bash
Password:
shithead is not in the sudoers file.  This incident will be reported.
so I am still not understanding what he is talking about if someone issues a command sudo bash becacuse I have not given this user any rights whatsoever other then the basic user rights it deafults to.

so what ya mean LOCK DOWN the sudoers file? sounds like a ruse to me.
Well with preventing a user from going into a shell i'm pretty sure all you do is put an ! after their name in /etc/shadow file...But in the case of locking down sudo isnt that relevent when you're an administrator and you have users who need sudo. Wouldnt that be the exception? Unless the better option which I learned from MWL (havent watched the whole vid yet) is just not to use sudo, but instead use groups who have a specific role. Unless you wanted to write policies for every sudo user. Not sure what would be more secure...

Turbocapitalist 10-02-2016 10:22 PM
Quote:
Originally Posted by linux4evr5581 (Post 5612906)
Well with preventing a user from going into a shell i'm pretty sure all you do is put an ! after their name in /etc/shadow file...
There are still plenty of ways around that. Whitelisting is not where you make a list of programs which the account is not allowed to run. That is blacklisting and does not work. Whitelisting is where the allowed actions are listed one by one. An example follows below.

Quote:
Originally Posted by linux4evr5581 (Post 5612906)
But in the case of locking down sudo isnt that relevent when you're an administrator and you have users who need sudo. Wouldnt that be the exception? Unless the better option which I learned from MWL (havent watched the whole vid yet) is just not to use sudo, but instead use groups who have a specific role. Unless you wanted to write policies for every sudo user. Not sure what would be more secure...
Yes. Where possible, using group privileges instead of sudo is a better option. So if you want access to a file or a directory, groups are the way to go. However, with services 'sudo' is necessary.

Locking down "sudo" means whitelisting actions. If you want someone to get root shell, you simply add them to a group that can do so. The following line does that and more for the group sudo:

Code:
%sudo  ALL=(ALL:ALL) ALL
Though once they have root shell, the 'and more' part is redundant. If your /etc/sudoers file has that line, don't add accounts to the group sudo. Make a new group for each set of tasks, and add accounts to those groups as needed.

Code:
%sudo ALL=(root:root) /usr/sbin/visudo ""
%admin ALL=(root:root) /usr/bin/apt-get
%webmasters ALL=(root:root) /usr/sbin/service apache2 start, /usr/sbin/service apache2 stop, \
            /usr/sbin/service apache2 restart, /usr/sbin/service apache2 status
So there, the accounts in sudo can run amok. The accounts in admin can install or remove programs from the official repository. Those in webmasters can start or stop the web server which, when combined with group write access to various files, is enough to administer the web server. Those in both groups can do either. If you need only to write web pages, then "sudo" is not needed and groups are enough.

However, even with the admin and webmasters examples above, there are probably ways around "apt-get" itself and maybe Apache via the configuration files. The former could certainly be more compartmentalized. However, "sudo" is a helper for people you already trust. If you don't trust them, they should not be working for you. And as far as intruders go, they've already gotten in too far and you missed detecting them in time.

lazydog 10-03-2016 02:17 PM
Quote:
Originally Posted by BW-userx (Post 5612815)
so I am still not understanding what he is talking about if someone issues a command sudo bash becacuse I have not given this user any rights whatsoever other then the basic user rights it deafults to.

so what ya mean LOCK DOWN the sudoers file? sounds like a ruse to me.
I am talking about users who already have SUDO rights. Some admins lock down what a user may do when they are given the user these special rights on the system but most do not. I am simply pointing out that you should lock them (the sudo user) out of launching any type of shell so they cannot elevate what commands they can run. Once they can run a shell with root privileges you no longer have them locked down and that user has all the same rights as root to do anything root can do including locking out root and all other users.

BW-userx 10-03-2016 02:26 PM
Quote:
Originally Posted by lazydog (Post 5613331)
I am talking about users who already have SUDO rights. Some admins lock down what a user may do when they are given the user these special rights on the system but most do not. I am simply pointing out that you should lock them (the sudo user) out of launching any type of shell so they cannot elevate what commands they can run. Once they can run a shell with root privileges you no longer have them locked down and that user has all the same rights as root to do anything root can do including locking out root and all other users.
doesn't that void out the reason they have the sudoers file able to modify it so that they can only do certin things? like someone else in here has been showing how to do?

lazydog 10-03-2016 02:40 PM
No void here. Just making people aware that not locking out execution of shells will still allow a user to gain more privileges then what they want them to have.

linux4evr5581 10-03-2016 03:07 PM
Quote:
Originally Posted by Turbocapitalist (Post 5612971)
There are still plenty of ways around that. Whitelisting is not where you make a list of programs which the account is not allowed to run. That is blacklisting and does not work. Whitelisting is where the allowed actions are listed one by one. An example follows below.



Yes. Where possible, using group privileges instead of sudo is a better option. So if you want access to a file or a directory, groups are the way to go. However, with services 'sudo' is necessary.

Locking down "sudo" means whitelisting actions. If you want someone to get root shell, you simply add them to a group that can do so. The following line does that and more for the group sudo:

Code:
%sudo  ALL=(ALL:ALL) ALL
Though once they have root shell, the 'and more' part is redundant. If your /etc/sudoers file has that line, don't add accounts to the group sudo. Make a new group for each set of tasks, and add accounts to those groups as needed.

Code:
%sudo ALL=(root:root) /usr/sbin/visudo ""
%admin ALL=(root:root) /usr/bin/apt-get
%webmasters ALL=(root:root) /usr/sbin/service apache2 start, /usr/sbin/service apache2 stop, \
            /usr/sbin/service apache2 restart, /usr/sbin/service apache2 status
So there, the accounts in sudo can run amok. The accounts in admin can install or remove programs from the official repository. Those in webmasters can start or stop the web server which, when combined with group write access to various files, is enough to administer the web server. Those in both groups can do either. If you need only to write web pages, then "sudo" is not needed and groups are enough.

However, even with the admin and webmasters examples above, there are probably ways around "apt-get" itself and maybe Apache via the configuration files. The former could certainly be more compartmentalized. However, "sudo" is a helper for people you already trust. If you don't trust them, they should not be working for you. And as far as intruders go, they've already gotten in too far and you missed detecting them in time.
Ohhhhh ok I get it now, makes sense. I knew what whitelisting was but I thought you had to set/edit some parameter or something. I see you changed ALL to root cus sudo doesnt need to run as everying, and then just type the command(s) you want them to have, and put "" so they can't run commands with arguments.. Awesome now I know what im doing thank you!!


All times are GMT -5. The time now is 12:52 AM.