permit first or deny first in /etc/sudoer

gbcbooks · 02-21-2017, 04:07 AM

Quote:

Originally Posted by pan64

the right way is to create a strict list about what is allowed (and how, for whom). Any kind of weakness/looseness/negligence may lead to full access to the system (without control and audit).
From the other hand it looks very strange for me (to run huge amount of processes as root), so probably you need to think about reorganizing it (for example using a different account).

i know that. combining to the practice , it could cost a huge damage for the company if you make a mistake even thought it just a simple commands.

we need to do this step by step .

r3sistance · 02-21-2017, 04:12 AM

yes, there is a huge cost, which is why step 1 needs to be "get the use cases" and step 2 needs to be "verify the user cases". This shouldn't be phase 3 but phase 1.

It sounds like you've inherited a system which has probably been set-up horribly, you should get it marked for replacement with a new system ASAP. For a stop gap, you could look to start writing simple scripts to do what is required and place them in a separate directory that is added to the PATH environmental, but I'd still look to get the system replaced by something on a priority basis if the permissions you have inherited were already too open.