Preventing Sudoers from doing sudo su

DejaCpp · 12-13-2007, 02:18 PM

1. Is there a way to prevent someone that I have given sudo privilege to from doing 'sudo su'.

2. Do all of the editors in Linux have a way for a savvy user to escape to a shell and then get root access?

pljvaldez · 12-13-2007, 03:01 PM

Typically, you should do it by only giving them access to the few commands they need, instead of ALL=ALL. I think the NOEXEC root option in the sudoers file will prevent root from being used with sudo.

forrestt · 12-13-2007, 03:20 PM

There are other things that need to be stopped as well. For example vi can give a shell (or you can update the sudoers file). Firefox can save files to and overwrite the sudoers file (there are many other ways to skirt the issue). Your best bet if you can't trust the people you are giving sudo rights to is to make a whitelist of things they CAN do, not a blacklist of things they can't.

HTH

Forrest

anomie · 12-13-2007, 03:41 PM

+1

Give sudoer access only for what should be allowed. (So that all else is denied by default.) You don't want to get into the blacklist game in this case; there are too many apps that may allow one to run shell commands.

prasanta · 12-22-2007, 04:47 AM

Quote:

Originally Posted by DejaCpp

1. Is there a way to prevent someone that I have given sudo privilege to from doing 'sudo su'.

The following should suffice I think,

User_Alias PART_ADMINS = prasanta
PART_ADMINS ALL = !SU, !/usr/bin/sudo -s, !/usr/bin/passwd root

--
Prasanta