Hi people,

I've been breaking my head over the following security issue. The company for which I work has a small number of linux servers hosting some application software. There are a handfull of administrators who use local root accounts of these machines to administrate them. Now, for security reasons I would like them to start using personal accounts which have the same privileges as root except privileges to alter users, groups and privleges, stop or start logging or have write access to the /var/log directories. Say a sort of trimmed root accounts (I would rather have more restrictions obviously, but at least this would be a start). This way, there is still a lot of damage that can be done with these accounts, but at least I can monitor them and trace undesired actions back to a responsible person when I recognise them, without someone using these accounts being able to dodge monitoring.

So far, the only way I can think of realising this is to create a new group, add four personal accounts, and change all the group ownerships for all the system files and commands except chown, chmod, /var/log and so forth. This seems a bit radical and pretty scary however. Any thougts on this problem?

Thanks and kind regards,

Camiel

Hi!

There are of course many angles to the problem, but
one approach that comes to my mind is sudo.
http://www.gratisoft.us/sudo/intro.html

Well in general, you'll want to look towards sudo to handle this I would say, much more graceful than messing with actual permissions. You need to be very careful with all this level of thing though, as there will pretty much *always* be a way around the things you want at that level. There will be a way to run a different shell as a different user to change the things via that account etc.

One angle I find interesting is that the more you technically enforce security within an administrative environment, the more it can be assumed by users that whatever is technically possible is acceptable. This contrasts to a written policy of self governance (to some extent) where the onus is much more on them thinking about what they are doing, and not doing it if they think they shouldn't. This therefore implicitly covers all these hacks and tricks that are hard / not feasible / impossible to cover. You can audit a lot of what's done and keep an eye on it for anomalies, and awareness of local admins that actions are being recorded also helps enforce a personal accountability.

Thanks guys, I think sudo will indeed do the trick.

acid_kewpie, good point there btw. Will take that into account as well.

Always rememeber with sudo though that unless you really tie it down, sudo can be used to wipe out your auditing features.

quite. In the last place I worked, an web application level team had sudo rights explicitly only allow a dozen or so things. Including rm, mv, vi and cat. So amongst many other obvious irrelevancies they had 100% technical ability to directly edit the sudoers file itself! Nice!