Misuse of sudo(8) and sudoers(5)

The utility sudo(8) runs programs as another user. Frequently, that other user is root, but it does not have to be, the utility can also be used to downgrade privileges. Often it is mis-used to provide full root access to a group of users in place of su(1). However, sudo(8) was developed to give selective access to machines, following the principle of least privilege. It can achieve a very fine granularity of access, even allowing just specific programs or specific options for specific programs. It is a good alternative to handing out the root password, gives users some control, and can help beginning system administrators get started.

In general, it limits the window of opportunity for abuse and can also be set to time out after minutes or immediately. It is highly configurable in regards to programs, hosts, groups, times, and so on. It is important to note that the approach here can only be to add privileges. That is to say, make a white list of approved capabilities. With that in mind, trying to subtract privileges instead will not work, ever, and is trivial to circumvent.

With the right configuration it can make selected programs available, either by per host, or per group and even limit to only selected options. It provides verbose logging of activities and an audit trail of who did what and when. This is especially important for shared accounts like root, but even for other accounts such as one for a central databases.

What accounts can or can't do using sudo(1) is all in how the configuration file, sudoers(5), is set up. That file contains a list of which users and groups may do what, down to environment variables and command parameters. Here, for example, anyone in the group sysadmin can schedule a shutdown or reboot of the machine:

With nothing after the program path and name in the configuration file, the utility shutdown(8) can run as the superuser and can be launched with any of its options, including any message. However, the utility updatedb(8) can only be run without parameters because of the empty quotes.

Here are some lines from the configuration file which allow anyone in the group webmaster to start, stop, or reload the web server:

Note that nothing there in the configuration is set to allow editing of files using sudo(8). That should instead be managed by using the right group permissions. And between the two, permissions and sudoers(5), there is enough to allow operation of a web service without giving away the shop.

Here is an example using the simple patterns available where accounts in the group admin can install or remove packages found in the official repositories, or generally use or abuse the package manager:

The list consists of two types of entries: aliases and rules. For what it's worth, the rules are written in a grammar known as Extended Backus-Naur (ENBF) e.g. symbol ::= definition | alternate1 | alternate2 . The configuration file, sudoers(5), has its own manual page so be sure to look there first.

For what it's worth, the sudoers(5) file should be edited only with visudo(8). It checks the syntax of the file before saving it so as to reduce the likelihood of getting locked out. And speaking of editing, the alias sudoedit should be used if granting the ability to edit a file is needed. It makes a copy of the target file, then launches the editor of choice as the regular user, and once the editing is complete copies the changed file over the original. That prevents shell escapes among other problems. So, rather than allowing use of vi(1) or nano(1), use sudoedit instead and let that call vi(1) or nano(1) for editing. However, rather than reaching for sudoedit first, group permissions should be used to allow file access whenever possible.

Graphical programs should not be launched carelessly as root with sudo(8) because some environment variables will still point to your home directory and any files created there in the user's home directory will be created with root ownership. That can mean, in some cases, that the normal account can then no longer use those same programs. The way around that problem is to launch sudo(8)with the -H option to force using root's own home directory.

But as a rule of thumb, if it is a graphical program, it should not be run as root. There is always a safer way. For example, using bash(1) the utility wireshark(1) can capture the output from tcpdump(8) using process substitution so it does not have to run as root.

Though in many cases with wireshark(1) it might be better to read a file of captured packets made by using tcpdump(8) first.

As of the time of this writing, there is at least one very good book on sudo(8), Sudo Mastery: Access Control for Real People by Michael W. Lucas. So for in depth coverage, look there. The project web site for sudo(8) itself is at http://www.sudo.ws/