Can sudo do?

your_shadow03 · 02-08-2010, 10:42 AM

Can a sudo user do everything what a root user can do?
I read sometimes expert say "You should run it as root rather than sudo user".

Mr-Bisquit · 02-08-2010, 10:45 AM

If you are experienced and safe use sudo.
Personally, I call it a security risk waiting to bite you in the ass.

repo · 02-08-2010, 10:51 AM

Take a look at
http://kb.iu.edu/data/amyi.html

Tinkster · 02-08-2010, 11:16 AM

Quote:

Originally Posted by your_shadow03

Can a sudo user everything what a root user can do?
I read sometimes expert say "You should run it as root rather than sudo user".

How long is a "piece of string"?

It entirely depends on how you set /etc/sudoers up.

If it's done poorly (like e.g. in Ubuntu) your
user can do ANYTHING.

pixellany · 02-08-2010, 12:12 PM

Definition of "expert": A drip under pressure.

My inner expert says that I should use the ways of the ancient masters--root is the administrator, users are users, and there is no "sudo". sudo is ambiguity--ie you may or may not be able to do something. Computers do not like ambiguity.

So there!!!

onebuck · 02-08-2010, 12:19 PM

Hi,

I think 'man sudo' explains it;

Quote:

DESCRIPTION
sudo allows a permitted user to execute a command as the superuser or another user, as specified
in the sudoers file. The real and effective uid and gid are set to match those of the target
user as specified in the passwd file and the group vector is initialized based on the group file
(unless the -P option was specified). If the invoking user is root or if the target user is the
same as the invoking user, no password is required. Otherwise, sudo requires that users authen-
ticate themselves with a password by default (NOTE: in the default configuration this is the
user's password, not the root password). Once a user has been authenticated, a timestamp is
updated and the user may then use sudo without a password for a short period of time (5 minutes
unless overridden in sudoers).

When invoked as sudoedit, the -e option (described below), is implied.

sudo determines who is an authorized user by consulting the file /etc/sudoers. By giving sudo
the -v flag a user can update the time stamp without running a command. The password prompt
itself will also time out if the user's password is not entered within 5 minutes (unless overrid-
den via sudoers).

If a user who is not listed in the sudoers file tries to run a command via sudo, mail is sent to
the proper authorities, as defined at configure time or in the sudoers file (defaults to root).
Note that the mail will not be sent if an unauthorized user tries to run sudo with the -l or -v
flags. This allows users to determine for themselves whether or not they are allowed to use
sudo.

your_shadow03 · 02-08-2010, 12:20 PM

Pixel..I respect your words.
But what I really want to know is :

Say I have /etc/sudoers with entry:

root ALL=(ALL) ALL

ravi ALL=(ALL) ALL

Does that mean by simply running sudo bash, I can run any command with root privileges.
There may be few commands which recommends to be running as root user.
In that case, can sudo user(who is provided with root permission) have almost every judgement at hand.

pixellany · 02-08-2010, 12:25 PM

My irreverent remarks were not directed at you!! The only thing I know about sudo is that I don't like it....

btmiller · 02-08-2010, 01:55 PM

A user who is allowed to run all commands via sudo will be allowed to do anything root can do.

Personally I like sudo ... it allows us to have multiple system administrators without having to distribute the root password. It also allows us to limit what junior admins can do. It also provides an additional audit trail. However, this is predicated on sudo being set up correctly.

devnull10 · 02-08-2010, 03:16 PM

I think sudo is a good idea for organizations, multi-user machines/servers etc, however for someone running linux on their own machine as a desktop, no others users etc, then sometimes the overhead of setting up the sudoers file can be a pain in the arse!
If I want to say change the ownership of a file, I ain't gonna sudo it, I'll just su to root, do the change and then logout (or use su -c).

jefro · 02-08-2010, 03:20 PM

sudo is root for only that command where as su to root is root for all commands good or bad.

mudangel · 02-08-2010, 05:23 PM

Quote:

Originally Posted by jefro

sudo is root for only that command where as su to root is root for all commands good or bad.

sudo won't keep one from making mistakes; the Ubuntu-default setup allows a regular user to be root- a user with unlimited privileges IS root.
edit: I'm not knocking Ubuntu as such, just the way it uses sudo.

pixellany · 02-08-2010, 10:11 PM

Quote:

Originally Posted by jefro

sudo is root for only that command where as su to root is root for all commands good or bad.

There are no "bad commands"---only the usage of a command ever comes into question. Even then, I would not tell someone they were "bad"---perhaps I would just say: "That was not your best move this week."

Seriously, root is for doing a bunch of admin stuff very quickly--eg to fix the )(%(*& computer before you leave for work so that your wife can surf the shoe stores. Having to spend the extra time typing "sudo" could affect your quality of life for the entire week.

sudo is for-----hmmmm???---Ah--sudo is for Ubuntu.

Quakeboy02 · 02-08-2010, 10:27 PM

I'm in the middle of the boat here. Sudo is very good for what it's meant for, and that IMO is 1) to limit the abilities of junior admins like btmiller says, and 2) to get you out of the habit of logging into root and staying logged in for normal tasks. For the most of us, #2 is the most important. It's not just the "rm -rf /" that is dangerous to run as root. If you run ordinary tasks as root, when you really meant to be yourself, then you might have a mess of permissions and ownerships to untangle. Running gdm/kdm as root is just asking for trouble.

So, for the most part, I use sudo for my admin tasks, including compiling and installing new kernels. OTOH, when I boot up a new kernel, both the virtualbox and nvidia drivers are non-functional, so I login to root to fix those, and then logout and bring up gdm.

Tinkster · 02-08-2010, 10:30 PM

Quote:

Originally Posted by pixellany

Seriously, root is for doing a bunch of admin stuff very quickly--eg to fix the )(%(*& computer before you leave for work so that your wife can surf the shoe stores. Having to spend the extra time typing "sudo" could affect your quality of life for the entire week.

Or (if you've taken that option into consideration) you
could let yourself do 'sudo -i' and become root on a
system where root has no password ... that's three keystrokes
more than 'su -'. If that affects your quality of life ... ;}

Quote:

Originally Posted by pixellany

sudo is for-----hmmmm???---Ah--sudo is for Ubuntu.

Or for your DBAs, if you want to give them permission
to update their products directory tree w/o letting them
(by accident, of course, not by malice) delete /etc or
the likes by giving them a set of maybe 10 commands they
can run against a given file/directory.

Admittedly it's more effort to set sudo up, and I'll also
confess that it wouldn't occur to me to use it on my slack
machines at home. But to say it's useless is unfair, and
I can clearly see the benefits in a corporate environment.

Cheers,
Tink