sudoers problem

kamran.ayub · 10-30-2014, 05:18 PM

Dear All,

I have setup a user group in sudoers to allow some specific commands.
Commands allowed to the group are running fine. I have not allowed to run service command or /etc/init.d/service command.
But that user can run /etc/init.d/service status command.

How can I restrict that user to not run /etc/init.d/asterisk command.

User_Alias DGS = john,johny
DGS ALL= NOPASSWD: /bin/date, /usr/bin/tail, /usr/bin/tailf, /bin/ls*, /bin/grep*, /bin/cat*, /usr/bin/find*, /usr/sbin/mtr, /usr/bin/less, /usr/bin/more, !/etc/rc.d/init.d/asterisk

In last I have write !/etc/rc.d/init.d/asterisk but not restricting it in centos.

Please suggest the solution.

regards,
kamran

kamran.ayub · 10-30-2014, 06:17 PM

Please help.

I just want to block access for following command for user group DGS defined in sudoers file.

/etc/init.d/asterisk status

How to block this access in sudoers.

wpeckham · 10-30-2014, 06:30 PM

Question: can a normal user (not in the target group) run that command WITHOUT sudo?
If they can, then sudo is not giving the permission and changing the sudo configuration will not help you.

Make sure the init files belong to root, and have permissions likie 700 and see if that does the job for you.

kamran.ayub · 10-30-2014, 06:44 PM

Dear wpeckham,

Yes you are right. I have tried with a normal bash user and it can run the command.
But I can't set permissions to /etc/init.d/asterisk to 700 becuase it may impact my production time.
Is there any other way to sort this out.
Current permissions are as below:

#ls -al /etc/init.d/asterisk
-rwxr-xr-x 1 root root 4187 Oct 1 05:18 /etc/init.d/asterisk

Regards,
Kamran

Valery Reznic · 10-31-2014, 05:52 AM

Quote:

Originally Posted by kamran.ayub

Dear All,

I have setup a user group in sudoers to allow some specific commands.
Commands allowed to the group are running fine. I have not allowed to run service command or /etc/init.d/service command.
But that user can run /etc/init.d/service status command.

How can I restrict that user to not run /etc/init.d/asterisk command.

User_Alias DGS = john,johny
DGS ALL= NOPASSWD: /bin/date, /usr/bin/tail, /usr/bin/tailf, /bin/ls*, /bin/grep*, /bin/cat*, /usr/bin/find*, /usr/sbin/mtr, /usr/bin/less, /usr/bin/more, !/etc/rc.d/init.d/asterisk

In last I have write !/etc/rc.d/init.d/asterisk but not restricting it in centos.

Please suggest the solution.
It

regards,
kamran

It is not related to your question, but anyway...
In your sudoers file you specified among other things find, less and more.
Find and less ( may be more too) able to execute arbitrary commands.
So, allowing using those commands are effectively the same as allowing full root access.
If you really need to those command yiu may want to consider sudoers' noexec specifier
to close this hole.

Valery

wpeckham · 10-31-2014, 08:01 AM

The init files nromally need to be run as root on startup anyway. Restricting them only removes the ability of non-root users to get status information, which appears exactly what you want.

I am not saying there will be no unintended consequences, but they should be non-fatal.

Why not try this with one or two that you want to lock down. If those cause no issues, move on to one or two more.