to sudo or not to sudo

madivad · 03-21-2008, 03:16 AM

I notice in openSolaris (and others) that sudo is not installed, which I thought was strange since it encourages you to actually su more often than you need to when a simple one line sudo would suffice better.

Should I install sudo? or is there a good reason not to?

jschiwal · 03-21-2008, 04:06 AM

The main reason to use sudo is that it allows you to delegate certain tasks to others without having to give out the root password. It logs each command and lets you control what commands can be run by certain users or groups of users.

I don't have solaris and so I don't know it they have a something similar.

jlliagre · 03-21-2008, 04:19 AM

I can't vote. Like most poll, yours is missing the "none of the above" choice.

I use RBAC instead of sudo. It's simpler to use and has some features sudo is missing.

Here is the line I added in /etc/user_attr:

Code:

jlliagre::::type=normal;defaultpriv=basic,priv_file_dac_read,priv_file_dac_search,proc_zone,proc_owner;profiles=Primary Administrator

priv_file_dac_read and priv_file_dac_search allows me to search directories and see files content I couldn't otherwise because of their permissions.
proc_zone allow me to control non global zone processes
proc_owner allow me to view and alter processes that do not belong to me
Primary Administrator allow me to run any command as root just by prefixing it with "pfexec".

I find this alias convenient, as sudo is easier to type and remember:

Code:

alias sudo=pfexec

madivad · 03-21-2008, 08:27 PM

Quote:

Originally Posted by jlliagre

Here is the line I added in /etc/user_attr:

Code:

jlliagre::::type=normal;defaultpriv=basic,priv_file_dac_read,priv_file_dac_search,proc_zone,proc_owner;profiles=Primary Administrator

GREAT TIP (as usual)

Quote:

I find this alias convenient, as sudo is easier to type and remember:

Code:

alias sudo=pfexec

I've noticed pfexec NEVER asks for a password

jlliagre · 03-22-2008, 05:00 AM

Indeed. Password prompting and caching aren't (yet?) in rbac.

If you want users to be prompted for a password, then you can use roles.