Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to prevent users who need escalated privileges from obtaining any kind of a root shell. However since there are many ways to attain this, and many non root commands ( like those found in coreutils ) I'm wondering if there are any downloadable sudoers policies that provide restrictive access.

share|improve this question
2  
What is the difference between them having a shell and just using sudo to execute the commands? You can give them access to only a certain command (or, I believe, a list), is that what you want? –  Kevin Nov 24 '11 at 19:58
4  
I genuinely don't understand what you're asking. Could you please clarify your question? –  Chris Down Nov 24 '11 at 21:04
    
Are there any special programs that give you headaches? –  Nils Nov 24 '11 at 21:33
1  
The only safe sudoers is an empty sudoers. By default, assume that any command has a shell escape. Running a specific command with escalated privileges corresponds to exceptional needs, and you need to study each exception. I don't understand what you're after: a list of safe commands? That doesn't exist; the vast majority of safe commands are useless. –  Gilles Nov 25 '11 at 2:07
    
I want to know if there are any downloadable policies that provide a list of common shell programs that do not provide a shell themselves so to speak. I'm basically looking for a preexisting security policy, though such a thing may not exist in any distributable form (outside of the default sample) –  xenoterracide Nov 25 '11 at 21:24

3 Answers 3

sudo

overview

sudo allows you to give users and groups super user privileges. sudo's configuration file can be found at /etc/sudoers. Typically, one edits the sudoers file using the command visudo. By default on most distributions, either no user is given sudo privileges, or the first user created is given such privileges. After that, users are typically created without sudo privileges.

flexibility

sudo allows you to give each user different settings, or even apply settings to groups of users. For example, you could give the user admin or the group admins access to gain super user privileges.

You can also allow these users access to specific programs. For example, you can give Bob sudo access to apt-get if you trust Bob to install packages and update packages on your system.

Your system most likely has a sudoers file, in which case you can open the file and see the examples provided. I will show you an example here that might clear things up:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) NOPASSWD:ALL

This gives any user in the group of sudo privileges to run any command anywhere without prompting for a password. The user must first authenticate (ie: login), but once that happens, these users will have root access to the machine.

tl;dr

Most distributions give the initial user sudo access, but users created thereafter are not given such access. You can verify this by viewing /etc/sudoers. Simply make sure users have no access to sudo via sudoers file to ensure no user can gain root shell via sudo.

share|improve this answer

I'm not sure I understand the question. However, if you grant some user root permissions (through sudo or whatever) to execute a program and that this program happens to provide access to a shell with these same permissions, you can't do anything against it.

When you give some permissions to execute a specific program you have to trust the program for not messing up (except, of course, if you really trust the user).

share|improve this answer

Are you looking for something like this:

# Allow members of group sudo to execute any command
username  ALL = ALL, !/bin/sh, !/bin/bash, !/bin/tcsh, !/bin/csh, !/bin/ksh, !/bin/zsh, !/bin/su
share|improve this answer
    
essentially, though more comprehensive –  xenoterracide Oct 3 '12 at 9:26
3  
You forgot shutdown, halt, mkfs, dd... IMO there is no secure way maintaining a blacklist of possible dangerous programs. Go with a whitelist instead and think very hard why you would want users to have root-privileges in the first place. –  Alexander Janssen Oct 3 '12 at 12:05
    
@xenoterracide: +1 for Alex. There is no secure way to maintain a blacklist. A user can always cp /bin/sh ~/not_a_shell ; sudo ~/not_a_shell or sudo ex +':!/bin/sh'. Rather than trying to make it impossible, provide a supported/approved way that will audit and make people justify any elevation to full root. –  bahamat Oct 3 '12 at 18:04
    
well this is why I was asking if there are any downloadable policies... obviously publicly audited tools/policies are more secure than me or someone just coming up with them myself. –  xenoterracide Oct 4 '12 at 2:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.