Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to set up a deploy script using Capistrano At a step cap deploy:setup script is connecting to my server and trying to run commands that create directories. Then I see an error: msudo: sorry, you must have a tty to run sudo

There is a suggested solution to disable requiretty on my server. http://unix.stackexchange.com/a/49078/26271

I'm wondering if it is safe to do?

share|improve this question

1 Answer 1

up vote 9 down vote accepted

There is a very limited security advantage in having requiretty on a server. If some non-root code is exploited (a PHP script, for example), the requiretty option means that the exploit code won't be able to directly upgrade its privileges by running sudo.

There may be another way for the attacker to gain root, and of course the attacker will still be able to deface your site, but not letting the attacker gain root means that other services running as different users will keep running normally and the attacker won't be able to erase system logs. If none of your sudo rules do anything dangerous like creating a directory, this isn't a concern.

Furthermore — and more damning for requiretty — no privilege is needed to create a tty, e.g. with expect. So you might as well turn off requiretty: on its own, it does not provide a security advantage. It does provide a mild auditability advantage when executed by users (because the logs give a better idea of who invoked sudo and where they're coming from), but not when executed from a background job.

share|improve this answer
    
Do you mean that if the user can run expect (or screen for example), then requiretty is useless from a security point of view? (I didn't quite understand what you meant by "damning" in that sentence) –  Georges Dupéron Sep 18 '13 at 21:27
    
@GeorgesDupéron Yes, that's it. Since anyone can create a tty, the requiretty option doesn't prevent anyone from using sudo. –  Gilles Sep 18 '13 at 21:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.