Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I'm about to start my new job as a sysadmin and I've been thinking about implementing a cooldown feature on su or sudo. The cooldown prevents the user from using these commands for a few seconds after the first failed attempt, and the waiting time increases with each failed attempt by some factor.

The idea behind the concept is that the authorized user might get it wrong the first time but will get it right on the second. The cooldown will be there to discourage and delay an adversary from using brute-force variations.

Is there a flaw in my approach? Would replacing the sudo command with a modified script be wise? Or should I patch the executable itself?

Edit: I've already searched for this on Google, nothing found. Same goes for SO, SuperUser.SE and Security.SE. If you feel this question isn't a fit for ServerFault, please flag it so.

share|improve this question

migrated from serverfault.com Jul 17 '13 at 11:20

This question came from our site for system and network administrators.

marked as duplicate by Chris Down, rahmu, Evan Teitelman, Anthon, jasonwryan Jul 17 '13 at 18:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

First rule of security is Do Not Build Your Own.. Replacing a well tested program with something custom will almost always be the wrong thing to do. As for what you are asking look into PAM plugins. I bet there is already one to do something like this. – Zoredache Jul 17 '13 at 9:40
It never occured to me to look for this on Unix.SE. Although my question is about sudo and the other question is about PAM, I consider this question answered. Thanks @Zoredache – rath Jul 17 '13 at 9:45
up vote 2 down vote accepted

Is there a flaw in my approach? Would replacing the sudo command with a modified script be wise? Or should I patch the executable itself?

Yes, there is a flaw in your approach: as was pointed out in the comments, the first rule of security is do not build your own. You have no chance of testing your own code as thoroughly as the su or sudo code has been tested, and even if you do manage to get it mostly right you are practically bound to miss some edge case somewhere. (It's hard enough to get non-security-critical code right even when you are paid to do it.) Just don't do it.

Instead, use the PAM pam_faildelay module. It allows you to configure the delay, might allow you to stagger the delay, and even if it doesn't, copying the code from it and implementing a staggering delay will almost certainly be less error-prone than replacing su and sudo. I still wouldn't recommend creating a PAM module, even based on an existing similar one, if you don't know exactly what you are doing (anything that hooks into PAM risks introducing security vulnerabilities), but at least you wouldn't be messing with basic system utilities trying to add your own logic from scratch.

Besides, as Lingfeng Xiong pointed out, there are many other ways to get root privileges.

share|improve this answer

sudo and su are not the only way to get root permission. Try PAM. I believe it is better for you than to patch the binaries.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.