Tag Info

Hot answers tagged

8

You can reenable aliases as described at http://askubuntu.com/questions/22037/aliases-not-available-when-using-sudo the short version is to add and alias for sudo as alias sudo='sudo ' to get it to check the rest of the command for aliases. Otherwise, the sudo is check to see if it's an alias, it is not, so the rest of the alias checking ends. If sudo ...


4

Means folk can leverage this to get a root shell, thereby bypassing your security, eg :!/bin/sh from within vim. Or :r /etc/shadow and :w /etc/shadow. And so on...


3

In short, it's a security thing. You have said, that mary can run certain commands without the supplying of a password. That fails, then the "default action" is taken. Go and ask the password, then log the failed attempt. With out getting horridly technical, it's the separation between authentication and authorization. is this mary trying to run a ...


3

LD_LIBRARY_PATH settings are dropped by sudo for the security. To avoid being affected by that, you could add those paths to dynamic loader's global search path list. Put the library path lines in /etc/ld.so.conf.d/bitnami.conf: /opt/bitnami/common/lib /opt/bitnami/apache2/lib /opt/bitnami/sqlite/lib /opt/bitnami/subversion/lib Then update ...


3

su and sudo are the two most common ways to run a program (possibly a shell) as another user (possibly root). They have the same effect, but they work very differently in terms of how they determine whether to allow the action: su requires that either the source user is root, or the user demonstrate that they have access to the target account (typically by ...


3

Set the history file to ~root/.bash_history.$SUDO_USER, where $SUDO_USER is automatically set to the user who invoked sudo. For example, the following could go in your root bashrc: HISTFILE="$HOME/.bash_history.$SUDO_USER"


3

You seem pretty close with your PAM conf line: session [success=1 default=ignore] pam_succeed_if.so service in sudo quiet uid = 0 Looking at the manual page for pam_succeed_if, I think you want to test that the requesting user (ruser) is zabbix. So I suggest: session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0 ruser = zabbix That will ...


3

It's a bug in xonsh. In the build_ins.py module, xonsh attempts to determine if a file is "binary" or not by opening it and reading a few bytes: def _is_binary(fname, limit=80): with open(fname, 'rb') as f: for i in range(limit): char = f.read(1) if char == b'\0': return True if ...


2

You can exclude command with sudoers. Eg: Cmnd_Alias DEV_EXCEPTIONS=/bin/su, /usr/bin/vi %devgrp ALL = ALL, !DEV_EXCEPTIONS Results in User XYZ may run the following commands on this host: (root) ALL, (root) !/bin/su, !/usr/bin/vi The user will still be able to run the su command


2

2nd ALL= on all hosts (if you distribute the same sudoers file to many computers)


2

You seem to have some editing errors in your post. There is a "&" missing for the sudo line, and you are using different names for your pipes later in the script. Here is something that works for me: #!/usr/bin/env bash mkfifo pipein mkfifo pipeout echo '/usr/lib/openssh/sftp-server <pipein >pipeout' | sudo su anotheruser & cat <pipeout ...


2

If you can use simply su, you should. But, in most modern (desktop-) Linux distributions (for example Ubuntu) the root user is disabled and has no password set. Therefore you cannot switch to the root user with su (you can try). You have to call sudo with root privileges: sudo su.


2

Traditionally, interactive password problems are solved by using the expect command which creates an intermediary pseudo-tty to talk to the process. Here's an alternative python version using the equivalent python-pexpect package. Create a python file run.py: import sys,pexpect (pw,cmd) = sys.argv[1:] child = pexpect.spawn(cmd) ...


2

Group changes on unix are not recognized by existing login sessions; assuming, say, a Linux system with the usermod command: $ groups user $ sudo usermod -G wheel $USER ... $ grep user /etc/group | grep wheel wheel:x:10:user $ groups user To see the group change, any existing sessions (e.g. SSH, X11, etc.) must be exited, and a new session made (e.g. open ...


1

Sure. You can just drop files into /etc/sudoers.d instead of editing the sudoers file itself: cat > /etc/sudoers.d/apache <<EOF User_Alias APACHE = www-data Cmnd_Alias FIREWALL = /sbin/iptables, /sbin/ifconfig, /sbin/route APACHE ALL = (ALL) NOPASSWD: FIREWALL EOF chmod 440 /etc/sudoers.d/apache And I guess if you were stuck with a really old ...


1

You might want to use rvim or vim -Z to avoid the trivial root shell escape. Personally I'd write a short script that allowed the user to edit just the necessary files. Then, if any changes were detected it could offer to restart the Apache server, too. The script could even make automatic backups.


1

I downloaded the sudo SRPM from here, compiled and ran it from inside gdb to have a closer understanding. This tip on debugging setuid root programs was invaluable. The thing is that sudo creates/updates the timestamp file (resides inside /var/db/sudo/<user>) only when the user is authorized to run the command and has been authenticated as well. ...


1

Both programs are suid root. There is no reason to ever type sudo su except for the situation where one is unfamiliar with the -i and -E options to sudo, or otherwise in the habit of doing things as root without understanding why they're done. The su commands passes through a few hard-coded environment vars (or, on recent Linux, can use -p to pass through ...


1

Sudo is an additional program which may or may not be installed on a system. It's available as package sudo on Debian. Without more information on the specific situation/code you are referring to, the most likely answer is that sudo cannot be assumed to be installed, why su is required to be present as by the POSIX standard installed as part of Debians base ...


1

See my Detailed Solution Here. Your solution will be much the same. What you'll want to do differently is use multiple Cmnd_Alias's to make debugging, and adding new commands easier. You can use these multiple alias strings, in conjunction with the Negate Operator, as DarkHeart pointed out in his answer.


1

The full specification of the sudoers syntax is more complex than you've listed. The host specification just tells sudo on which hosts that user is allowed to run those commands. If the host specification is "ALL", which the man page says: The reserved word ALL is a built-in alias that always causes a match to succeed. It can be used wherever one might ...



Only top voted, non community-wiki answers of a minimum length are eligible