4

Is there a way to have a one-time sudo account?

My use-case is the following.

I have an Ubuntu station with no remote ssh allowed to that machine. The machine generally serves as a public-use computer. But sometimes I would like to grant root access to some people (who I know personally) based on e.g. SMS or IM communication. Of course I don't mean giving them full root access, just one restricted to some commands like apt-get or so. In no way do I intend to allow them to write to /etc.

But obviously I don't want to share the root password. And I also don't want those people to have root access forever, nor do I want to delete accounts or change passwords manually.

So I thought about creating a (sufficiently large) amount of root-access accounts and save their passwords to my laptop or phone. In the case I needed to provide root access to someone, I'd just send him the login information for an account that would be deleted when the sudo password-cache timout ends up.

Do you think this is a good approach? And if it is, where and how to setup the deletion script?

  • 4
    If someone has root access they can get around any defences you attempt, by definition. If you don't absolutely trust them, don't give them root access. – evilsoup Nov 16 '13 at 20:10
  • Their sudo could be restricted e.g. only to run apt-get - that would be sufficient for my purposes :) – Martin Pecka Nov 16 '13 at 20:39
  • You should probably include that information in your question: what do they need to be able to do, exactly? – evilsoup Nov 16 '13 at 21:29
  • @evilsoup : Thanks, edited ;) My fault not to include that info in the original question. – Martin Pecka Nov 16 '13 at 21:39
4

I've never seen anything like one time sudo, but you could still get one time sudo by setting up one time passwords. There's an article in Linux Journal, titled: Configuring One-Time Password Authentication with OTPW, that covers the various ways that you can do this. There are 3 packages that they discuss which facilitate this:

I've never used any of these so I can not offer you any guidance or practical experiences in using any of them but the LJ article and the sources I liked look to have everything one would need to get started.

  • Thanks, S/KEY looks like what I actually need :) Moreover, it has the added bonus of not creating tons of one-time users =) Excellent answer ;) – Martin Pecka Nov 17 '13 at 23:49
0

If you give a user the permission to run arbitrary commands as root, they can plant a backdoor. While it is not easy to install a rootkit without being detected, other people have done the hard work and you can download and install a pre-made rootkit. So from a security perspective a one-time root access is no more restrictive than a permanent root access.

If you trust the user, give them sudo access, and take that access away later. If you don't trust the user, don't give them sudo access.

If you want to give a user the permission to run specific commands, then a limited-time sudo access makes sense. But there is no benefit in allowing a one-time access. Give them access at one point in time, and take away that access later. For example, you could grant a 24-hour access by adding a line to the sudoers file and setting an at job to remove that line.

  • That's not very useful for me. I need the accounts pre-made since I can't ssh to the client machine and can't visit it personally daily. So writing anything to local files is offtopic. My solution has to be batch-based (run a batch once a month/year, download the passwords to my laptop and go away). – Martin Pecka Nov 18 '13 at 0:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.