0

I've set Kali Linux as the OS on a remote PC. Users will be connecting to it via SSH and I want to prevent them from gaining root access or using su or sudo command. I'd like to disable a variety of commands. Can I create standard users on Kali Linux who are boxed in from doing serious damage? A few administrators have the root password but we do not want anyone else but that team to have power on the system.

3

By default, a user should not be able to escalate themselves to root.

The command su requires they know the root password, and if they know this there is nothing you can really do to stop them. To avoid that route do not give them the root password.

The sudo command is configured in the file /etc/sudoers, which determines who can use that command and what password is required of them (theirs or their target user). As long as you do not allow all users access to sudo and they are not in any groups allowed to use sudo, this method is closed to them. If a distro ships with sudo setup by default, it will make your initial user able to use it, but should not (I hope) do this for all new users.

Sometimes su and sudo have special behavior configured for users in certain system groups (e.g. wheel) that may allow sudo without a password. In addition to the above advice, it is also smart to not add your users into any un-needed groups, particularly system groups and in particular wheel. On certain systems you may also find some important files whose group id is wheel, giving users potentially unintended access without the need for privilege escalation.

In short:

  • Do not give them the root password,
  • Make sure they are not in a group allowing sudo access,
  • Make sure sudo is not configured to allow all users access,
  • Do not add users to any system groups, particularly wheel.

Note that these will block legitimate ways of becoming the superuser but have no effect on illegitimate means.

  • It might be worth also mentioning the significance of the wheel group. – David Z Feb 6 '14 at 21:18
  • @DavidZ edited. – casey Feb 6 '14 at 21:34
0

Adding to what has already been said, the group wheel consists of users who are allowed access to sudo, however on Ubuntu distros like Kali, this group is called sudo. To find out which users currently have sudo access you can use cat /etc/group | grep sudo. If you see users you don't want to have sudo access, simply edit /etc/group, removing those users from the group.

For more fine granularity, you can edit the /etc/sudoers file to give certain users or groups access to only the commands you want them to have access to. However, DO NOT use any old text editor!!! You must use the command visudo which will make sure you don't break your system.

More info can be found at https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file-on-ubuntu-and-centos

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.