Sudoers for one day per week?

Question

I have been volunteered by my boss to be the sysadmin for our production redhat server. He asked me to tighten the security to avoid mishaps like rm -f * that occured not long ago.

Right now, we have 53 users sudo-ing into the machine and it is an audit nightmare. I am wondering if it possible to allow user access only on specific days of the week.

For example, can I have user 'Joe' allowed to login on Tuesdays and Thursdays ONLY and 'Jane' only on Sundays? Can etc/sudoers be customized to allow this?

Is there a better way instead of using sudoers?

Answer 1

sudo does its authentication through PAM, like pretty much everything else on a Linux box.

So you should be able to use pam_time.so to do this.

By default on Debian at least, that module isn't enabled. You need to add a line that looks like this:

account    requisite  pam_time.so

to either /etc/pam.d/sudo to enable for only sudo or to /etc/pam.d/common-account (after the pam-auth-update block) to enable for all programs on the system.

Then edit /etc/security/time.conf to set your restrictions. The service name should be sudo. For example, to allow Fred to use sudo only between 3pm and 5pm on Friday:

sudo;*;fred;Fr1500-1700

(NOTE: I have not tested this.)

edit: To be clear, I agree with the other answer and the various commenters, you appear to have too many people running too many commands as root, and you really need to fix that. And of course if they can become root, they can edit the pam config...

Answer 2

I would question why 53 users need sudo to do their day to day work -- for most users (even developers), sudo should be a rare exception, not such a routine thing that someone would casually run a sudo rm -rf * command.

Can you use group permissions (or even more advanced ACL's) to give people access to the files they need to get their work done, perhaps with some setuid or sudo'ed scripts or binaries to let them do things like restart services? (note that it's hard to write a secure setuid/sudo script, so it's more to keep honest people honest).

Even if you can restrict people to one day a week of sudo access, that's still 53 people with sudo access in a week's time, so it doesn't really help with your core problem.

For that matter, I'd question whether that many users need access to a production server at all -- can you ship logs or whatever data/files they need to a non-production machine?

Answer 3

The simplest way would be to use the sudoers.d directory (via includedir) for your configuration. You could then have cron jobs that could place the rules for each user in to that directory for the times you desire.

The #includedir directive can be used in /etc/sudoers to create a sudoers.d directory that you can drop sudoers rules into as part of your rules. For example, given:

#includedir /etc/sudoers.d

sudo will read each file in /etc/sudoers.d, skipping file names that end in ‘~’ or contain a ‘.’ character to avoid causing problems with package manager or editor temporary/backup files. Files are parsed in sorted lexical order. That is, /etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second. Be aware that because the sorting is lexical, not numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second. Using a consistent number of leading zeroes in the file names can be used to avoid such problems.

Note that unlike files included via #include, visudo will not edit the files in a #includedir directory unless one of them contains a syntax error. It is still possible to run visudo with the ‑f flag to edit the files directly.

/etc/sudoers.d/joe would be present when you want joe to have access and you could simply remove the file to take away access.

Answer 4

You could add a crontab to put a users in a sudo group, and then a second crontab to take that user out.