What mechanism prevents any user from accessing any other user's files via root?

Question

On a multi-user system, what protects against any user accessing any other users files via root? As context, the question is based on my understanding as follows:

There are two commands related to root privileges, sudo and su. With sudo, you don't become another user (including root). sudo has a pre-defined list of approved commands that it executes on your behalf. Since you are not becoming root or another user, you just authenticate yourself with your own password.

With su, you actually become root or another user. If you want to become user Bob, you need Bob's password. To become root, you need the root password (which would be defined on a multi-user system).

ref's: howtogeek.com:

su switches you to the root user account and requires the root account’s password. sudo runs a single command with root privileges – it doesn’t switch to the root user.

and

If you execute the su bob command, you’ll be prompted to enter Bob’s password and the shell will switch to Bob’s user account; Similar description at computerhope.com

tecmint.com:

‘sudo‘ is a root binary setuid, which executes root commands on behalf of authorized users

If you become root, you have access to everything. Anyone not authorized to access another user's account would not be given the root password and would not have sudo definitions allowing it.

This all makes sense until you look at something like this link, which is a tutorial for using sudo -V and then sudo su - to become root using only your own password.

If any user can become root without the root password, what mechanism protects user files from unauthorized access?

Answer 1

The major difference between sudo and su is the mechanism used to authenticate. With su the user must know the root password (which should be a closely guarded secret), while with sudo the user uses his/her own password. In order to stop all users causing mayhem, the priviliges discharged by the sudo command can, fortunately, be configured using the /etc/sudoers file.

Both commands run a command as another user, quite often root.

sudo su - works in the example you gave because the user (or a group where the user is a member) is configured in the /etc/sudoers file. That is, they are allowed to use sudo. Armed with this, they use the sudo to temporarily gain root privileges (which is default when no username is provided) and as root start another shell (su -). They now have root access without knowing root's password.

Conversely, if you don't allow the user to use sudo then they won't be able to sudo su -.

Distros generally have a group (often called wheel) whose members are allowed to use sudo to run all commands. Removing them from this group will mean that they cannot use sudo at all by default.

The line in /etc/sudoers that does this is:

## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL

While removing users from this group would make your system more secure, it would also result in you (or other system adminstrators) being required to carry out more administrative tasks on the system on behalf of your users.

A more sensible compromise would configure sudo to give you more fine grained control of who is allowed to use sudo and who isn't, along with which commands they are allowed to use (instead of the default of all commands). For example,

## Allows members of the users group to mount and unmount the
## cdrom as root
%users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

(only useful with the previous %wheel line commented out, or no users in the wheel group).

Presumably, distros don't come with this finer grained configuration as standard as it's impossible to forecast what the admin's requirements are for his/her users and system.

Bottom line is - learn the details of sudo and you can stop sudo su - while allowing other commands that don't give the user root shell access or access to commands that can change other users' files. You should give serious consideration to who you allow to use sudo and to what level.

WARNING: Always use the visudo command to edit the sudoers file as it checks your edits for you and tries to save you from the embarrassing situation where a misconfigured file (due to a syntax error) stops you from using sudo to edit any errors. This is especially true on Debian/Ubuntu and variants where the root account is disabled by default.

Answer 2

There are two commands related to root privileges, SUDO and SU. With SUDO, you don't become another user (including root). SUDO has a pre-defined list of approved commands that it executes on your behalf (this addresses what I asked in the comment about how you give selected users selective privileges). Since you are not becoming root or another user, you just authenticate yourself with your own password.

This is incorrect. The biggest difference between su and sudo is that you enter your own password instead of the target user's password, and that sudo is more flexible. Both of them's whole point is leting you become another user. su can run a specific command and sudo can start an interactive shell, they just have different default modes.

Most commonly you have a group, conventionally named wheel, that is allowed to run any command as any user. Sometimes you want to restrict a user to only run a specific command as a specific user though, and this is what's more flexible about sudo compared to su.

With SU, you actually become root or another user. If you want to become user Bob, you need Bob's password. To become root, you need the root password (which would be defined on a multi-user system).

You can become any user with sudo too, with your own password, provided that the rules in /etc/sudoers are set up to allow you to. sudo lets you restrict the command a user can run tho, yes, and prevents you from having to disclose the passwords of specific users, or even not having a password at all on specific users disallowing regular logins.

If you become root, you have access to everything. Anyone not authorized to access another user's account would not be given the root password and would not have SUDO definitions allowing it.

This all makes sense until you look at something like this link, which is a tutorial for using SUDO -V and then SUDO SU - to become root using only your own password.

If any user can become root without the root password, what mechanism protects user files from unauthorized access? First of all, sudo -V prints the version of your sudo binary, and sudo -v validates the cached credentials and are irrelevant to the later part.

Second, sudo su is a rather silly thing to do because there is already a sudo option to start an interactive shell as the specified user (sudo -i), and running one privilege authorization tool (sudo) to run another privilege authorization tool (su) is really silly.

Third, "any user" should definitely NOT be able to become root. If they can your whole system is completely unsecured. the root user is all powerful and can do anything at all, and running a command as root is only one of the uses of sudo, it's a general authorization tool which can let a specific user run a specific command as a specific user.

Answer 3

Short answer is you can't.

If you allow someone (e.g. simth) in sudoer's group, he can issue a sudo su - then become root, then anoter user (e.g. wesson). This is an alternate way of giving root's password to simth. However he (smith) can change root passwd.

Notes also that

1) you must specify in /etc/sudoers a line like

%sudo   ALL=(ALL:ALL) ALL

2) smith (in the exemple above) must be in sudo group.

this is not a default setting.

You must completly trust someone (smith) to give sudo su - access.