4

most of the person in my team have sudo access. But I still want them to confirm before they do sudo su. if user press Y, then allow him as root else return him to his own home directory. I tried the below code but when user press any other key, he is still allowed to login as root. Please help

!/bin/bash

echo -e "You are entering into high security env."

echo -e "If You are still not sure about the purpose, please logout of root user immediately."

echo -e "Contact admin immediately in case of any doubt."

sleep 1
echo -e "Press Y if you still want to enter as a root user"

read ch

case $ch in

    'Y'|'y' )

                echo -e "Risk is all yours. PT team welcome you here."
                ;;

        *)
                bash /root/.bash_logout
                exit
                ;;
esac
1
  • 3
    What's all this cargo cult stuff with sudo su when you have sudo -s or even sudo -i available to you? Jan 25, 2016 at 11:13

2 Answers 2

8

It is worrisome apparently so many users have sudo access.

Instead of reinventing the wheel, and because the root .profile only runs when doing sudo su -, and also because an alias to sudo besides not very convenient, is printed beforehand, I recommend a more standard approach.

The /etc/sudoers configuration has an option to keep forever the default warning every user gets the first time he uses it.

We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:

#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.

root's password:

For it to be always on, you create a file in /etc/sudoers.d/privacy with:

Defaults        lecture = always

If you want to try it with the current user, you have to logout first.

The default message is in the sudo source code, if you wish to change it, you will have to recompile sudo. I advise against the idea; if you insist, you have to compile the package from apt-src, and then pin/freeze it, for it not to be updated at random, but only manually.

As an addition to your request, I do strongly urge to start logging what people do, especially if they have unrestrained sudo access.

If you add to your /etc/bash.bashrc:

readonly PROMPT_COMMAND='history -a >(logger -t "commandlog $USER[$PWD] $SSH_CONNECTION")'

This will log all the user commands to syslog.

I would configure syslogto forward the logs to a locked down central syslog server, so in case of hacking or a rogue sysadmin, they would not be able to tamper with evidence.

0
1

Where is the script getting called from? root's .bash_profile or .bashrc ?

I don't believe this line will log the user out:

bash /root/.bash_logout

It creates a new bash process that will run the commands in the .bash_logout file.

You could instead try this line:

logout

Update: or try:

exit

Assuming a shell startup file is running the warning script the "exit" will just exit the warning script, not the shell.

If the bash code that runs "exit" were in the .bashrc file instead of a separate warning script then it should exit the shell.

6
  • 1
    Beware .profile (not .bash_profile) is only run when doing sudo su - Jan 24, 2016 at 7:27
  • 1
    logout: not login shell: use `exit' getting this exception
    – anurag
    Jan 24, 2016 at 7:30
  • (beware of sub-shells too) Jan 24, 2016 at 7:31
  • 1
    Good point. Edited to add .bashrc. Also note that people can get shell access using other commands too. Eg: run "sudo vi" then ":shell" . If you are going to give them sudo access you have to trust them.
    – Chad Clark
    Jan 24, 2016 at 7:32
  • 1
    Exactly, if a user does not want to have a warning, a restricted shell, or whatever artificial restrictions, with sudo he will always find a way, unless you are giving them a few commands in /etc/sudoers. For external people/developers, I only let them start and stop apache, stop and restart tomcat, and reboot the server. Nothing else. Jan 24, 2016 at 7:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .