What is the threat of a user trying to sudo without permission?

Question

I was sshing into a certain computing system that I use. I was trying to follow some Linux instructions that involved sudo, and tried a few times to enter the password unsuccessfully, before realizing that I was getting it incorrect because I was typing in my ssh terminal.

I then received a very accusatory email about how my trying to sudo constituted a threat to the system. The tone was sustained even after I explained that it was an accident.

My concrete question is: what is the threat model whereby trying a couple times to sudo without permission is considered a serious violation of system security?

Note: I understand in principle why the rule is there. My guess is that you don't want people writing automated scripts trying to crack the password - or I guess try to input a password one obtained via social engineering. But a couple unsuccessful guesses for some silly command...what's the threat model?

Answer 1

First off, sudo all by itself, doesn't send any emails or create warning messages, other than logging your unsuccessful attempt to the log. People who observe these logs and correlate events (most probably using a scripted log watcher), see that some user id, which happened to be yours this time, is trying to gain root access where he/she is not permitted. As a result, the automated process fires an email to the offender. Even though you think you might be responding to a human being, 9 out 10 times, your response goes into a mailbox, which is either not observed, or checked very seldom.

If you think you have received a response to your explanation from an actual human, who keeps accusing you after you made clear that this was a mistake and you were not on the right server, he is either too bored and looking for something to do or have strict orders to scare people off.

Other than brute force cracking attempts, there is no other threat vector in the wild at this time, attacking sudo protected servers, that I know.

Also, consider asking questions of this nature in the Information Security section of Stack Exchange.

Answer 2

I was trying to follow some linux instructions that involved sudo

This is the threat. A user who doesn't know or understand what he or she is entering into their terminal with sudo privileges can cause very bad things to happen very quickly. It sounds like the admin didn't really explain to you that trying to sudo isn't really the issue, (in theory you could try sudoing everything until you're blue in the face, but if you don't have sudo access none of it will do anything). It's the potential that he's concerned with. What if you did have sudo privileges and you entered a command you found on the internet that happened to be destructive?

Answer 3

I can't speak to your specific situation; you'll have to ask your sysadmin why they chose to yell at you.

But I can tell you why sudo reports these incidents: Because there is no legitimate reason for them to happen. You do not have root. You should know that you don't have root (and if somehow you don't, you can check with sudo -l). You have no business attempting to do something which the sysadmin has chosen to prohibit. You will often find in computer security that "everything not permitted is prohibited." Since there is no valid reason to run sudo commands when you don't have appropriate privileges, it ought to be reported to a human for review. It might indicate misconfigured software, a compromised account, or any number of other security or non-security issues with the system.

Answer 4

If sudo is configured to send email and if the mailbox file hypothetical failed sudoers email goes to (or if the MTA is broken, the mail queue) is not or seldom monitored, and if a malicious local user is given sufficient time, and if disk usage on /var is not monitored, then a malicious local user may be able to fill that partition with mailbox or mailqueue entries due to failed logins, which could be bad. But that's a lot of if, and there would probably be more attractive targets in such a poorly run shop.

Answer 5

I suspect that the system reports each failed sudo attempt to the sysadmin, who takes them as individual action items. Yelling at you allows the sysadmin to cross them off his/her todo list.

The threat model is not to the system, but to the sysadmin. The sysadmin feels a need to respond to these incidents to prove that s/he is not asleep at the wheel.

If this is the case, the solution is to get VirtualBox or similar and stop bothering the sysadmin.

Answer 6

The threat of repeatedly failed sudo access attempts is that a malicious user might be able to brute force the password and thereby escalate their privileges. Since the user in question doesn't actually have sudo access, this is a dangling threat – a threat with no vulnerability to exploit. However, a monitoring system might trigger an alarm for this as part of an intrusion detection strategy, or because it's a standard operating procedure for the admins.

The issue with false positives in alarm systems in general is that they can cause the alarm to lose its significance to the humans that monitor it, "Boy Who Cried Wolf" style. Admins are thus justifiably concerned with minimizing the number of false positives in their monitoring/alarm systems.

That said, this seems to be a pro forma email from an admin in response to a triggered alarm, and that admin's default communication style seems to be "disproportionately annoyed". I wouldn't worry about it.

(As a side note, I would worry about your practice of reckless copy/paste systems administration, especially when the commands you are copy/pasting are sudo commands.)