1

I am creating a self-control tool for administrators. The script when run by an administrator, would voluntarily drop admin privileges. The administrator can regain admin privileges by running the script again but faces an intentional delay (of say 20 min).

What would be a good way to do this?

My solution

Let's say the administrator is called my-admin. My current solution is the following:

  • Add a file in /etc/sudoers.d that allows my-admin to run a script called /usr/local/bin/delayed-admin as root.
  • The script /usr/local/bin/delayed-admin does the following: If my-admin is a part of the admin group, it removes it from the group. And if my-admin is not in the admin group then it sleeps for 20min and then adds it to the admin group.

This seems to work, but I don't like the idea of messing with the sudoer file every time.

0

I would exercise extreme caution with this as it would be seen as a major security vulnerability since anyone can potentially run this script and gain admin access to your system.

To provide an alternative around the sudoers and the suders.d configuration. I would recommend having the script check to see if you are part of the admins group and just run a chmod -aG admins my-admin to add the account or a gpasswd -d my-admin admins to remove the account.

  • In my code, the permission to run the script (via sudoers) is only given to my-admin. So I think that is safe. – Miheer May 1 '17 at 2:19
  • In your solution how does my-admin run the script once he/she has dropped privileges? – Miheer May 1 '17 at 2:24
  • Exactly, you were saying in the first point fo your solution that you would have the script running as root. if you take a user away from sudo, they will no longer have any permission to be able to add their account back into the appropriate group. You would have to use another account that runs this script with sufficient permission to add the user back into a suitable group – Laywah May 1 '17 at 2:49
  • The entry in the sudoers file only permits my-admin to run /usr/local/bin/delayed-admin as root. This would work regardless of whether my-admin is in the admin/sudo group or not. He just has to have admin privileges when the sudoers file is written. – Miheer May 1 '17 at 3:06
  • 1
    Potentially create another group and make this person a member of this group and have one entry in the sudoers file where the group members have permission to run this script. this way you can add multiple people to that group which has permission to only run this script and then that script grants/drops the access you talk about. – Laywah May 1 '17 at 3:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.