1

I'm wondering what's best practice from a security standpoint: should I add my user to the /etc/sudoers file on my single-user computer or rather just leave %sudo in there?

Would this cause any problems or would I have to open the console as root everytime I execute something requiring root priviliges?

I'm using Debian 9.1 with KDE.

closed as primarily opinion-based by Thomas Dickey, Archemar, Jeff Schaller, Romeo Ninov, Stephen Rauch Aug 4 '17 at 14:38

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

2

As a security perspective there is no different between defining a single user in "sudoers" file or adding it to a group like "sudo", however the default and the best practice is to add anyone who needs to issue sudo to the "sudo" group or "wheel" on different distributions.

When do I have to add a single user to "sudoers" file? when that specific user needs some specific permissions for example he's only able to run a specific command from a specific machine under user "john" without the need of providing his password.

Now lets say we have a lot of users and they all need the same default sudo privilege, it's not logical to add all of them one by one to the sudoers file, right? what we should do is to add all of them to "sudo" group.

however in your case, only one user there is no different, if you want to be able to run commands using sudo then add your self to "sudo" group:

sudo gpasswd -a username sudo
1

It is not a security problem.

sudo is just of way for an administrator to have quick root access without using a root shell.

Using the root shell all the time is dangerous, following are a few reasons.

You're logged as root = all applications are running with root privilegies -- every vulnerability in Firefox, Flash, OpenOffice etc. now can destroy your system, because possible viruses now have access everywhere. Yes, there are only few viruses for Ubuntu/Linux, but it's also because of good security and default unprivileged user. It's not only about viruses -- small bug in an application could erase some system files or...

When your're logged as root, you can do everything -- the system won't ask! Do you want to format this disk? Ok, just one click and it's done, because you're root and you know what you're doing.

Thus, sudo was created, so that when root access is needed, it will only be the one command you use sudo with, which gets root access, you will not be permanently using the root shell.

  • What about su? – njsg Jul 31 '17 at 17:40
  • If you use su, you are in a root shell until you exit it(CNTRL + D). Which should be avoided, unless all your activity requires root privilege. – Hunter.S.Thompson Jul 31 '17 at 17:47
  • sudo is a security tool. It is simply the way to give elevated privileges without giving everyone involved the only root passowrd. Aditionally, it allows to change user (not only root) and control which programs could be executed. – Arrow Jul 31 '17 at 20:47
  • 1
    None of this is relevant to the question. The alternative between running a shell as root vs running a one-off command as root is not mentioned in the question and is not relevant to the requested choice of sudo configuration. – Gilles Aug 2 '17 at 22:23
0

It is the "best practice" to have to issue sudo to execute elevated commands.

It avoids the tendency of running a shell with root privileges and execute everything there. That will allow any command to be executed as root, but also dangerous ones. With sudo, you have to provide the sudo word, which means that that command will get more attention, it serves as a warning to yourself.

You nee to do nothing additional to get privilege separation.

Using sudo will avoid that normal users could run commands in /sbin and /usr/sbin and some other sbin directories.

For example, fdisk is in /sbin, if may be used to list partitions details, but also could be used to change such partition definitions (in essence) destroying all disk data. Clearly not a commandthat everyone should use.

A normal user will see this:

$ fdisk
sh: 1: fdisk: not found

When actually fdisk exist inside /sbin as /sbin/fdisk.

If that user has been given enough privileges with sudo, he can do:

$ sudo fdisk -l

to actualy run the program (-l will only list the partitions, nothing dangerous if you try it).

  • How to make sure that one has to use the sudo command? What do I have to put into the sudoers file for this? – mYnDstrEAm Jul 31 '17 at 21:09
  • Read edited answer. @mYnDstrEAm – Arrow Jul 31 '17 at 22:37
  • Okay, but to be able to use the sudo command it appears that I need to add myself to the sudoers file beneath the %sudo line or else it tells me that I'm not root when I use it. – mYnDstrEAm Aug 1 '17 at 11:45
  • 1
    Hmmm, Yes, of course, you do need to add a line to sudoers. What you execute (being root) is the visudo command in the command line, then add a yourusername ALL=(ALL:ALL) bash line if you want to run bash as root. You could put ALL instead of bash, but that is a too wide privilege delegation IMnshO. You could also make it a yourusername ALL=(ALL:ALL) NOPASSWD: bash so it will allow you to run bash witout even asking for a password. – Arrow Aug 1 '17 at 21:47
  • None of this is relevant to the question. The alternative between running a shell as root vs running a one-off command as root is not mentioned in the question and is not relevant to the requested choice of sudo configuration. – Gilles Aug 2 '17 at 22:24
0

Okay so now I've learned that it's best to simply not create a root account during installation. Simply leave the root password empty as explained in the installer. (No need to edit the sudoers file afterwards.) Then use the sudo and sudo -i commands for anything that requires root priviliges.

Not the answer you're looking for? Browse other questions tagged or ask your own question.