0

I'm using a RHEL 6.10 and recently observed any new user can get sudo to root access by default.

I checked all sudoer files but no such reference, only a few users are configured there and that doesn't have any relations with the new users (such as common group).

We tried testing by creating multiple new user accounts and also with kerberos user account and found them all able to sudo2root without any reference in sudores.

Can you suggest any pointer for such configuration done system wide.

  • 1
    Can you post your sudoers file? Are there any files in the /etc/sudoers.d directory? What default group are your users created with? Does the root user have a password? – Scottie H Jul 9 at 15:55
  • 1
    Unfortunately, I won't be able to publish file here. There are no files in sudoers.d directory and users are created with their own group same as the user name. User's doesn't have root password. As I mentioned I created few users as below: 1st user: user1(username) user1(group) 2nd user: user2(username) user2(group) – Vikas Thakur Jul 9 at 16:09
  • 1
    Near the end of the sudoers file, is there an include statement? It will start with #. Other than that, how many non-comment lines are in your sudoers file? – Scottie H Jul 9 at 16:12
  • 1
    ## This file must be edited with the 'visudo' command. ## Host Aliases ## User Aliases User_Alias SYSADM = +sysadmin, %sysadmin, +xyznadmin, xyznmon User_Alias LINUX1 = linux1 ## Command Aliases Cmnd_Alias LOAD_KERBEROS_DATA = /usr/sbin/kdb5_util load, /var/kerberos/krb5kdc/slave_datatrans # Defaults specification # # Refuse to run if unable to disable echo on the tty. # Defaults !visiblepw – Vikas Thakur Jul 9 at 16:15
  • 3
    @Vikas please edit your post to add information. Use code formatting to show file contents and command output: unix.stackexchange.com/editing-help#code – muru Jul 9 at 16:23
0

It's a bit hard to follow, but there are still a few interesting things here.
sudo -l user1
Matching Defaults entries foruser1 on this host:
!visiblepw, always_set_home, requiretty, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin:/bin:/usr/sbin:/usr/bin
Useruser1 may run the following commands on this host:
(ALL) ALL


That is the issue. I think it comes from this line in your sudoers:
##Linux1 user LINUX1 ALL=NOPASSWD: LOAD_KERBEROS_DATA
Is that what is in your sudoers file? Something, perhaps a typeo, is allowing your users users to get the (ALL) ALL value.

  • Sorry, I'm trying to format data, but not able to do so, I guess it will take some time for me to learn formatting here. Anyway, I see this line as below: ## Linux1 user <br/> LINUX1 ALL=NOPASSWD: LOAD_KERBEROS_DATA <br/> – Vikas Thakur Jul 9 at 16:42
  • User_Alias SYSADM = +sysadmin, %sysadmin, +vinciadmin, vincimon <br/> User_Alias LINUX1 = linux1 <br/> <br/> <br/> Cmnd_Alias LOAD_KERBEROS_DATA = /usr/sbin/kdb5_util load, /var/kerberos/krb5kdc/slave_datatrans <br/> Defaults !visiblepw <br/> Defaults always_set_home <br/> Defaults requiretty <br/> Defaults: arago !requiretty <br/> arago ALL=(ALL) NOPASSWD:ALL <br/> aragoki ALL=(ALL) NOPASSWD:ALL <br/> root ALL=(ALL) NOPASSWD:ALL <br/> – Vikas Thakur Jul 9 at 16:46
  • Defaults env_reset <br/> Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS" <br/> Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE" <br/> Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES" <br/> Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE" <br/> Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY" <br/> – Vikas Thakur Jul 9 at 16:47
  • Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin <br/> root ALL=(ALL) ALL <br/> SYSADM ALL=(ALL) ALL <br/> LINUX1 ALL=NOPASSWD: LOAD_KERBEROS_DATA <br/> surecloud ALL=NOPASSWD: ALL <br/> – Vikas Thakur Jul 9 at 16:47
  • 1
    ScottieH your suggested pair of lines could equally be a single commented line ##Linux1 user LINUX1 ALL=NOPASSWD: LOAD_KERBEROS_DATA. We just don't know. "It's a bit hard to follow" - no, it's impossible to follow. – roaima Jul 9 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.