I have a headless server that is logged into remotely by multiple users. None of the other users are in the sudoers file, so they cannot obtain root via
sudo. However, since the permissions on
-rwsr-xr-x there's nothing stopping them from attempting to brute force the root password.
One could argue that if a user knows the root password they can compromise the system anyway, but I don't think this is the case. OpenSSH is configured with
PermitRootLogin no and
PasswordAuthentication no, and none of the other users have physical access to the server. As far as I can tell, the world execute permission on
/usr/bin/su is the only avenue for users attempting to gain root on my server.
What's further puzzling to me in that it doesn't even seem useful. It allows me to run
su directly instead of needing to do
sudo su, but this is hardly an inconvenience.
Am I overlooking something? Is the world execute permission on
su just there for historic reasons? Are there any downsides to removing that permission that I haven't encountered yet?