1

I'm searching for a way to prevent my system users to sudo into the root account in any way.

I don't mean logging to the root user by SSH, but specifically by sudoing ( sudo -s ) ( sudo su ) etc.

Any suggestions?

(Expect white listing specific commands by sudoers file )

Thanks!

Thats what i want to prevent. when user uses "sudo -s" he will not be able to use the "root" user

  • Do you still want users to be able to use sudo to act as other non-root users? – Kusalananda Oct 2 '19 at 13:11
  • Yes, The users have sudo access to run privileged commands. the idea behind disabling sudo into root user is to find suspicous activities.when you implement your employees the idea of using sudo for every command, suspicious activity can be easier to find :) – ayali Oct 2 '19 at 13:24
  • Ah, so you're talking about being able to start an interactive root shell, only. – Kusalananda Oct 2 '19 at 13:26
  • I found this one : makeitcompliant.blogspot.com/2012/06/… that is actually my question "Users often drop to a root shell to avoid typing sudo before any command. Dropping to a root shell is usually done doing su -, sudo –i, sudo –s, sudo bash etc." what i want is to prevent my users from dropping into the "root" shell. the example on this website is not working. any suggetions? – ayali Oct 3 '19 at 11:08
3

Once you define the sudoers specification with the 'ALL' keyword in the commands field, there is no way to effectively prevent the execution of a specific command or set of commands. The sudoers manual explains this in a straightforward manner:

Limitations of the ‘!’ operator

It is generally not effective to “subtract” commands from ALL using the ‘!’ operator. A user can trivially circumvent this by copying the desired command to a different name and then executing that. For example:

bill ALL = ALL, !SU, !SHELLS

Doesn't really prevent bill from running the commands listed in SU or SHELLS since he can simply copy those commands to a different name, or use a shell escape from an editor or other program. Therefore, these kind of restrictions should be considered advisory at best (and reinforced by policy).

In general, if a user has sudo ALL there is nothing to prevent them from creating their own program that gives them a root shell (or making their own copy of a shell) regardless of any ‘!’ elements in the user specification.

The only way to avoid the scenario described above is to have a list of allowed commands that the user can execute, i.e. a whitelist.

1

That is not possible, because there is always a way to act as root as long as you do not white list specific commands in the sudoers file.

If you don't mind disabling the root login shell completely, you could do that.

It would still be possible for any sudo user to undo this ofcourse.

  • 1
    using this method disables SSH access but no preventing users from using " sudo -s" to su into the root user – ayali Oct 3 '19 at 10:07
0

Remove the users from the sudo group and create a new group, say, restricted.

Then, in /etc/sudoers (or better yet, in a file under /etc/sudoers.d) you add something like this:

%restricted ALL=NOPASSWD: /usr/bin/command1,/etc/init.d/command2 restart

The users in that group will only be able to run those commands.

  • Hi, That was not my question :) – ayali Oct 2 '19 at 14:09
  • You're right. Sorry. – Eduardo Trápani Oct 2 '19 at 14:27
  • This new answer might solve it. – Eduardo Trápani Oct 2 '19 at 14:36
  • /usr/bin/rsync? Hopefully you won't be surprised when someone you gave the ability to run rsync as root to uses that to get full root privileges. "Gee, I have root rsync!!!! I can copy /etc/shadow out, change or remove the root password, and copy it back!" – Andrew Henle Oct 2 '19 at 14:47
  • @AndrewHenle that is not an actual entry. But I'll edit it so as to not distract people from the actual solution. – Eduardo Trápani Oct 2 '19 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.