0

I'd like to disable using sudo to become the root user so that every user will be forced to run privileged commands prefixed by sudo. This way, all these commands will be logged and a history is kept of access and modifications.

Any solution to achieve this?

  • 1
    Please edit your question and tell us what operating system you are using. Do you also want them to not be able to run sudo bash? How about other shells? What if they use sudo to install a new shell, should that also be excluded? What if they use sudo to undo whatever limitation you impose? – terdon Jul 4 at 17:44
  • 1
    What about sudo bash or ln -s /bin/bash /tmp/ls; sudo /tmp/ls? – roaima Jul 4 at 17:48
  • 3
    @EarthMind sudo bash is basically the same as sudo -s (or -i): it will launch a new shell session, as root. If you're OK with sudo bash, you should be OK with sudu -i, both are logged in the same way. – terdon Jul 4 at 18:19
  • 1
    @terdon In that case, I'm not okay with it :) in any case, the reason for this is not because users are not trusted in our environment. It's just to remove a bad habit – EarthMind Jul 4 at 18:29
  • 1
    If they're not trusted, only give sudo access to a single menu command that you write, offering a restricted subset of commands and options. Better still don't offer sudo access at all – roaima Jul 4 at 20:52
2

Friendly reminder to get rid of bad sudo habits

So, if I understand correctly, you 'only' want a friendly reminder to get rid of bad habits. In other words, it is OK with a simple tool, that can easily be removed or worked around.

In that case a simple shellscript in a directory in PATH before the real sudo should work. I suggest that you

  • give it the name sudo
  • put it in the directory /usr/local/bin
  • give it execute permissions

This means that when you or your colleagues type sudo something the system will find

/usr/local/bin/sudo  # the shellscript

before

/usr/bin/sudo        # the real sudo program

Shellscript:

#!/bin/bash

if [ $# -eq 1 ] && (  [ "$1" == "-s" ] || [ "$1" == "-i" ] || [ "$1" == "bash" ] )
then
 echo "Please do not use 'sudo $1'"
 exit
else
 /usr/bin/sudo "$@"
fi

Please tell me, if you want something that is more difficult to remove or work around. In that case I have nothing to offer, and will delete this answer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.