0

I want to provide a user to execute all command what a root user can do except from switching to root user.

SO I added as below in sudoers file in centos7/redhat7

guest ALL=(ALL:ALL) NOPASSWD: ALL,!/bin/su - , !/bin/su - , !/bin/su root

but user can still switch as root user using "sudo -i" or "sudo su". How do I prevent user from executing above command or atleast some way to prevent anybody from switching as root user on the server but can run all commands allowed to root user.

3
  • Did you try actually excluding those commands in the file?
    – Nasir Riley
    May 22, 2021 at 10:49
  • 1
    Did you also exclude for example vi? Example: sudo vi /tmp/foo . In vi :sh and again you get a root shell. That's just to tell this method is doomed to fail (ok maybe this example gets some unknown protection with SELinux, I don't know but not everything will).
    – A.B
    May 22, 2021 at 10:53
  • 1
    If you want to prevent users from getting a root shell, you need to provide an approved list of commands; otherwise if they can write anywhere, they can add their own copy of a shell, which won’t be on the denied list, and run that. As A.B hints, you also need to be absolutely certain that the commands on the approved list can’t be used to get a shell; that’s one reason why users shouldn’t be allowed to run editors as root, but use sudoedit instead.
    – Stephen Kitt
    May 22, 2021 at 16:30

1 Answer 1

Reset to default
3

You can't. If you want to allow someone to do anything as root, they don't need su or sudo to become root. Simply allowing them to run chown and chmod as root will give them root access to the server. Heck.. just allowing them to edit the passwd file as root will give them root access... and this could be with cat, echo, sed, awk, vi, vipw, etc, etc.

This is one of the silliest uses of sudo that we see in the security space... allow someone to run anything as root, but don't let them become root. Duh... it doesn't work that way.

Being root by name isn't special... executing as UID 0 is what matters. All someone would need to do is chmod SUID root /bin/bash and they'd be root. Or simply change their UID in /etc/passwd to 0 and they are root as soon as they login. Two easy examples, but there are many more.

Root access should only be granted to those responsible for the system... and at that point, sudo is a joke... just let them su to root. For non-sysadmin users that need limited root capability, then sudo makes sense, but only if you allow very specific command execution and only if you know enough about how the UNIX OS works that you don't give out root access to risky executables... ie vi, chown, chmod, cp, mv, etc, etc. and that you limit the arguments and execution modes of those commands.

3
  • is there possibility whether this can be achieved via /etc/pam.d/su or sudo or sudo-i file?
    – Venom
    May 24, 2021 at 13:12
  • No. Root is always UID 0. There are no config options to change that.
    – mikem
    May 24, 2021 at 23:42
  • You need to know root's password to su to root, you don't need that if sudo is configured to let you do anything, so even in that case sudo is not a joke.
    – Henrik supports the community
    Jan 21, 2022 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .