37

I'm trying to set up a deploy script using Capistrano At a step cap deploy:setup script is connecting to my server and trying to run commands that create directories. Then I see an error: msudo: sorry, you must have a tty to run sudo

There is a suggested solution to disable requiretty on my server. https://unix.stackexchange.com/a/49078/26271

I'm wondering if it is safe to do?

37

There is a very limited security advantage in having requiretty on a server. If some non-root code is exploited (a PHP script, for example), the requiretty option means that the exploit code won't be able to directly upgrade its privileges by running sudo.

There may be another way for the attacker to gain root, and of course the attacker will still be able to deface your site, but not letting the attacker gain root means that other services running as different users will keep running normally and the attacker won't be able to erase system logs. If none of your sudo rules do anything dangerous like creating a directory, this isn't a concern.

Furthermore — and more damning for requiretty — no privilege is needed to create a tty, e.g. with expect. So you might as well turn off requiretty: on its own, it does not provide a security advantage. It does provide a mild auditability advantage when executed by users (because the logs give a better idea of who invoked sudo and where they're coming from), but not when executed from a background job.

  • 1
    Do you mean that if the user can run expect (or screen for example), then requiretty is useless from a security point of view? (I didn't quite understand what you meant by "damning" in that sentence) – Georges Dupéron Sep 18 '13 at 21:27
  • @GeorgesDupéron Yes, that's it. Since anyone can create a tty, the requiretty option doesn't prevent anyone from using sudo. – Gilles Sep 18 '13 at 21:31
  • 3
    requiretty can prevent a user from leaking their password in cleartext, if they are executing a sudo command which requires a password via ssh. It's there to force the user to call ssh -t. – Chris Betti Apr 27 '15 at 3:55
  • 1
    @Chris Betti -- why is that a good thing, to enforce ssh -t ... ? – Rop May 10 '17 at 7:39
  • My thinking at the time was that in this case, if you are executing a remote sudo command that prompts for a password, then it is better to leverage the remote machine's askpass program than to fill the password in cleartext via the console. I honestly have no idea if doing so provides enhanced security, other than possibly preventing the situation where your password is echoed to the screen as you type it. I believe I was thinking that an askpass program would not be invoked without a tty or pseudo-tty. – Chris Betti May 11 '17 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.