Ian Blackwell wrote:
Plant, Dean wrote:
I see your trying to protect your users from becoming root. You do realise that with that sudo configuration a user can still run "sudo /bin/bash" or any of the other shells to gain root access.
Hi Dean,
I don't think that's correct. One of the purposes of the sudoers file is you can limit users to specific programs, excluding them from others. This entry, which I just tested in my CentOS5.2 box, allows the user tldap to use yum, but not /bin/bash:- tldap ALL=/usr/bin/yum
Here's what happens when I try sudo as user tldap:- 2.6.18-92.1.1.el5.centos.plusxen[tldap@www ~]$ sudo yum update Loading "fastestmirror" plugin Loading "priorities" plugin Loading mirror speeds from cached hostfile
- base: rsync.atworks.co.jp
- updates: rsync.atworks.co.jp
- centosplus: mirror.exetel.com.au
- addons: mirror.exetel.com.au
- extras: mirror.exetel.com.au
0 packages excluded due to repository priority protections Setting up Update Process No Packages marked for Update 2.6.18-92.1.1.el5.centos.plusxen[tldap@www ~]$ sudo /bin/bash Sorry, user tldap is not allowed to execute '/bin/bash' as root on www 2.6.18-92.1.1.el5.centos.plusxen[tldap@www ~]$
Yes you are correct in your example only yum would run and no exclude is required. We can not see from his posting exactly what commands he is allowing as he is calling groups.
What I was trying to point out is that if is he is disabling commands like su then they must be enabled somewhere in the groups he is calling and it is good practice to disable all the shells as well. All my sudoers lines that call groups like he was trying to do always have a !SU, !SHELLS to specifically deny root access.
Anyway I will shut up now as none of this will help fix his problem.
Dean