sudo versus #

[Avi Greenbury]

astor JW wrote:

> On Wednesday 10 February 2010 1:43:40 pm Bill Marcum wrote:
> > On 2010-02-10, KAYVEN RIESE <kayve at sfsu.edu> wrote:
> > >
> > > Also, I notice that when Ubuntu gives me those update dialog
> > > boxes my root password doesn't work to allow the installation to
> > > go forward.  This makes me irritated, because it instead wants my
> > > normal user password, which for me by design is a weaker password
> > > that I use for more things and thus could be more easily
> > > cracked.  My root password is longer and I use it for less
> > > things.  Both are immune to dictionary attack, but it bothers me
> > > the way this subverts my configuration.
> 
> So remember how frustrated and irritated you became trying to install 
> something as root.  Think about it from the point of view of person
> trying to hack into your system.  He of course first tries the root
> account and spends some time trying to find a non-existant password
> for root.  

Surely he'd first try a normal user account password? They're
entered more frequently, less well guarded, and actually have rights to
log into the box (you did disable root ssh logon, amd
clear /etc/securetty didn't you?).

> likely he doesn't understand sudo even as well as you do. 

And here's the other issue - sudo's quite easy to get wrong. 

It's not insecure by default, but I've seen several times where it's
been configured exclusively - "give user X permission to do everything
except A, B and C" - but where the configuration hasn't barred sudoers
from executing /bin/sh (or even su).
It's actually quite difficult to configure properly, and I think most
people wont bother, and will just give whoever needs rights to
traceroute rights to do everything.

That said, it is very much personal preference. I don't think there's
that much in terms of security in it - either configuration can be made
substantially more secure than the default. My flavour of laziness
means I configure a root password in order to not prepend five
characters to every command I want to run as root.

-- 
Avi Greenbury
http://aviswebsite.co.uk ;)
http://aviswebsite.co.uk/asking-questions