Re: [linux_var] Sudoers e sicurezza

[marcobev <marcobev@gmail.com>]

Luca Lesinigo ha scritto:

Il giorno 04/mag/09, alle ore 15:19, Wolf L.A.B. ha scritto:

Con mio grande sgomento ho scoperto una falla nella sicurezza dei miei due sistemi grande come una montagna!
Digitando "sudo su" diventavo root senza che mi venisse chiesta la password!

Non è che avevi usato da poco sudo e quindi aveva ancora per buona la tua password utente immessa in precedenza?

googolando un pochino:
http://www.gratisoft.us/sudo/man/sudoers.html#nopasswd_and_passwd

By default, sudo requires that a user authenticate him or herself before running a command. This behavior can be modified via the NOPASSWD tag. Like a Runas_Spec, the NOPASSWD tag sets a default for the commands that follow it in the Cmnd_Spec_List. Conversely, the PASSWD tag can be used to reverse things. For example:

 ray    rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm

would allow the user ray to run /bin/kill, /bin/ls, and /usr/bin/lprm as root on the machine rushmore without authenticating himself. If we only want ray to be able to run /bin/kill without a password the entry would be:

 ray    rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm

Note, however, that the PASSWD tag has no effect on users who are in the group specified by the exemptgroup option.

By default, if the NOPASSWD tag is applied to any of the entries for a user on the current host, he or she will be able to run sudo -l without a password. Additionally, a user may only run sudo -v without a password if the NOPASSWD tag is present for all a user's entries that pertain to the current host. This behavior may be overridden via the verifypw and listpw options.

-- 
                                           __
Marco Bevacqua aka MoBius             |   /\ \   Linux User #277442         
I have a dream of a mega OS with the  |  / /\ \   
logo of a penguin sitting on a window | / /__\ \  Möbius is always 
sill eating an apple.                 | \/____\/  on the right side ;)