Sudo - Revision history

Jimbo at 11:49, 25 February 2006

2006-02-25T11:49:30Z

2006-02-25T11:48:29Z

2004-12-27T05:32:37Z

Gotchas

2004-09-29T04:30:40Z

Bad side of sudo

2004-09-14T16:21:51Z

2004-09-14T12:55:17Z

Gotchas

2004-09-14T12:52:40Z

Gotchas

2004-09-14T05:41:54Z

2004-09-14T04:52:44Z

2004-09-13T19:08:17Z

← Older revision		Revision as of 11:49, 25 February 2006
Line 1:		Line 1:
−	[[sudo]] allows a user to run a program or perform a task without having to login as [[root]] directly or even knowing the root password. [[sudo]] works by authenticating the user (with the user's password) against the /[[etc/sudoers]] file that gives specific rights to run sudo. Note that you have to use [[visudo]] to edit /etc/sudoers, and that you have to do it as root; you can't do it any other way. Apple's Mac OS X, based on the BSD Darwin kernel, has the root user disabled by default, and the only way to get [[root]]-level access to commands on the OS X command line (in a terminal or from the command-line console,) is by using [[sudo]].	+	[[sudo]] allows a user to run a program or perform a task without having to login as [[root]] directly or even knowing the root password. [[sudo]] works by authenticating the user (with the user's password) against the /[[usr/local/etc/sudoers]] file that gives specific rights to run sudo. Note that you have to use [[visudo]] to edit /etc/sudoers, and that you have to do it as root; you can't do it any other way. Apple's Mac OS X, based on the BSD Darwin kernel, has the root user disabled by default, and the only way to get [[root]]-level access to commands on the OS X command line (in a terminal or from the command-line console,) is by using [[sudo]].

	==Good side of sudo==		==Good side of sudo==

← Older revision		Revision as of 11:48, 25 February 2006
Line 1:		Line 1:
−	[[sudo]] allows a user to run a program or perform a task without having to login as [[root]] directly or even knowing the root password. [[sudo]] works by authenticating the user (with the user's password) against the /etc/sudoers file that gives specific rights to run sudo. Note that you have to use [[visudo]] to edit /etc/sudoers, and that you have to do it as root; you can't do it any other way. Apple's Mac OS X, based on the BSD Darwin kernel, has the root user disabled by default, and the only way to get [[root]]-level access to commands on the OS X command line (in a terminal or from the command-line console,) is by using [[sudo]].	+	[[sudo]] allows a user to run a program or perform a task without having to login as [[root]] directly or even knowing the root password. [[sudo]] works by authenticating the user (with the user's password) against the /[[etc/sudoers]] file that gives specific rights to run sudo. Note that you have to use [[visudo]] to edit /etc/sudoers, and that you have to do it as root; you can't do it any other way. Apple's Mac OS X, based on the BSD Darwin kernel, has the root user disabled by default, and the only way to get [[root]]-level access to commands on the OS X command line (in a terminal or from the command-line console,) is by using [[sudo]].

	==Good side of sudo==		==Good side of sudo==

@@ Line 11: / Line 11: @@
 ==Gotchas==
-. You can use the -u flag to set a user to run as. (e.g.: '''su -u named /usr/local/sbin/rndc reload''')
+. You can use the -u flag to set a user to run as. (e.g.: '''sudo -u named /usr/local/sbin/rndc reload''')
 . [[sudo]] is a [[setuid]] binary. Be '''careful''' what you set as sudo-able; if you let sudo run interactive commands (e.g., shells, editors, compilers/interpreters), users will be able to exploit this to inconspiciously run arbitrary commands as root.  Similarly, make very certain that users don't have write permissions on any file they are allowed to use [[sudo]] to run.  For more information on how to limit [[sudo]], see [[Configuring_sudo]].

@@ Line 8: / Line 8: @@
 ==Bad side of sudo==
 Difficult to configure correctly (or rather, really easy to misconfigure if you're not sure of what you're doing).
 ==Gotchas==

← Older revision		Revision as of 16:21, 14 September 2004
Line 1:		Line 1:
−	[[sudo]] allows a user to run a program or perform a task without having to login as [[root]] directly or even knowing the root password. [[sudo]] works by authenticating the user (with the user's password) against the /etc/sudoers file that gives specific rights to run sudo. Note that you have to use [[visudo]] to edit /etc/sudoers, and that you have to do it as root; you can't do it any other way.	+	[[sudo]] allows a user to run a program or perform a task without having to login as [[root]] directly or even knowing the root password. [[sudo]] works by authenticating the user (with the user's password) against the /etc/sudoers file that gives specific rights to run sudo. Note that you have to use [[visudo]] to edit /etc/sudoers, and that you have to do it as root; you can't do it any other way. Apple's Mac OS X, based on the BSD Darwin kernel, has the root user disabled by default, and the only way to get [[root]]-level access to commands on the OS X command line (in a terminal or from the command-line console,) is by using [[sudo]].

	==Good side of sudo==		==Good side of sudo==

@@ Line 14: / Line 14: @@
 . You can use the -u flag to set a user to run as. (e.g.: '''su -u named /usr/local/sbin/rndc reload''')
-. [[sudo]] is a [[setuid]] binary. Be '''careful''' what you set as sudo-able; if you let sudo run interactive commands (e.g., shells, editors, compilers/interpreters) users will be able to exploit this to get arbitrary commands to run inconspicously.  Similarly, make very certain that users don't have write permissions on any file they are allowed to use [[sudo]] to run.  For more information on how to limit [[sudo]], see [[Configuring_sudo]].
+. [[sudo]] is a [[setuid]] binary. Be '''careful''' what you set as sudo-able; if you let sudo run interactive commands (e.g., shells, editors, compilers/interpreters), users will be able to exploit this to inconspiciously run arbitrary commands as root.  Similarly, make very certain that users don't have write permissions on any file they are allowed to use [[sudo]] to run.  For more information on how to limit [[sudo]], see [[Configuring_sudo]].
 [[Category:System Commands]] [[Category:Ports and Packages]]

← Older revision		Revision as of 05:41, 14 September 2004
Line 10:		Line 10:


−	~~See~~ [[Configuring_sudo]]	+	==Gotchas==
		+
		+	1. You can use the -u flag to set a user to run as. (e.g.: '''su -u named /usr/local/sbin/rndc reload''')
		+
		+	2. [[sudo]] is a [[setuid]] binary. Be '''careful''' what you set as sudo-able; if you let sudo run interactive commands (e.g., shells, editors, compilers/interpreters,) since it's possible to exploit this to get arbitrary commands to run inconspicously. For more information on how to limit [[sudo]], see [[Configuring_sudo]].
		+
		+

	[[Category:System Commands]] [[Category:Ports and Packages]]		[[Category:System Commands]] [[Category:Ports and Packages]]

← Older revision		Revision as of 04:52, 14 September 2004
Line 9:		Line 9:
	Difficult to configure correctly (or rather, really easy to misconfigure if you're not sure of what you're doing).		Difficult to configure correctly (or rather, really easy to misconfigure if you're not sure of what you're doing).

		+
		+	See [[Configuring_sudo]]

	[[Category:System Commands]] [[Category:Ports and Packages]]		[[Category:System Commands]] [[Category:Ports and Packages]]