Questions tagged [sudo]
`sudo` is a command that allows a user to use commands with the privileges of another user, usually the root user.
87 questions
1 vote
1 answer
141 views
Is static linking setuid libraries musl libc an effective defense against chroot/mount attacks?
Seems a lot of privileged escalation involves replacing libc or another dependency of a setuid binary like "sudo" with something an attacker controls. To ensure this, a wide range of file ...
- 71
1 vote
1 answer
75 views
Active Directory Computer accounts in User Groups
We are using SSSD to connect RHEL systems to Microsoft Active Directory. Access is granted to groups using the SSSD simple_allow_groups option and those groups are also used to allow sudo access. Some ...
- 111
10 votes
3 answers
3k views
Linux root account without password - what are the issues, and how to address them?
A number of Linux distros, for quite a while now, by default install no root passwords and always require sudo from another user to become root. Examples are Ubuntu and AWS. This is implemented with ...
- 1,201
0 votes
0 answers
114 views
How to exploit Python script and sudo subprocess shared file handle?
I am wondering what attacks would be theoretically possible against a Python script that executes a subprocess involving sudo. I know that asking for the sudo password using input() or getpass(), then ...
3 votes
1 answer
259 views
Is it wise to use sudo in .bash_aliases?
My ~/.bash_aliases contains aliases such as the following examples: alias duh="sudo du -sh ./* | sort -hr | head -n 10" alias pcm="sudo pcm -nc -nsys" Question is, how smart that ...
- 259
7 votes
3 answers
2k views
Security implications of increasing sudo timeout in terminal
I often need to run commands with sudo during development and since my password is lengthy I don't like to type it every time sudo times out which by default is 5 minutes. To deal with that I've run ...
- 259
1 vote
1 answer
166 views
Sudo user without ability to login
I have a main user with home folder encryption enabled. To avoid typing long phrase each time I want to have another user with sudo privilege and weak password. In the terminal I would first switch ...
- 121
2 votes
2 answers
2k views
Risks and recommendations of using passwordless sudo
Given that I'm the only human who should have access to a Linux server, what are the major security risks associated with updating sudo to not require a password for my local user? Are there other ...
- 123
11 votes
2 answers
4k views
The rationale behind allowing `sudo -u root` but disallowing `sudo -u <any other user>`
I'm working with a customer where I use a functional user ID, created specifically for the purpose, to install and configure some software on multiple servers. The customer's security policies, ...
- 181
0 votes
2 answers
420 views
Is Windows UAC's clicking OK authentication as secure as macOS/Linux's password authentication?
Windows only show [Yes] or [No] for the same thing as Linux's sudo. macOS/Linux both require you to type the password. Is the password-less Windows implementation almost as secure as password-...
- 237
0 votes
0 answers
120 views
sudo with a USERID
This question relates to a comment on a question I posted at https://askubuntu.com/questions/1426688/sudo-with-a-userid-reverting-old-behaviour?noredirect=1#comment2484447_1426688 Specifically, in ...
- 713
1 vote
2 answers
300 views
How to securely use `pass`, `sudo`, and `npm` on the same machine
TL;DR: running npm i ... not long after pass my-password allows a malicious package to steal my entire password store. I use pass as a password manager, on Linux. And like probably all Linux users, I ...
- 113
1 vote
1 answer
514 views
Security difference between changing permissions versus using sudo to execute
If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
- 13
1 vote
1 answer
230 views
Read files protected with System Integrity Protection with sudo
I had a debate with a friend about the security model in new OS X versions. OS X El Capitan and newer have the System Integrity Protection security feature which protects aspects of the OS even from ...
- 633
1 vote
1 answer
1k views
Using GPG from another user (GNU/Linux)
I want to use gpg from another user (user2), so that the primary user (user1) does not have access to the encrypted file, but only to the part the script will output. Added a sudo rule for user1 to ...
- 735