Any program like `sudo` to gain root by having two users enter a password?

Requiring dual approval for certain actions is part of some security policies; for example:

• In banking, very large transactions typically require validation by two managers.
• Launching heavy weapons such as nukes requires validations by two or more high-ranking officers or decision-makers.
• Approving or rejecting a suggested edit on Stack Overflow requires two users with sufficient reputation to agree.

You'll note that this is not about authentication (e.g. typing a password to show that you're who you pretend to be), but about authorization, i.e. deciding whether a certain action is permitted.

For background reading, I recommend Security Engineering by Ross Anderson. Buy the latest edition if you can, but otherwise the first edition is available online. The most relevant chapter is “Access Control”; there are examples in the chapters on banking and nuclear command.

Unix offers a simple security model, with only two levels: user and superuser. This is both a strength (simple means less room for errors in the design and implementation of the system itself and of security policies) and a weakness (complex security policies cannot be expressed natively). If you're worried about a rogue user gaining root, don't give him root permissions. There are very few checks on what root does; the only constraint would be that the action of gaining root can be logged remotely, as can certain external actions (network traffic). A rogue user could pretend to want to gain root to do a certain thing and actually do another while hiding his actions from the other user. So you would not gain much security by requiring root access to be vetted by another user. Conversely, you would lose security by reducing the availability of root access (I gather you want to give less trusted users root access to serve as back-ups if something goes wrong; dual approval would increase the burden a lot).

Dual approval is useful for specific actions: Alice says “please authorize me do do X”, Bob says “I authorize Alice to do X”, and the system performs X (X can be e.g. transferring $1,000,000,000 from one bank account to another, or nuking Moscow, or rejecting an edit). If Alice says “please authorize me to do anything I want” and Bob agrees, all Bob is doing is echoing what you (the policy maker) already said, namely that Alice can be authorized to do anything. You might as well make Alice a sudoer.

I don't know of any existing system on unix to have multiple users approve specific commands in a sudo-like framework.

This may be what you are looking for:

https://github.com/square/sudo_pair

sudo_pair is a plugin for sudo that requires another human to approve and monitor privileged sudo sessions.

The only way I can think of doing such a thing would be to create an account in /etc/passwd ( and /etc/shadow ) with uid 0 (for full access) or which belongs to the group(s) which provide proper access.

Then, set the password, telling the first person the first five characters and the second person the other five characters. Since passwords no longer have a limit of eight chars (like the old days), you can do this for as many people as you like (e.g. a 20 char sting with four characters being given to each of five people).

Of course, once in the account, they could just reset the password to something any one of them could use (in the case of uid = 0). So if you really have trust issues like this, then you have bigger problems on your hand than this.

Just a minor comment on the mathematical issues here. One problem with splitting the password is that having half the password makes it easier to crack the rest. However, there are ways to specify two pieces of information that combine to give a key in such a way that either one piece of information by itself does not give any help whatsoever.

A rather simple example of this is to say: "The key is the sum of the two numbers, modulo 10". Then each person gets a number between 0 and 9 but that number by itself gives them no information. If Alice has 3, then the key could still be absolutely anything between 0 and 9 so she still has no advantage in cracking the code. It's only when Bob turns up and has 9 that together they can access the system with the key 2.

Of course, in a practical situation you'd want a way to ensure that Alice and Bob could enter their keys without the other seeing them.

For this situation, I'd agree with the others. Restricted access via sudo (read the manual) together with good logging. Then if they do try to do something bad, you'll have the logs (which they didn't get access to because you only gave them restricted access!).

You could have a process that runs in the background as root, that checks for certain conditions that both users must fullfill, and then copies in /etc/sudoers and removes it again after a few minutes. Both users could have to touch a file with with todays date as the filename in their home directory, for example. The background process could remove this file or disregard it after it was used once.

I also think that PAM has support for exotic types of authentication (like fingerprints and cards), so PAM might be worth looking into.

I don't know of any such program.

I think in general, it's flawed and gives you no more security than allowing a single user trusted access to limited commands.

Personally, I wouldn't give anyone I didn't know personally sudo access, even to a subset of commands, because it's too easy to miss something and give them access you don't anticipate.

Trust them, or don't trust them, building layers of not quite trusting them doesn't help.

It is probably easy to implement this by creating a superuser why has a long password, first half from the first authorized user, second from another (something like paul_john where paul and john are ordinary users).

The drawback, you would need such an account per every user pair but this would not require any changes in the software. These accounts could be listed in /etc/sudoers, authorizing them for the needed actions.

Be sure to have the policy the account must be immediately logged out if one of the authorized users go away from the terminal.