3 ms·

> permit nopass keepenv yourusername Isn't nopass a bad idea? Edit: I'm not a BSD user - this is a genuine question, not a complaint.

jlgaddis 10y ago
"It depends." (NB: "nopass" for doas is the equivalent of sudo's "NOPASSWD".) Like most things relating to security, whether its use is "a bad idea" or not depends on many, many things: the attack surface, whom you are trying to defend against, other mitigations in place that protect the host, etc. As a general rule, I'd say that yes, it is a bad idea. However, I have an OpenBSD 5.9 laptop sitting here next to me on my desk at home: $ cat /etc/doas.conf permit nopass jeremy It also has a very restrictive firewall, allows SSH connections from a very limited set of remote hosts, has only one user account that can log in via SSH, allows authentication only via keys, runs no other services that can be accessed remotely, and uses full-disk encryption. The one user account on the host has a very long, complex password that I often have to look up in 1Password when logging in or resuming. Is it "a bad idea" to use "nopass" in this case? Strictly speaking, sure, but I'm really not too worried about it. There are a limited number of people who have physical access to it: myself, my girlfriend, friends & visitors we have over, and the few others who have a key to my house -- along with, I suppose, anyone who might break in, law enforcement armed with a warrant, and so on. I have, mentally, calculated the risk of the laptop being compromised via the use of "nopass" and deemed this risk acceptable. On the other hand, I have OpenBSD servers in data centers and even though the physical security is very good in those facilities, I do not allow "nopass" on those machines -- primarily because they do not have some of the "mitigations" that this laptop on my desk does.
mcpherrinm 10y ago
This is Linux-based, because I don't have FreeBSD experience, but is related in security posture. I have a more controversial opinion: If you're going to use `sudo`, you shouldn't use passwords. Your login passwords should only be given to the login prompt, which you hopefully have some reasonable faith in its integrity (if not; game over already). If you're typing your password into terminals after login, that's a great place to steal your password. I would much prefer to use pam_krb5 to "kinit on login", and then by sudo to authenticate your session. Then you shouldn't ever be tempted to type your password into potentially untrusted programs. Of course, if you're sure you have no malware on your computer, then there's also no need for a sudo password -- nobody but yourself could be running commands!
- catern 10y ago
  What if your root password is different from your regular password? For example - if you have a Kerberos root principal? That seems even better.
  - lmm 10y ago
    Sudo/doas never involves giving the root password. (Whether it's better not to use sudo/doas at all is a separate question).

jlgaddis 10y ago

"It depends." (NB: "nopass" for doas is the equivalent of sudo's "NOPASSWD".) Like most things relating to security, whether its use is "a bad idea" or not depends on many, many things: the attack surface, whom you are trying to defend against, other mitigations in place that protect the host, etc. As a general rule, I'd say that yes, it is a bad idea. However, I have an OpenBSD 5.9 laptop sitting here next to me on my desk at home: $ cat /etc/doas.conf permit nopass jeremy It also has a very restrictive firewall, allows SSH connections from a very limited set of remote hosts, has only one user account that can log in via SSH, allows authentication only via keys, runs no other services that can be accessed remotely, and uses full-disk encryption. The one user account on the host has a very long, complex password that I often have to look up in 1Password when logging in or resuming. Is it "a bad idea" to use "nopass" in this case? Strictly speaking, sure, but I'm really not too worried about it. There are a limited number of people who have physical access to it: myself, my girlfriend, friends & visitors we have over, and the few others who have a key to my house -- along with, I suppose, anyone who might break in, law enforcement armed with a warrant, and so on. I have, mentally, calculated the risk of the laptop being compromised via the use of "nopass" and deemed this risk acceptable. On the other hand, I have OpenBSD servers in data centers and even though the physical security is very good in those facilities, I do not allow "nopass" on those machines -- primarily because they do not have some of the "mitigations" that this laptop on my desk does.

mcpherrinm 10y ago

This is Linux-based, because I don't have FreeBSD experience, but is related in security posture. I have a more controversial opinion: If you're going to use `sudo`, you shouldn't use passwords. Your login passwords should only be given to the login prompt, which you hopefully have some reasonable faith in its integrity (if not; game over already). If you're typing your password into terminals after login, that's a great place to steal your password. I would much prefer to use pam_krb5 to "kinit on login", and then by sudo to authenticate your session. Then you shouldn't ever be tempted to type your password into potentially untrusted programs. Of course, if you're sure you have no malware on your computer, then there's also no need for a sudo password -- nobody but yourself could be running commands!

catern 10y ago
What if your root password is different from your regular password? For example - if you have a Kerberos root principal? That seems even better.
- lmm 10y ago
  Sudo/doas never involves giving the root password. (Whether it's better not to use sudo/doas at all is a separate question).