4 ms·
If you have more than one person logging in, it's far easier to identify who did something as root by looking at the username that logged in. Also far better t
by isostatic 9y ago
If you have more than one person logging in, it's far easier to identify who did something as root by looking at the username that logged in.
Also far better to encourage running sudo for every command, gives a nice simple audit log of what happened, right there in your syslog, so you can identify and undo mistakes, and also eliminate lines of enquiry.
Clearly you can cover your tracks with the old sudo vi / !bash and similar tricks, but the goal isn't to protect against hostile privileges users, its to know what happened so that when John is on holiday you can see what he did to fix the problem you had last week.
- cuckcuckspruce 9y agoIf your sudoers policy allows you to run vi then you've already failed. sudoedit(8) has been around for a long time and it solves this problem.
- isostatic 9y agoFailed at what? I want my sysadmins to have full access, I just want to know what they did. I'm not trying to defend against malicious staff members - I trust them, otherwise they wouldn't have sudo access.
- cuckcuckspruce 9y agoIf you can trust your administrators then you don't need to worry about shell escapes in editors. The idea for sudoedit is that it allows you to allow non-root users to safely edit files, and if they shell out of their editor then they've not gained root rights - they edit a temporary file as a regular user and then sudo moves the file into place after it is edited.