7 ms·

"sudo -i", please!

• spc476 15y ago
  sudo vi^Mpassword^M:shell Years ago a friend of mine asked my help in securing a Unix system with sudo. I bascially told him it was nearly impossible because there were (and still are) too many ways to escape back to a root shell with sudo, so, in my humble opinion, gives a false sense of security.
  • marshray 15y ago
    But as far as letting people run a root shell goes, sudo is a handy way to do it.
  • chousuke 15y ago
    I don't think the point is "more secure" root access. Rather, sudo is just a convenient way to invoke superuser privileges only when necessary. If you need a longer session with uid 0, use sudo -i. Having a separate root login is pretty much pointless. I doubt having separate passwords helps security either, since local privilege escalation vulnerabilities are common anyway. I've used sudo to restrict root access to specific command line invocations for certain users. With due care (ie. no access to software with shell escapes) it is secure. In any case, distributions seem to be moving towards eliminating the superuser altogether in common use cases. I think advocating sudo was just the beginning.
  • graywh 15y ago
    start by disallowing vi through sudo and tell people to use sudo -e instead