4 ms·

> Passworded sudo is just another roadblock to give you more time. The problem with this world-view is that it's a fallacy. You're assuming that people won't b

• kbenson 5y ago
  > The problem with this world-view is that it's a fallacy. There's nothing fallacious about the concept that security controls are just roadblocks. There is no such thing as perfect security for a system that requires someone to be able to access or use it. All security controls do is provide time and/or notification of someone trying to break in, if all goes well. Then you can hope to mount a more active defense of some sort if needed. > You're assuming that people won't be bothered by having to re-type their password all the time, and just implement a "secure" script using a setuid bit instead. Obviously there's a trade off for how cumbersome it is to use something in an authorized manner and how much people will attempt to work around that inconvenience. What is a fallacy is that any inconvenience in the same of security is not worthwhile. In many configurations of sudo shipped by default in common distros, it caches your auth for that tty for a number of minutes, so after you auth you don't have to auth again for a while. You can easily change this, and make it so that after you auth in a tty, you won't have to auth again for 24 hours if you wanted. You would still have quite a bit of protection from attackers (at least those that weren't at an unlocked screen of yours with one of those terminals), and entering a password once a dayis probably acceptable to most people (in reality, once a day per terminal they want to use it in, but it's not hard to keep one terminal open for secure use). > Now someone else intentionally adds the ability to allow that script to execute arbitrary commands and you've got a vulnerability with passworded sudo that would have never happened with passwordless sudo. It's hard to protect against stupidity. Either train people to not to stupid things, or if your security policy is actually too onerous, then reassess what the correct policy should be and implement it. To be clear, I doubt the correct policy is "let's just turn off all the security because we're lazy". > That's conceptually the same as insisting on passworded sudo in terms of security. It's easy to say it is, because almost everything is conceptually the same thing if you boil them down to a few related concepts and attributes and then ignore the magnitude and impact of those things. I mean, shooting someone with a Nerf gun and shooting someone with a Glock are conceptually the same things, right? So, please, let's not act like having to enter your password once every few minutes when needed for root access (or longer, if you configure it to) is equivalent to jumping through multiple systems, authing additional times at each level, and requiring OOB auth additionally. If you're really annoyed by sudo, just "sudo bash" and keep the terminal open. At least you still get some protection from local user access privilege escalation.