3 ms·
I've been using busybox vi as my root editor but it doesn't have secure mode which disables shell access within vi. It looks like OpenVi and nvi2 have them. Are
by ayushnix 5y ago
I've been using busybox vi as my root editor but it doesn't have secure mode which disables shell access within vi. It looks like OpenVi and nvi2 have them. Are they preferable to busybox vi if I want better security as a root editor?
- pletnes 5y agoIf you’re that paranoid, isn’t it better to run the editor on some other machine? E.g vim with scp support? Then there’s no editor to infect/replace/screw with on the Important Server.
- mprovost 5y agoSecure mode doesn't really make anything more secure if you're the one using it. It just lets you add it to the list of allowed commands in the sudoers file without giving someone a root shell. We used to do that all the time at one job that didn't let you log in as root and wanted you to do everything through sudo. You'd just sudo vi /some/random/file and then :! and have a root shell.
- trn 5y agoOpenVi uses only secure functions (snprintf, strlcpy, etc.) as a matter of policy. This may lead to a more secure editor for untrusted files, but it depends on how careful the other editors are. (I haven't examined them at that level.)