4 ms·

I lock my computer when not near it. If my computer is breached, having user level access of the one account permitted sudo is pretty much Crown Jewels. If you

I lock my computer when not near it. If my computer is breached, having user level access of the one account permitted sudo is pretty much Crown Jewels. If you really wanted to privesc you could sniff X11 keystrokes or back door bashrc, but either way even user level access screws me so whatever do what you want after that. As a result, I just enable passwordless sudo.

rollcat 4y ago
You're right, once an adversary gains physical access (or even remote access as your main login account), all bets are off. This is the area where the traditional UNIX security model has failed to adapt at all: you need a password to install a random game from apt (a vetted and trusted source), but you don't need a password to install a cryptolocker, or exfiltrate personal data. However I like having a password (or some other form of confirmation), just so that I can stop to think for a second, whether what I'm about to do is a good idea. What's annoying is that I effectively need two different policies on workstations and on servers, since I still want to be able to escalate privileges from maintenance scripts[1]. [1]: https://github.com/rollcat/judo/issues/9 https://github.com/rollcat/judo/issues/9
PureParadigm 4y ago
I do the same. I've yet to hear a convincing argument against this practice. Everyone seems okay with passwordless docker and you can use that to privilege escalate too.
- hsbauauvhabzb 4y ago
  I use FDE so I’ve also configured gdm3 to auto login, login and screen lock are two separate concepts and I only use the latter :)
deckard1 4y ago
yep. What I did in the past, back when yubikey first came out, was I added a PAM module to check the presence of the yubikey. It's almost comically stupid since it just checks that the key is inserted with the correct serial number. But you'd need root to see what the number is (to emulate it with a fake usb device, I guess), and to get sudo you'd need the key inserted. I WFH so I'd just leave the key inserted for passwordless sudo all the time. But if I needed to step out, just grab the yubikey and go.

rollcat 4y ago

You're right, once an adversary gains physical access (or even remote access as your main login account), all bets are off. This is the area where the traditional UNIX security model has failed to adapt at all: you need a password to install a random game from apt (a vetted and trusted source), but you don't need a password to install a cryptolocker, or exfiltrate personal data. However I like having a password (or some other form of confirmation), just so that I can stop to think for a second, whether what I'm about to do is a good idea. What's annoying is that I effectively need two different policies on workstations and on servers, since I still want to be able to escalate privileges from maintenance scripts[1]. [1]: https://github.com/rollcat/judo/issues/9 https://github.com/rollcat/judo/issues/9

PureParadigm 4y ago

I do the same. I've yet to hear a convincing argument against this practice. Everyone seems okay with passwordless docker and you can use that to privilege escalate too.

hsbauauvhabzb 4y ago
I use FDE so I’ve also configured gdm3 to auto login, login and screen lock are two separate concepts and I only use the latter :)

deckard1 4y ago

yep. What I did in the past, back when yubikey first came out, was I added a PAM module to check the presence of the yubikey. It's almost comically stupid since it just checks that the key is inserted with the correct serial number. But you'd need root to see what the number is (to emulate it with a fake usb device, I guess), and to get sudo you'd need the key inserted. I WFH so I'd just leave the key inserted for passwordless sudo all the time. But if I needed to step out, just grab the yubikey and go.