Legatus wrote:
On Mon, Aug 4, 2008 at 10:35, David Brown <[EMAIL PROTECTED]> wrote:
On Mon, Aug 04, 2008 at 02:20:10AM -0700, Ralph Shumaker wrote:
The manuals have enlightened me on some things, but confused me on many
others. I want rafael to have full sudo access, but only if he is at this
keyboard I am using right now, regardless of whatever IPv4 (or IPv6) address
is currently assigned to eth0 by my DSL ISP. I don't know if the IPv6
address ever changes. I haven't paid attention. If it doesn't, perhaps I can
somehow use that to lock it in?
Do you plan on not allowing remote logins for this user?
I think this hits what is necessary for you to do what you want. Create two
users for these people.
1) Can log in remotely only, and doesn't have sudo access to commands
2) Can log in locally, and does have sudo access to commands.
I all you are trying to do is allow access to shutdown and reboot the
system. PAM allows you to set restrictions for who and where you are allowed
to reboot as and from.
You might be able to affect access to run sudo using PAM, if sudo is
compiled with PAM support.
I really think PAM is your only solution on determining where a user is
coming from for something like this, without writing a wrapper script of
some sort.
Actually, if it's possible to disable remote login, that's probably good
enough. But are there ways someone could crack rafael remotely without
logging in? If I give wide open sudo access to user rafael, I just want
to minimize risk that someone could gain root access. If I cannot limit
that risk, then why not just run as root in the first place?
This is essentially a single user machine. I have a couple of users for
myself (for convenience of separating work and personal). I have a
couple other users, for whenever they visit, though they don't keep
anything that needs to be backed up or safeguarded.
Maybe I'm just overthinking the whole thing. It's hard to know what I
need when I barely even know what I need to know. I probably should
have put this on the newbie list, but it seemed a little to technical
for that forum.
Currently, whenever I want root access, I generally launch
gnome-terminal, "su -", and then type the command "gnome-terminal" so
that I can hit Shift-Ctrl-T and have multiple root tabs without having
to enter root password more than once. But others have persuaded me
that sudo command logging can be a valuable tool for "How the hell did
*that* happen?".
I don't know how vulnerable I have made myself with keeping root-owned
gnome-terminals open. And I don't have anything crucial on here, but I
still wouldn't want to have to re-create any of it if not needed. sudo
sounds like it would insulate me more than my current practice.
--
Ralph
--------------------
If the American people ever allow private banks to control the issue of
currency ... the banks and corporations that will grow up around them
will deprive the people of their property until their children wake up
homeless on the continent their fathers conquered.
--Thomas Jefferson
--
[email protected]
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list
