Re: sudoer security problem on server

2009-03-29 Thread Steve Kemp
On Sun Mar 29, 2009 at 10:41:57 -0300, Eduardo M KALINOWSKI wrote: > This will allow them to run make as root. Not only they will be able to > install anywhere (not only under /usr/local), but they can run any > command by creating a Makefile that does what they want to do. Indeed. > If one wa

Re: sudoer security problem on server

2009-03-29 Thread Nate Bargmann
* Eduardo M KALINOWSKI [2009 Mar 29 08:43 -0500]: > > %USER HOSTNAME=NOPASSWD: /usr/bin/make > > > > I replace USER and HOSTNAME with my local values. The sudoers man page > > is quite extensive as well. > > > > This will allow them to run make as root. Not only they will be able to > inst

Re: sudoer security problem on server

2009-03-29 Thread Eduardo M KALINOWSKI
Nate Bargmann wrote: > I'm no security or sudo expert, but it seems to me that the devs should > only have access to the commands they need. For example if they need > to install to /usr/local/ using `make install' you can enable that > specific command. For example I did that for myself (single

Re: sudoer security problem on server

2009-03-29 Thread Nate Bargmann
* zhang zhengquan [2009 Mar 28 19:27 -0500]: > I wonder if a sysadmin should keep the root privilege safe and not > give sudo to anybody anybody else. and if there is more secure ways of > enabling root privilege to normal users? I'm no security or sudo expert, but it seems to me that the devs sh

Re: sudoer security problem on server

2009-03-29 Thread Nate Bargmann
* zhang zhengquan [2009 Mar 28 19:27 -0500]: > I wonder if a sysadmin should keep the root privilege safe and not > give sudo to anybody anybody else. and if there is more secure ways of > enabling root privilege to normal users? I'm no security or sudo expert, but it seems to me that the devs s

Re: sudoer security problem on server

2009-03-28 Thread Sudev Barar
2009/3/29 zhang zhengquan : > Hi, there, > I am exposed to a sudoer security problem on a server. > the server is running debian etch and every so often users on it > would ask me for sudoer permissions. > I would simply add > > username ALL=(ALL) ALL > user localhost = NOPASSWD: /path/to/comman

sudoer security problem on server

2009-03-28 Thread zhang zhengquan
Hi, there, I am exposed to a sudoer security problem on a server. the server is running debian etch and every so often users on it would ask me for sudoer permissions. I would simply add username ALL=(ALL) ALL to the /etc/sudoers file. But now I am worried, it is a developement server that devs o