Sudo can be VERY flexible when properly configured and good security is done on machines.
In the past I have helped set up machines so some users can do some things, other users can issue other commands or run scripts, all dependent on the groups to which they belong. At least in the past the sudo configuration was in the /etc/sudoers ... Things seem to move and migrate in more recent implementations su just allows one to become super user (root) and must be done with the password of root. sudo allows no one to NEED the root password, even to do admin work. It also allows for more auditable security. Everything that someone does on a machine via sudo can (and arguably should be) logged, so it can be audited if the need occurs. If you just su and use the root password, the last auditable event in the logs is you became root. (the same argument At one customers site, we (a consulting company I worked for) implemented sudo on their servers. WAY to many people had root access and for any number of reasons talked their way into having it (personal power things, not 'real' business needs). It took a while, but we did manage to even implement procedures so there was a 'root' password, but it was automatically generated, changed on all the servers, and a procedure was in place to print it in a way that no one saw it, and it was put into a envelope in the data center managers private office. It was available to anyone who wanted it, and could justify it to the DC manager. If it was used, the procedure was to have a new one generated and implemented the next business day, and an incident report was filled out by the people who 'justified' the need for the password. That was taken and reviewed to put new procedures in place so it was not needed in the future. It didn't take long till there were almost no 'need' for anyone to have the root password. Also the password was changed once a quarter 'for good measure'. -- Yes we were anal about it, but the user management wanted solid and auditable security, so they got it. Good? Bad? It all depends on your needs and where/what you are doing. -- You received this message because you are subscribed to the Google Groups "NLUG" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/nlug-talk?hl=en
