Re: sudoer security problem on server

2009-03-29 Thread Nate Bargmann
* zhang zhengquan zhang.zhengq...@gmail.com [2009 Mar 28 19:27 -0500]: I wonder if a sysadmin should keep the root privilege safe and not give sudo to anybody anybody else. and if there is more secure ways of enabling root privilege to normal users? I'm no security or sudo expert, but it

Re: sudoer security problem on server

2009-03-29 Thread Nate Bargmann
* zhang zhengquan zhang.zhengq...@gmail.com [2009 Mar 28 19:27 -0500]: I wonder if a sysadmin should keep the root privilege safe and not give sudo to anybody anybody else. and if there is more secure ways of enabling root privilege to normal users? I'm no security or sudo expert, but it seems

Re: sudoer security problem on server

2009-03-29 Thread Eduardo M KALINOWSKI
Nate Bargmann wrote: I'm no security or sudo expert, but it seems to me that the devs should only have access to the commands they need. For example if they need to install to /usr/local/ using `make install' you can enable that specific command. For example I did that for myself (single

Re: sudoer security problem on server

2009-03-29 Thread Nate Bargmann
* Eduardo M KALINOWSKI edua...@kalinowski.com.br [2009 Mar 29 08:43 -0500]: %USER HOSTNAME=NOPASSWD: /usr/bin/make I replace USER and HOSTNAME with my local values. The sudoers man page is quite extensive as well. This will allow them to run make as root. Not only they will be

Re: sudoer security problem on server

2009-03-29 Thread Steve Kemp
On Sun Mar 29, 2009 at 10:41:57 -0300, Eduardo M KALINOWSKI wrote: This will allow them to run make as root. Not only they will be able to install anywhere (not only under /usr/local), but they can run any command by creating a Makefile that does what they want to do. Indeed. If one wants

sudoer security problem on server

2009-03-28 Thread zhang zhengquan
Hi, there, I am exposed to a sudoer security problem on a server. the server is running debian etch and every so often users on it would ask me for sudoer permissions. I would simply add username ALL=(ALL) ALL to the /etc/sudoers file. But now I am worried, it is a developement server that devs

Re: sudoer security problem on server

2009-03-28 Thread Sudev Barar
2009/3/29 zhang zhengquan zhang.zhengq...@gmail.com: Hi, there, I am exposed to a sudoer security problem on a server. the server is running debian etch and every so often users on it would ask me for sudoer permissions. I would simply add username ALL=(ALL) ALL user localhost