Re: [openstack-dev] [tripleo] Limiting sudo coverage of heat-admin / stack and other users.

2018-05-22 Thread Luke Hinds
On Tue, May 22, 2018 at 8:24 AM, Cédric Jeanneret wrote: > > > On 05/22/2018 09:08 AM, Luke Hinds wrote: > > > > > > On Tue, May 22, 2018 at 5:27 AM, Cédric Jeanneret > > wrote: > > > > > > > > On 05/21/2018 03:49 PM,

Re: [openstack-dev] [tripleo] Limiting sudo coverage of heat-admin / stack and other users.

2018-05-22 Thread Cédric Jeanneret
On 05/22/2018 09:24 AM, Cédric Jeanneret wrote: > > > On 05/22/2018 09:08 AM, Luke Hinds wrote: >> >> >> On Tue, May 22, 2018 at 5:27 AM, Cédric Jeanneret > > wrote: >> >> >> >> On 05/21/2018 03:49 PM, Luke Hinds wrote: >> > A few

Re: [openstack-dev] [tripleo] Limiting sudo coverage of heat-admin / stack and other users.

2018-05-22 Thread Cédric Jeanneret
On 05/22/2018 09:08 AM, Luke Hinds wrote: > > > On Tue, May 22, 2018 at 5:27 AM, Cédric Jeanneret > wrote: > > > > On 05/21/2018 03:49 PM, Luke Hinds wrote: > > A few operators have requested if its possible to limit sudo's coverage

Re: [openstack-dev] [tripleo] Limiting sudo coverage of heat-admin / stack and other users.

2018-05-22 Thread Luke Hinds
On Tue, May 22, 2018 at 5:27 AM, Cédric Jeanneret wrote: > > > On 05/21/2018 03:49 PM, Luke Hinds wrote: > > A few operators have requested if its possible to limit sudo's coverage > > on both the under / overcloud. There is concern over `ALL=(ALL) > > NOPASSWD:ALL` , which

Re: [openstack-dev] [tripleo] Limiting sudo coverage of heat-admin / stack and other users.

2018-05-21 Thread Cédric Jeanneret
On 05/21/2018 03:49 PM, Luke Hinds wrote: > A few operators have requested if its possible to limit sudo's coverage > on both the under / overcloud. There is concern over `ALL=(ALL) > NOPASSWD:ALL` , which allows someone to  `sudo su`. > > This task has come under the care of the tripleo

[openstack-dev] [tripleo] Limiting sudo coverage of heat-admin / stack and other users.

2018-05-21 Thread Luke Hinds
A few operators have requested if its possible to limit sudo's coverage on both the under / overcloud. There is concern over `ALL=(ALL) NOPASSWD:ALL` , which allows someone to `sudo su`. This task has come under the care of the tripleo security squad. The work is being tracked and discussed