freebsd security - Jul 2005 - FW: FW: FW: FW: Adding OpenBSD sudo to the FreeBSD base system?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

"All you need to do is uncomment that and viola, you have default su
behavior -- anyone in the wheel group allowed to sudo as any other user."

Exactly! Every other user can sudo.

I run many shell servers I do not want every user being able to sudo.

With su, first they have to break into an account that is part of the wheel
group. Then they have to get past your root password.

You cannot configure sudo to fit everyone's needs. So replacing su
Just makes it so the rest of us have to configure it just because you do not
want to take 10 minutes and install the port. 

Then again some people have brought to the table the security flaws found in
sudo.

What makes it so hard that you cannot install sudo from ports? I will even
make you a quick shell script that will do it for you.



- -----Original Message-----
From: asym [mailto:bsdlists@rfnj.org] 
Sent: Thursday, July 21, 2005 12:45 PM
To: Stephen Major; freebsd-security@freebsd.org
Subject: Re: FW: FW: FW: Adding OpenBSD sudo to the FreeBSD base system?

At 15:15 7/21/2005, Stephen Major wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA512
>
>http://www.freshports.org/security/sudo/
>
>
>there it is in the ports tree do your research before saying that my claim
>is baseless
The claim that you'd have to do any configuring at all is
"baseless."

>And stop before you come back with saying you have to configure it.
>Because that is exactly my point I do not have to configure anything to use
>su.
>
>And no you could not make sudo "out of the box" ready, for
everyone's
>application. Otherwise the default configs would already be that way when
>you installed it from ports.
Try logic here rather than just spouting the first thing that comes to mind.

It can be duplicated.  Exactly.
The port contains the following line in the default sudoers(5) file:

# %wheel ALL = (ALL) ALL

All you need to do is uncomment that and viola, you have default su 
behavior -- anyone in the wheel group allowed to sudo as any other user.

The only difference is it asks for their password instead of the root 
password, which is how sudo works, the entire point some (including myself) 
might say.

>I only want 2 users on my system to be in the wheel group and su to full
>root.
>
>But the next guy might want sudo and be able to give limited access to to
>several "sub-admins"
Perhaps, but guess what?  sudo gives that opportunity, su does not.

Coupled with the fact that sudo can be configured (and should be by 
default, if in the base system) to allow wheel to function as it does for 
su, and I say again:  your concerns in this regard are entirely baseless.

>- From my perspective su is more secure than sudo in the fact that an idiot
>admin cannot screw it up. Unless they set some dumb root password for
>example: 1234admin
There is no security against idiocy.  If you make combine "idiot" and 
"admin" in your environment, and make an "idiot admin" shame
on you, not
shame on sudo.



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.1 (Build 2185)

iQEVAwUBQt/99aKXvLS903/FAQqf8Af/bc7rFdiuvLfF58j5HzJuVbta7ItLB9mb
IA5jz1NJLKBnwZSYdGbgn0RpmwYbyxsHjIogO2JnKpMj0GyClBRX1l3HuAthWtbz
bnk8apFzYdCrokSmkPLshG+mhGV3OcQZezwz1OcY1AykoRmieDcpMXHIcQh9v3yG
kJlwbjF2GcCJD9GEfU3m6InmdsgI3zeHSRNh5FT6phcCiULR7x/T00V5Xr+ksgMt
9apUODZj4zK08BpPIvkKLRUwsGPPVpsP2uU2nk1o2NIY+8APe2CVJpz8+UuERinv
q8fVXs/3zCGhmN8VelgvBCQap4kFuxGaDw8qYuySX2CJv8Nn8GjC5Q==FpOi
-----END PGP SIGNATURE-----

At 15:56 7/21/2005, Stephen Major wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA512
>
>"All you need to do is uncomment that and viola, you have default su
>behavior -- anyone in the wheel group allowed to sudo as any other
user."
>
>Exactly! Every other user can sudo.
How EXACTLY do you come to that conclusion?

I imagine it has something to do with why you also decided to quote as you 
did, instead of letting the mailreader do it for you.

Uncomment the line I indicated and every user IN THE WHEEL GROUP can sudo.

EXACTLY how su works.