Stop Telling sudo Your Password

A whole new generations of idiots are now administering Linux systems. This article backs that theory up too. It reminds me of the typical parrotted argument against using su, "sudo is more secure". Yet those same idiots do idiotic things like what this article suggests. Or usually you'll see people saying to do "sudo su". It seems that when sudo came out that it helped create a whole new generation of stupid people, that think passwords are a stupid thing, that use it as a tool circumvent security measures.

Its really nice to know that we can use sudo without password prompt.

You shouldn't tell people how to make their systems less secure via techniques they probably don't understand. I don't really want to see a major news outlet say that Linux is just as insecure as the other guys because we taught people how to do this sort of thing.

When you have compromised a server as a user but do not have root access yet, a script like that may be used to provide you with one as soon as the true user does sudo.

Any form of sudo is a security hole, but on a home PC behind a hardware firewall it is OK to have one. Strangely enough, nobody mentioned 2 advantages sudo has over su, provided it is safe.

First, sudo can do things like "sudo thunar" while root is still unable to connect to X.

Second, things like the above or "sudo mc" leave you with your user path, while su gives you the root path. Thus, with sudo mc you still cannot do most devastating things incidentally.

Sudo should be locked down to specific commands (NOT be able to get to a shell prompt, etc).

If this is the case, the physical person logging into the server ALREADY HAS THE PASSWORD.. What's the point in having to type it over and over again for a command you (as a systems admin) have given them the permissions to run?

If it is that risky that you could damage the system - why are you allowing that user to run that command? Why didn't you restrict the command down so the user can only use it in specific ways?

Yes, someone can walk up to your computer while you're away (and the luser hasn't locked it) - doesn't that mean you've got insufficient access/delegation processes (delegating important jobs to ID10T's or allowing the wrong people access to the wrong areas).
But also someone can look over your shoulder - or otherwise capture what you type - (while you're typing your password for the 200th time that day) and more easily capture said password.

So PLEASE, explain what you and one or two posters in here think is meant by "security implications"?

--
Paul_one

I have put this on the LinuxToday site link, and I think that the anger I have pretty much equates to that of the sysadmin above. For 10 years I have had Linux security and passwords drummed into me and I absolutely KNOW that they are critical to the use of my OS......now we have small minds trying to undo Linux security. Words begin to fail me.....read on:

I am utterly fed up and disgusted with the stupidity of these "Linux geeks" who are now feeding into the community ways of cancelling (at least temporarily) the use of passwords. This is the second time in at two weeks I have seen this occur and in each case the writer of the article has indicated that doing so will compromise computer security, and yet they then proceeded to continue to show how to do it.

What is with these people who want to make Linux into a clone of Windows where passwords are a joke and security is usually so poor ? The whole point of Linux is that it DOES normally require passwords to do anything that threatens computer security, and as I pointed out earlier, what is so hard about writing in a password ? That's good security and that is what Linux teaches you to do.

I have almost reached the stage where I have become paranoid enough to believe this is a subtle Redmond campaign to destroy one of Linux' main advantages over Windows. Newcomers see this sort of ridiculous suggestion and think: "Right, this is what I am used to doing and I see the warning, but this suggestion would not be here unless I can do it without too much of a problem." I sincerely wish these people would take a little more responsibility for what they write instead of bursting into print with suggestions that turn the clock backwards. We are trying to increase knowledge of computer security in this world of viruses
and trojans not decrease it !!!!!!!!!!!!

Perfect! teach them how to be insecure just like windblows. if typing a password is too painful, then maybe they should stick with windows.

'sudo -S "your command" < ~/.mypasswd' where ~/.mypasswd contains your password should do the trick. Ensure that only you can read / write to ~/.mypasswd.

Isn't easier to type >sudo bash than type password once. You have shell with root privileges inheriting all environment settings.

Were I a Unix sys admin (and I am), and were I to find anyone on any of the systems I administer doing such a thing (unlikely, but I digress), I would *immediately* revoke sudo priviliges for said user. As you mention in your footnote, there are security implications to this tip, and that is the reason sudo times out the password. On your own system at home, it's one thing. However, in the corporate world, sys admins often take a very, very dim view of users trying to weasel around their security policies.