less is more (security)

• in compliance with the UNIX K.I.S.S philosophy
  • run as little software as absolutely necessary
  • stop/uninstall/disable all services not absolutely needed
  • less software = less lines of mistaken code = less security flaws = higher probability those semi(?)automatic updates actually work
  • run as much software non-root as possible but bare in mind: there are a ton of “privilege escalation” exploits out there, that allow non-root users to become root

how to allow username to use sudo:

meaning start temporary run processes with root-privileges, by adding him to the group “sudo” or “wheel”

# deb based distros
usermod -a -G sudo username; # Debian8/10/11,Ubuntu,Arch(untested)

# rpm based distros
usermod -a -G wheel username; # Suse12 / Fedora / CentOS7 / RedHat

su; # become root

useradd -m username; # add username bob to the system
passwd username; # give username a password

# sudo allows to run processes as a different user
sudo -u username sleep 30 & ps uax|grep sleep

root 1335 0.0 0.3 6436 3768 pts/0 S 11:48 0:00 sudo -u bob sleep 30
 bob 1339 0.0 0.0 3744 536 pts/0 S 11:48 0:00 sleep 30

usermod -a -G sudo username; # debian8: add user bob to group sudo -> allows user bob to run (hopefully temporary) processes with root-privileges

usermod -a -G wheel username; # under suse12 or centos7 this group is called "wheel"

under suse12 you will have to:

1. uncomment this line:

## Uncomment to allow members of group wheel to execute any command
%wheel ALL=(ALL) ALL

2. comment out those two lines:

# Defaults targetpw # ask for the password of the target user i.e. root
# ALL ALL=(ALL) ALL # WARNING! Only use this together with ‘Defaults targetpw’!

… or it will ask bob to input root’s password if he runs for example “sudo bash”.

For more detailed specification of the privileges of bob, instead of adding him to the group sudoers you can:

sudo visudo; # open up the sudoers config file, this also does syntax-checking

>>> /etc/sudoers: syntax error near line 15 <<<
What now?

type “e” and hit enter to re-edit the file.

vim /etc/sudoers; # you could also do those changes “manually”, but without the syntax-checking

and right below

# User privilege specification
root ALL=(ALL:ALL) ALL

bob ALL=(root) /usr/sbin/useradd, /usr/bin/passwd, !/usr/bin/passwd root

ESC :wq! # force save and quit in vim

what does that line mean?

bob ALL=(root)

bob may sudo to run processes as root (not as any other user)

what follows is a ,comma,separated,list of commands that bob is allowed to run

!/and/some/programs/he/is/NOT/allowed/to/run

(whitelist-blacklist)

bob should now be allowed to add a user – without being member of group sudo or wheel

sudo /usr/sbin/useradd -m jo; # try it 😀 should work

# wait for 5 minutes until sudo password-caching expired

# or you will get “passwd: You may not view or modify password information for jo.”

sudo /usr/bin/passwd jo; # asign password to newly created user jo, should work too

another example:

%LimitedAdmins ALL=NOPASSWD: /usr/bin/apt-get*, /etc/init.d/apache2 restart

# will allow admins to use apt-get install or apt-get update or apt-get upgrade

# will allow admins to restart apache2, without even asking for a password

id of the super-user-group:

root@Debian8:/# cat /etc/group|grep sudo
sudo:x:27:

[root@CentOS7]# cat /etc/group|grep wheel
wheel:x:10:

suse12:/# cat /etc/group|grep wheel
wheel:x:10:

manpage: sudo.man.txt

can’t resolve hostname

if you get strange error: two things to check (assuming your machine is called my-machine, you can change this as appropriate):

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 <ADD_YOURS_HERE> 
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 <ADD_YOURS_HERE>

liked this article?

• only together we can create a truly free world
• plz support dwaves to keep it up & running!
• (yes the info on the internet is (mostly) free but beer is still not free (still have to work on that))
• really really hate advertisement
• contribute: whenever a solution was found, blog about it for others to find!
• talk about, recommend & link to this blog and articles
• thanks to all who contribute!