14 Dec
2011
14 Dec
'11
4:35 p.m.
On Wed, Dec 14, 2011 at 04:57:15PM -0500, Sean Conner wrote:
It was thus said that the Great Brian Wheeler once
stated:
Makes perfect sense. If you are afraid of them installing backdoors,
you shouldn't grant them _any_ shell access to the system at all.
The "common" root password probably is also used for machines those guys
are not supposed to have root on.
Kind regards,
Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison
On 12/14/2011 04:21 PM, Sean Conner wrote:
You don't trust some users with the root password, but you allow them a
root shell via sudo and trust them not to install back doors. It was thus said that the Great Richard once
stated:
We use a common root password on our machines but we don't want to give
some of the people who do admin things on those machine the common
password -- so we give them sudo access on the machines they need to do
admin on and don't really restrict what they can do with it because we
"trust" them :) In
article<539CFBE84C931A4E8516F3BBEA36C7AA4D7E8D75 at 505MBX1.corp.vnw.com>,
Rich Alderson<RichA at vulcan.com> writes:
>That's an awful lot of schratzing around to accomplish what a simple
>
> GUNRUP% sudo /bin/bash
>
>will do for you. (I use this frequently on my Snow Leopard system.)
Is there some reason you don't do 'sudo -i'?
Basically, yes. I
*loathe* sudo [1], so the less I have to use it, the
better. I made the assumption that sudo bash (or any other number of
commands that have been presented) were locked, because what's the *point*
of sudo if you can just simply do "sudo bash"? [3]
-spc (sudo this, sudo that, sudo something else ... for more than one
command, sudo is an annoyance ... )
[1] It doesn't protect the system at *all*. Or rather, to prevent shell
access via sudo [2], you need to go to insane lengths in tightening
down the system. @#$@#$ that! I'll su, thank you very much.
[2] Because root shell access can cause a great amount of damage. [3]
[3] Sudo was to allow non-root users to do root-like things, but *not*
to run a @#$@ shell, or else, why not just give the users root
access? I mean---hello! Am I missing something?