topic Re: sudo in Operating System - HP-UX

sudo

Khashru — Sun, 12 Feb 2006 19:21:39 GMT

I have configured sudo for giving some access to our helpdesk team. My manager wants to know about the security issues about it like

1. who made sudo
2. where is the configuration file and what is the permission of that.
3. Is there any known threat?

Can anyoune help me in this.

Re: sudo

Patrick Wallek — Sun, 12 Feb 2006 19:38:11 GMT

1. Who made sudo: Check out http://www.courtesan.com for lots of information on sudo.

2. It depends on the installation. Sometimes it is /etc/sodu/sudoers, sometimes /usr/local/etc/sudo/sudoers. I have seen it in other directories as well. Permissions on one of my machines are readable by the owner and group (both root) only.

3. Any known thread: Information here on the only sudo security issue I have ever seen: http://www.sudo.ws/sudo/alerts/path_race.html

Sudo is a great product and the benefits far outweigh the risks in my opinion.

Re: sudo

Arunvijai_4 — Sun, 12 Feb 2006 22:48:08 GMT

Hi Khashru,

Q1. who made sudo

Ans : Sudo is an Opensource utlity distributed under ISC-style license. It is part of Internet Express suite as well, you can download it for 11.11 and 11.23

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123

Main site is at : http://www.courtesan.com/sudo/

Q2. where is the configuration file and what is the permission of that.
"sudoers" is the configuration file for sudo. If you install Internet express version of sudo, you can find "sudoers" at /opt/iexpress/sudo/etc/ directory.

Permission will be 644.

Q3.Is there any known threat?

Current version 1.6.8p12 is risk free,

See all Sudo reated security alerts at http://www.courtesan.com/sudo/alerts/

-Arun

Re: sudo

Steven E. Protter — Mon, 13 Feb 2006 00:48:13 GMT

Shalom Kashru,

I differ with the last answer to number 3. Though there are no known vulnerabilities with the sudo product, which is stable and in wide use, there are inherent problems with sudo itself.

If used to grant access on the wrong utility it can open up your system completely to malicious, or more likely stupid users. It is very important to use this utility in a very, very limited way.

sudo increases security if it allows you to keep non-admins from root access and if its used carefully and in a limited way.

sudo ships with a special visudo or visudoers utility that when saving the file, updates the sudo database.

Good Luck.

Re: sudo

Mustafa Gulercan — Tue, 14 Feb 2006 01:54:18 GMT

hi;

1) there is a sudo web page at http://www.sudo.ws/sudo/

2)/etc/sudoers
-r--r----- 1 root root

regards
mustafa

Re: sudo

Yogeeraj_1 — Tue, 14 Feb 2006 04:23:41 GMT

hi Khashru.

Many questions on sudo also answered at the following url:
http://groups.google.mu/group/alt.hacking/msg/4de350322e329c48?&q=sudo+security+threats

hope this helps too!

kind regards
yogeeraj