security on vi

[dongming]

Hello everyone:
a simple question, i set up sudo on all servers. and let user to run sudo to get some root's permission. however, i find if i run
#sudo vi then escape to command line by !sh.
it go into root prompt. then can hide all operation here. in the syslog.log , you cann't trace , just find sudo vi .
is there any configuration to deny user escape to command line from vi.

thanks.

[Simon Hargrave]

I don't think it really matters.

If you are granting your users access to run vi via sudo, then they can use that to edit the sudoers file and do what they like!

Don't let your users do this!

[RAC_1]

What version of sudo??
in sudoers file, update vi command to run it as follows.

root (root) command1, command2, !SHELL

[Raj D.]

Hi Dongminq ,

You have to specify for the users , to use vi for their files only , in sudoers file

YOu can do following :
1. # visudo

2. And put the entires like this on the user alias :

Cmnd_Alias BACKUP_C = /opt/omni/*, \
/opt/omni/utilns/*, \
/var/opt/omni/*, \
/usr/bin/vi /etc/opt/omni/datalists/*, \

-------------------------------------------

To trace who are using sudo , you can check in /var/log/sudo.log file.

Hope this will help ,

Cheers ,
Raj.

[dongming]

Hi thanks for response.
my sudo version is
what /usr/bin/sudo
$Sudo A.03.00-1.6.7p5 $

do you mean disable sudo to run vi. but maybe some user to edit some file other then their own.
i have ever seen this, let user sudo vi , but deny to escape to shell, i don't remember how to configure it.

[RAC_1 · Accepted solution]

You can do one more thing.
For root prepeare following wrapper.

#!/usr/bin/ksh
export SHELL=/usr/bin/false
/usr/bin/vi $1

Call this vi1, now root entry for root will look as follows.

root root, command1, vi1

This should help.

OR

In root's .profile file, put following.
export EXINIT='set shell=/usr/bin/false'
You can put set shell=/usr/bin/false in .exrc file of root's home dir.

[dongming]

Hi RAC:
i test the configuraiton you told me.
1. .profile: because the normal user didn't run this script when they run sudo vi. so the SHELL was not set.
2. add vi1 to sudoers.
i configure root ALL=(ALL) ALL , so root can run anything.

i test wraperred vi1, it works. so i think the better way to rename vi and link vi to vi1 for all servers, is it ok?

[RAC_1]

In root's .profile file, put following.
export EXINIT='set shell=/usr/bin/false'

You can also put set shell=/usr/bin/false in .exrc file in root's home directory.

[dongming]

HI RAC:
i test it, it doesn't work.

[Rick Garland]

As you are allowing the use of vi, a wrapper around the vi executable can do the trick.

Here is an attachment that will allow you to specify which files are governed by RCS. When users vi a file (a special file as dictate by the wrapper) then RCS will be invoked for the file.

Modify to your needs