Reading root mail using sudo

[Debbie Beresford]

We have set up sudo to allow our operators to access root functions without needing the root password. In the sudoers file, we have set up a User_Alias of OPERUSER. Under User privilege specification is the following:
OPERUSER ALL=(ALL) NOPASSWD: ALL

Most functions are available to the operators but they cannot check to see if root has any mail. It appears when "mail" is entered, it shows the information for the original user. Logging on as root does show there is mail.

Any suggestions on how to correct this?

[Mark Grant]

I have never used sudo but would guess from this that sudo only gives you the effective user id of 0 (EUID) and that mail does it's checks using the real user id (UID). If there is no configuration option within sudo to use the real user id you could change the command to "su - root -c mail". I imagine this should give the user the real uid of 0 and then read the mail.

[Debbie Beresford]

This does work. I am a novice so I need to look into sudo further to see if the options you suggest are available. I also needed the root password to make this work. Is there a way around this?

[Marvin Strong]

If I am interpreting the setup correctly

They should be able to "sudo su - root"
then type "mail"

or "sudo su - root -c mail"

Either of those should work. And they should not need the passwd, if sudo prompts for a passwd they can use the operuser passwd they have, they do not need roots passwd.

[Cesare Salvioni]

The problem is that elm and mail command use the environment variables LOGNAME and MAIL to decide the mailbox to use.
If u run the command su root the environment is not changed, while if u run the command su - root the environment is exactly the same as logging in as root.
Try to run the sudo command with a script like

#!/usr/bin/sh
export LOGNAME=root
export MAIL=/var/mail/root
mail

it should use the root mailbox
Bye Cesare

[Paul F. Carlson]

I want to make sure you realize you've given your operators the keys to the kingdom. They can type in "sudo su -" and get a root shell, and reboot the box or whatever else they want. On top of this, you are allowing this to happen without any password.

If you want them to only have privilages to run certain commands, it's better to specify each command they have access to in your sudoers file.

[Sanjay_6]

Hi,

Once your operator has done sudo to root, let them do a su - root and when they get the root prompt, they should be able to read the root mail.

Hope this helps.

Regds

[Scott J. Showalter]

In addition to what Paul said, you should realize that there are TONS of commands that you could put in the sudoers file that could give the user "FULL ROOT" access.

sudo, if not configured right, is just as bad as giving them the root password. You give me sudo access to your system, and unless you know all the holes, I bet I could get a root shell pretty easy.

[Robert True]

Tested this on 11.0, sudo 1.6.7p5:

Add a Cmnd_Alias like:

Cmnd_Alias ROOTMAIL=/bin/mail -f /var/mail/root

(Sorry, tab / space formating is lost)

Then add ROOTMAIL to your user privilege section. Keep in mind /bin/mail has a shell escape, so it is not secure.

However if your OPERUSER entry is for real, you are not secure anyway. I really do not like that entry.

I don't believe in granting more privilege than necessary. Thats the one drawback to sudo: If you want it secure, it is a hassle to admin!

[Robert True]

Opps, forgot to add:

User must enter the command exactly like the Cmnd_Alias, IE:

'sudo /bin/mail -f /var/mail/root'

Rt.

[Debbie Beresford]

Thanks for all of your help. Also, we will now be reviewing the use of sudo!