sudo or other type access

[Dan Matlock_1]

Just curious as to what is the most popular why to restrict/monitor/allow root access. We have some systems configured to use sudo, and before I continue to move forward I want to research to see if there is a better alternative...

[Pete Randall]

The two most popular options continue to be sudo, of course, and restricted SAM (sam -r).


Pete

[Victor Fridyev · Accepted solution]

Hi,

IMHO, sudo is the best. It's almost a standard in many flavours.
In HPUX you can also create a restricted SAM access, if needed.

Regards

[Rick Garland]

sudo is popular for a couple of reasons; 1 because it works and 2 because it is free. Just a download.

There is an application called PowerBroker but this is a cost product. Lots of good with the package and lots of configuration is needed.

There is an application called 'rootsh'. Use this is conjuction with sudo. You will have the logging from sudo indicating that userA invoked sudo to execute the command. Once in rootsh another log file is appended to. This rootsh log file captures all input and output. Nothing missing in these log files.

[Rick Garland]

BTW, depending on the tasks to be executed, you may find restricted SAM a viable option as well.

[Darrel Louis]

Hi,

Sudo is the way to go.
HP and SUN are promoting RBAC, but I'm still in favour of SUDO.

What also can do to prevent root usage:
Restrict root logins to system console
echo console > /etc/securetty
chown root:sys /etc/securetty
chmod 600 /etc/securetty

Check if there are other users than root with uid=0
logins -d | grep ' 0 '
GoodLuck

Darrel

[Sanjay_6]

Hi,

I think sudo is most popular, primarily because it is free. But becasue it is free it is decentralised, you have to manage it seperately on each server.

The other alternative that i have worked with is powerbroker from symark. This is a very good product but costs $$$'s. The benefit is centralised manaagement and losts of features for a person to explore and use. since it can be configured from a central location, makes management of the policies easier.

Powerbroker site: http://www.symark.com

Hope this helps.

regds

[Paul Sperry]

I tend to like super it's free too
The source code can bo downloaded here:

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/super-3.9.7/

[Dan Matlock_1]

Thanks all, it appears sudo was put on by IBM Global back in 2004 on about 10% of servers here, so I will continue with the sudo route.... Thanks all and happy holidays!