| Newsgroups |
gmane.comp.tools.sudo.user |
| Message-ID |
<[email protected]> |
I like to use a construct like the following. Its quite flexible, and
makes for a good baddest o expand upon as needed in the future.
Host_Alias PRD_H = prodhost1,prodhost2
Host_Alias DEV_H = devhost1,devhost2
Runas_Alias PRD_A = prodappid
Runas_Alias DEV_A = devappid
User_Alias USERS = %somegroupname
Cmnd_Alias INIT = /sbin/service foo restart
/sbin/systemctl restart bar
Cmnd_Alias BIN = /bin/kill, /sbin/reboot, /bin/traceroute
Cmnd_Alias APPID_SHELL = /bin/bash
USERS DEV_H,PRD_H = (root) _INIT, _BIN
USERS DEV_H = (DEV_A) APPID_SHELL
USERS PRD_H = (PRD_A) APPID_SHELL
Quoting Shawn McMahon <[email protected]>:
> Don't try blacklisting, it doesn't work. Give it a rule to become any
> account in a certain group, and add accounts to that group as needed.
>
> Or please remove all my personal information from your systems, because I
> don't want it there if you're doing blacklisting. It can't work. Please
> don't be lazy with my personal information.
>
>
> On Fri, Jun 29, 2018 at 1:14 PM Price, Dean <[email protected]> wrote:
>
>> Folks,
>> I know giving sudo su - is a bad idea, but we have an
>> automated tool that will need to sudo su to multiple accounts but we want
>> to restrict is from being able to su to root. How could I allow su to any
>> id but root?
>>
>> Thank you,
>> Dean A. Price, CISSP
>> MetLife - IT Security Consultant
>> [email protected]<mailto:[email protected]>
>> 570-585-3407
>>
>> The information contained in this message may be CONFIDENTIAL and is for
>> the intended addressee only. Any unauthorized use, dissemination of the
>> information, or copying of this message is prohibited. If you are not the
>> intended addressee, please notify the sender immediately and delete this
>> message.
>> ____________________________________________________________
>> sudo-users mailing list <[email protected]>
>> For list information, options, or to unsubscribe, visit:
>> https://www.sudo.ws/mailman/listinfo/sudo-users
>>
> ____________________________________________________________
> sudo-users mailing list <[email protected]>
> For list information, options, or to unsubscribe, visit:
> https://www.sudo.ws/mailman/listinfo/sudo-users
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users