Re: What's so secure about sudo?

--===============7461155316438950597==
Content-Type: multipart/alternative; boundary="0000000000000021b5058b99d1f2"

--0000000000000021b5058b99d1f2
Content-Type: text/plain; charset="UTF-8"

* https://www.youtube.com/watch?v=o0purspHg-o
*
https://www.bsdcan.org/2014/schedule/attachments/283_2014-04-29%20sudo%20tutorial%20-%20bsdcan%202014.pdf


--
Rabin


On Tue, 18 Jun 2019 at 09:25, Shlomo Solomon <[email protected]>
wrote:

> This has bothered me for years and I decided to "get it off my chest".
>
> For many years I used su to do administrative tasks, but "everyone"
> uses sudo and the claim is that it's more secure than actually logging
> in as root.
>
> In principal, of course, root login is not a good thing, but let's
> remember something I've never seen discussed. I would assume that on
> most systems the root password is MUCH more secure than that of a
> regular user. Now if I give user david sudo privileges, anyone who
> cracks david's (weak) password now has access to root privileges.
>
> And before anyone says that this is only a one-time authorization, what
> if the guy who cracked david's password now does:
>        sudo passwd root
>
> So what's so secure about using sudo?
>
> --
> Shlomo Solomon
> http://the-solomons.net
> Claws Mail 3.16.0 - Kubuntu 18.04
>
> _______________________________________________
> Linux-il mailing list
> [email protected]
> http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il
>

--0000000000000021b5058b99d1f2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:tahoma,s=
ans-serif">* <a href=3D"https://www.youtube.com/watch?v=3Do0purspHg-o">http=
s://www.youtube.com/watch?v=3Do0purspHg-o</a></div><div class=3D"gmail_defa=
ult" style=3D"font-family:tahoma,sans-serif">* <a href=3D"https://www.bsdca=
n.org/2014/schedule/attachments/283_2014-04-29%20sudo%20tutorial%20-%20bsdc=
an%202014.pdf">https://www.bsdcan.org/2014/schedule/attachments/283_2014-04=
-29%20sudo%20tutorial%20-%20bsdcan%202014.pdf</a></div><div class=3D"gmail_=
default" style=3D"font-family:tahoma,sans-serif"><br></div><div class=3D"gm=
ail_default" style=3D"font-family:tahoma,sans-serif"><br></div><div><div di=
r=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"gmail_signature"><div=
 dir=3D"ltr"><span style=3D"font-family:tahoma,sans-serif">--<br>Rabin</spa=
n></div></div></div><br></div><br><div class=3D"gmail_quote"><div dir=3D"lt=
r" class=3D"gmail_attr">On Tue, 18 Jun 2019 at 09:25, Shlomo Solomon &lt;<a=
 href=3D"mailto:[email protected]">[email protected]</a>&gt; =
wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">This has =
bothered me for years and I decided to &quot;get it off my chest&quot;.<br>
<br>
For many years I used su to do administrative tasks, but &quot;everyone&quo=
t;<br>
uses sudo and the claim is that it&#39;s more secure than actually logging<=
br>
in as root. <br>
<br>
In principal, of course, root login is not a good thing, but let&#39;s<br>
remember something I&#39;ve never seen discussed. I would assume that on<br=
>
most systems the root password is MUCH more secure than that of a<br>
regular user. Now if I give user david sudo privileges, anyone who<br>
cracks david&#39;s (weak) password now has access to root privileges. <br>
<br>
And before anyone says that this is only a one-time authorization, what<br>
if the guy who cracked david&#39;s password now does:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0sudo passwd root<br>
<br>
So what&#39;s so secure about using sudo?=C2=A0 =C2=A0<br>
<br>
-- <br>
Shlomo Solomon<br>
<a href=3D"http://the-solomons.net" rel=3D"noreferrer" target=3D"_blank">ht=
tp://the-solomons.net</a><br>
Claws Mail 3.16.0 - Kubuntu 18.04<br>
<br>
_______________________________________________<br>
Linux-il mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]=
i.ac.il</a><br>
<a href=3D"http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il" rel=3D"n=
oreferrer" target=3D"_blank">http://mailman.cs.huji.ac.il/mailman/listinfo/=
linux-il</a><br>
</blockquote></div>

--0000000000000021b5058b99d1f2--


--===============7461155316438950597==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Linux-il mailing list
[email protected]
http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il

--===============7461155316438950597==--