Limit a user about "sudo su" command.

Support for security such as Firewalls and securing linux
Post Reply
hack3rcon
Posts: 663
Joined: 2014/11/24 11:04:37

Limit a user about "sudo su" command.

Post by hack3rcon » 2020/08/16 09:04:35

Hello,
According to the https://www.thegeekdiary.com/how-to-dis ... tion-file/, I limited a user to execute "/bin/su" command, but user can edit the sudoers file and change the configuration!!
How can I solve it?
Is my configuration wrong?

Code: Select all

user  ALL=ALL, !/bin/su
Thank you.

User avatar
TrevorH
Forum Moderator
Posts: 29491
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Limit a user about "sudo su" command.

Post by TrevorH » 2020/08/16 13:49:18

You told it the user is not allowed to run /bin/su but you neglected all the other 10001 ways of getting root. For example, I can sudo /bin/bash and now I have a root command prompt, or sudo visudo and amend the file directly. And that's without using anything like sudo less /var/log/messages then using `:!visudo` from within that to execute commands as root.
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

hack3rcon
Posts: 663
Joined: 2014/11/24 11:04:37

Re: Limit a user about "sudo su" command.

Post by hack3rcon » 2020/08/16 20:36:16

TrevorH wrote:
2020/08/16 13:49:18
You told it the user is not allowed to run /bin/su but you neglected all the other 10001 ways of getting root. For example, I can sudo /bin/bash and now I have a root command prompt, or sudo visudo and amend the file directly. And that's without using anything like sudo less /var/log/messages then using `:!visudo` from within that to execute commands as root.
How can I solve it? I'm thankful if you show me the wrong part.

User avatar
TrevorH
Forum Moderator
Posts: 29491
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Limit a user about "sudo su" command.

Post by TrevorH » 2020/08/16 21:53:19

There is no solution to doing things the way you tried. You cannot "allow everything and deny specific things" unless you spend the next few years itemising all the things on your system that could be used to escalate or break out of root. To use sudo safely you must allow just the things you allow this user to do and forbid everything else. Or let them do everything.
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

hack3rcon
Posts: 663
Joined: 2014/11/24 11:04:37

Re: Limit a user about "sudo su" command.

Post by hack3rcon » 2020/08/17 05:36:59

TrevorH wrote:
2020/08/16 21:53:19
There is no solution to doing things the way you tried. You cannot "allow everything and deny specific things" unless you spend the next few years itemising all the things on your system that could be used to escalate or break out of root. To use sudo safely you must allow just the things you allow this user to do and forbid everything else. Or let them do everything.
I want to give a the username and password to a remote user. this user wants to install and configure server but I don't like change the root password :(

User avatar
jlehtone
Posts: 3044
Joined: 2007/12/11 08:17:33
Location: Finland

Re: Limit a user about "sudo su" command.

Post by jlehtone » 2020/08/17 07:11:54

hack3rcon wrote:
2020/08/17 05:36:59
this user wants to install and configure server
What does "install a server" mean?

If it does mean administration of whole CentOS, then it is user's system.
If it does mean a web page, then user does not need any admin privileges.

hack3rcon
Posts: 663
Joined: 2014/11/24 11:04:37

Re: Limit a user about "sudo su" command.

Post by hack3rcon » 2020/08/17 08:07:32

something like LAMP and etc.

hack3rcon
Posts: 663
Joined: 2014/11/24 11:04:37

Re: Limit a user about "sudo su" command.

Post by hack3rcon » 2020/08/19 12:24:07

Thus, there is no way to let a user installing applications but can't see other parts of the system?

poky
Posts: 104
Joined: 2013/03/27 12:18:03

Re: Limit a user about "sudo su" command.

Post by poky » 2020/09/05 16:37:25

You can make KVM virtual OS and get root password for this virtual OS.

Post Reply

Return to “CentOS 8 - Security Support”