Limit a user about "sudo su" command.

[hack3rcon]

Hello,
According to the https://www.thegeekdiary.com/how-to-dis ... tion-file/, I limited a user to execute "/bin/su" command, but user can edit the sudoers file and change the configuration!!
How can I solve it?
Is my configuration wrong?

Code: Select all

user  ALL=ALL, !/bin/su

Thank you.

[TrevorH]

You told it the user is not allowed to run /bin/su but you neglected all the other 10001 ways of getting root. For example, I can sudo /bin/bash and now I have a root command prompt, or sudo visudo and amend the file directly. And that's without using anything like sudo less /var/log/messages then using `:!visudo` from within that to execute commands as root.

[hack3rcon]

You told it the user is not allowed to run /bin/su but you neglected all the other 10001 ways of getting root. For example, I can sudo /bin/bash and now I have a root command prompt, or sudo visudo and amend the file directly. And that's without using anything like sudo less /var/log/messages then using `:!visudo` from within that to execute commands as root.

How can I solve it? I'm thankful if you show me the wrong part.

[TrevorH]

There is no solution to doing things the way you tried. You cannot "allow everything and deny specific things" unless you spend the next few years itemising all the things on your system that could be used to escalate or break out of root. To use sudo safely you must allow just the things you allow this user to do and forbid everything else. Or let them do everything.

[hack3rcon]

There is no solution to doing things the way you tried. You cannot "allow everything and deny specific things" unless you spend the next few years itemising all the things on your system that could be used to escalate or break out of root. To use sudo safely you must allow just the things you allow this user to do and forbid everything else. Or let them do everything.

I want to give a the username and password to a remote user. this user wants to install and configure server but I don't like change the root password

[jlehtone]

this user wants to install and configure server

What does "install a server" mean?

If it does mean administration of whole CentOS, then it is user's system.
If it does mean a web page, then user does not need any admin privileges.

[hack3rcon]

something like LAMP and etc.

[hack3rcon]

Thus, there is no way to let a user installing applications but can't see other parts of the system?

[poky]

You can make KVM virtual OS and get root password for this virtual OS.