Re: Tool of Use to Unix WebCat Admins
This WebDNA talk-list message is from 2000
It keeps the original formatting.
numero = 36035
interpreted = N
texte = On 8/9/00 1:37 PM, John Peacock at JPeacock@UnivPress.com wrote:> Sudo is a program designed to allow a sysadmin to give limited root > privileges to users and log root activity. [...]Sudo is a very handy tool but you have to be careful because it can be a security hole if you're not. For example, you don't want any of your sudoers to be able to run an editor as root, because many unix editors allow shell escapes, which would give the sudoer a root shell. Also, any sudoer has to be on guard against password compromise, more so than a regular user since anybody with their name and passowrd can do any potentially destructive activities allowed by the sudoers file. Sudo's ALL=ALL directive is particularly dangerous since it practically makes a user with that attribute root. If you use sudo (read: if you provide shells to your customers at all), urge your users to use SSH or some other crypted protocol to start a shell session and be as strict as possible in defining permissions in the sudoers file. Start out with only a few privileges at first and keep everything else clamped down, then grant privileges only as needed.Actually, it's best not to provide shell access in the first place unless it's unavoidable.-- Andrew Vernon avernon@dramatols.net------------------------------------------------------------- This message is sent to you because you are subscribed to the mailing list
. To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://search.smithmicro.com/
Associated Messages, from the most recent to the oldest:
On 8/9/00 1:37 PM, John Peacock at JPeacock@UnivPress.com wrote:> Sudo is a program designed to allow a sysadmin to give limited root > privileges to users and log root activity. [...]Sudo is a very handy tool but you have to be careful because it can be a security hole if you're not. For example, you don't want any of your sudoers to be able to run an editor as root, because many unix editors allow shell escapes, which would give the sudoer a root shell. Also, any sudoer has to be on guard against password compromise, more so than a regular user since anybody with their name and passowrd can do any potentially destructive activities allowed by the sudoers file. Sudo's ALL=ALL directive is particularly dangerous since it practically makes a user with that attribute root. If you use sudo (read: if you provide shells to your customers at all), urge your users to use SSH or some other crypted protocol to start a shell session and be as strict as possible in defining permissions in the sudoers file. Start out with only a few privileges at first and keep everything else clamped down, then grant privileges only as needed.Actually, it's best not to provide shell access in the first place unless it's unavoidable.-- Andrew Vernon avernon@dramatols.net------------------------------------------------------------- This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://search.smithmicro.com/
Andrew Vernon
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
WebCatalog NT (1996)
Configuring E-mail (1997)
Web*SSL and WebCatalog (1997)
errormessages.db (1997)
Grep Search and Replace (2002)
Encrypted links ... (2000)
ShowNext (1997)
WebCatalog-NT?'s (1996)
Triggers Suck! (2000)
displaying New products (Yikes! it's Fixed!) (1997)
2.0 Info (1997)
Date Range search (1997)
show all problem (1997)
Problem with summary on date / inconsequent webcat behaviour (1998)
Multi Actions (1999)
FM PRO Compatibility Issue - Single Database w/o Conversions (1997)
cart number tracking (1998)
Web Catalog vs. ICAT (1997)
Grepping a csv (2003)
WebCat2: multiple currency support (1997)