Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH as a Sudo Replacement

whynothugo.nl

Post reply on HN
Print view View original

11–20 of 114 posts

Re: SSH as a Sudo Replacement

#11

Post by mmh0000 »

aaaronic wrote: post #7
op00to wrote: post #6

Earlier quoted context omitted.

A big part of sudo is that you should be running individual commands using sudo to increase auditability rather than simply running sudo bash or whatever.

I can agree with that, though admit to being guilty of using sudo bash far more often than I should. I honestly thought they’d be using ssh that way (single command at a time), though I’m still not sure to what security end.

If ‘sudo’ is properly configured running bash or anything that allows command execution (vim, eMacs, etc) is disallowed.

Also, may I introduce you to the ‘sudo -i’ option.

Re: SSH as a Sudo Replacement

#12

Post by rpgwaiter »

hughesjj wrote: post #10
lmz wrote: post #8

Earlier quoted context omitted.

The sudo binary is suid root / privileged and is exposed directly to the untrusted user. If anything goes wrong inside of sudo (with the user's entire environment as the surface area), it may be exploited. The ssh approach does not expose a suid binary. Instead it uses the ssh network layer so it is no less secure than accessing ssh over a network, which is considered pretty secure.

...why not just su then?

root would need a defined password, which opens up other security concerns

Re: SSH as a Sudo Replacement

#13

Post by mise_en_place »

This is an elegant solution to the problem. We don't need to treat users as children, but at the same time we should avoid potential foot guns with sensible defaults. I'd argue that even `su` is not needed, if you need to be root, then login as root via console. This is as close as possible to logging into root from the console tty.

Re: SSH as a Sudo Replacement

#17

Post by kiririn »

op00to wrote: post #6
aaaronic wrote: post #2

Am I missing something? How is logging into ssh (sshd) AS root more secure than using sudo? I honestly don’t even know how dangerous that is because I’ve always been told to never allow it. I see here thought goes into preventing that for a remote user, so I’m not talking about that aspect of security here. Maybe it has to do with #3 in the sudo limitations — I certainly don’t see any benefits vis-a-vis #1. I totally…

A big part of sudo is that you should be running individual commands using sudo to increase auditability rather than simply running sudo bash or whatever.

Auditd and pam_tty_audit can take care of all your auditing needs

Re: SSH as a Sudo Replacement

#18

Post by cycomanic »

So what happens if ssh (IIRC correctly in typical configurations it depends on network to start) fails to start at boot? You can't even login at failsave console. What does this actually buy us over sudo or su? Sure you avoid a setuid binary but instead you are now running a network service (even though only connected to a socket) with root priveledges.

Re: SSH as a Sudo Replacement

#19

Post by op00to »

aaaronic wrote: post #7
op00to wrote: post #6

Earlier quoted context omitted.

A big part of sudo is that you should be running individual commands using sudo to increase auditability rather than simply running sudo bash or whatever.

I can agree with that, though admit to being guilty of using sudo bash far more often than I should. I honestly thought they’d be using ssh that way (single command at a time), though I’m still not sure to what security end.

I sudo bash a lot as well. Some times I regret it when I try to figure out what the hell I did months ago. :)

Re: SSH as a Sudo Replacement

#20

Post by op00to »

kiririn wrote: post #17
op00to wrote: post #6

Earlier quoted context omitted.

A big part of sudo is that you should be running individual commands using sudo to increase auditability rather than simply running sudo bash or whatever.

Auditd and pam_tty_audit can take care of all your auditing needs

Sure! All part of layered controls and reporting.
Post reply on HN