Hello Everyone,
We are facing an issue related with the Sudoers LDAP Backend.
We have a LDAP group that should be able to vi, tail and less all the files contained inside /var/log/ We are thinking about using wildcards but it seems that the wildcards that works for suders file does not works when the backend is the LDAP.
Eg.
dn: cn=%GroupEX,ou=SUDOers,dc=examples,dc=example,dc=com objectClass: top objectClass: sudoRole cn: %Sec_Analysts description: Security Administrators group sudo rules sudoCommand: /usr/bin/less /var/log/* sudoCommand: /usr/bin/tail /var/log/* sudoCommand: /usr/bin/head /var/log/* sudoCommand: /usr/bin/vi /var/log/* sudoCommand: /usr/bin/vim /var/log/* sudoOption: !authenticate sudoOrder: 115 sudoRunAsUser: root sudoUser: %GroupEX
This only works when the user that belongs to GroupEX run the commands as shown:
/usr/bin/less /var/log/* /usr/bin/tail /var/log/* ...
But this does not work when the command is performed as: /usr/bin/less /var/log/warn /usr/bin/tail /var/log/warn
Any ideas?
Using ACLs and File permissions are not an option here.
Thank you so much. Regards.
[cid:image001.gif@01D7BB82.7B9FECE0]
Dario Garcia Díaz-Miguel GGCS-SES Unit GGCS SKMF Infrastructure Division
GMV C\ de Isaac Newton, 11 28760, Tres Cantos, Madrid España +34 918 07 21 00 +34 918 07 21 99 www.gmv.com http://www.gmv.com/ [cid:image002.png@01D7BB82.7B9FECE0]http://www.facebook.com/infoGMV
[cid:image003.png@01D7BB82.7B9FECE0]http://www.twitter.com/infoGMV_es
[cid:image004.png@01D7BB82.7B9FECE0]http://www.youtube.com/infoGMV
[cid:image005.png@01D7BB82.7B9FECE0]https://www.linkedin.com/company/gmv
[cid:image006.png@01D7BB82.7B9FECE0]http://www.gmv.com/en/RSS
[cid:image007.png@01D7BB82.7B9FECE0]http://www.gmv.com/blog_gmv/language/en/
P Please consider the environment before printing this e-mail.
On 10/7/21 13:51, Dario García Díaz-Miguel wrote:
We have a LDAP group that should be able to vi, tail and less all the files contained inside /var/log/
Bad idea because less and vi let the user escape to shell.
We are thinking about using wildcards but it seems that the wildcards that works for suders file does not works when the backend is the LDAP.
IMHO this question should be better asked on sudo-users list:
https://www.sudo.ws/mailman/listinfo/sudo-users
On sudo-users there are people who can explain in more detail why you should not use sudo like that.
Especially granting read access to log files should be done by appropriate group ownership and file permissions/ACLs.
Some introduction to the security issues:
https://www.sweharris.org/post/2018-08-26-minimal-sudo/
Ciao, Michael.
I would also agree that this is probably better suited for the sudo-users list, however I will add that in general you should allow the sudoedit program instead of allowing direct sudo use to vi, nano, emacs, etc:
user@host:~$ ldapsearch -Y GSSAPI -QLLL -b "cn=pgsql-mgr-default,ou=SUDOers,dc=harmonywave,dc=cloud" | grep sudoedit sudoCommand: sudoedit /etc/apt/* sudoCommand: sudoedit /etc/docker/* sudoCommand: sudoedit /etc/logrotate.d/postgresql-common sudoCommand: sudoedit /etc/postgresql-common/* sudoCommand: sudoedit /etc/postgresql-common/pg_upgradecluster.d/* sudoCommand: sudoedit /etc/postgresql/*/main/* sudoCommand: sudoedit /etc/postgresql/*/main/conf.d/*
This solves/avoids the root escalation issues with editors.
On 10/7/21 12:54 PM, Michael Ströder wrote:
On 10/7/21 13:51, Dario García Díaz-Miguel wrote:
We have a LDAP group that should be able to vi, tail and less all the files contained inside /var/log/
Bad idea because less and vi let the user escape to shell.
We are thinking about using wildcards but it seems that the wildcards that works for suders file does not works when the backend is the LDAP.
IMHO this question should be better asked on sudo-users list:
https://www.sudo.ws/mailman/listinfo/sudo-users
On sudo-users there are people who can explain in more detail why you should not use sudo like that.
Especially granting read access to log files should be done by appropriate group ownership and file permissions/ACLs.
Some introduction to the security issues:
https://www.sweharris.org/post/2018-08-26-minimal-sudo/
Ciao, Michael.
openldap-technical@openldap.org
-
Dario García Díaz-Miguel -
Joshua Schaeffer -
Michael Ströder