4:51 a.m.
Hello Everyone,
We are facing an issue related with the Sudoers LDAP Backend.
We have a LDAP group that should be able to vi, tail and less all the files contained
inside /var/log/
We are thinking about using wildcards but it seems that the wildcards that works for
suders file does not works when the backend is the LDAP.
Eg.
dn: cn=%GroupEX,ou=SUDOers,dc=examples,dc=example,dc=com
objectClass: top
objectClass: sudoRole
cn: %Sec_Analysts
description: Security Administrators group sudo rules
sudoCommand: /usr/bin/less /var/log/*
sudoCommand: /usr/bin/tail /var/log/*
sudoCommand: /usr/bin/head /var/log/*
sudoCommand: /usr/bin/vi /var/log/*
sudoCommand: /usr/bin/vim /var/log/*
sudoOption: !authenticate
sudoOrder: 115
sudoRunAsUser: root
sudoUser: %GroupEX
This only works when the user that belongs to GroupEX run the commands as shown:
/usr/bin/less /var/log/*
/usr/bin/tail /var/log/*
...
But this does not work when the command is performed as:
/usr/bin/less /var/log/warn
/usr/bin/tail /var/log/warn
Any ideas?
Using ACLs and File permissions are not an option here.
Thank you so much.
Regards.
[cid:image001.gif@01D7BB82.7B9FECE0]
Dario Garcia
Díaz-Miguel
GGCS-SES Unit
GGCS SKMF Infrastructure Division
GMV
C\ de Isaac Newton, 11
28760, Tres Cantos, Madrid
España
+34 918 07 21 00
+34 918 07 21 99
www.gmv.com <http://www.gmv.com/>
[cid:image002.png@01D7BB82.7B9FECE0]<http://www.facebook.com/infoGMV>
[cid:image003.png@01D7BB82.7B9FECE0]<http://www.twitter.com/infoGMV_es>
[cid:image004.png@01D7BB82.7B9FECE0]<http://www.youtube.com/infoGMV>
[cid:image005.png@01D7BB82.7B9FECE0]<https://www.linkedin.com/company/gmv>
[cid:image006.png@01D7BB82.7B9FECE0]<http://www.gmv.com/en/RSS>
[cid:image007.png@01D7BB82.7B9FECE0]<http://www.gmv.com/blog_gmv/language/en/>
P Please consider the environment before printing this e-mail.
11:54 a.m.
On 10/7/21 13:51, Dario García Díaz-Miguel wrote:
We have a LDAP group that should be able to vi, tail and less all the
files contained inside /var/log/
Bad idea because less and vi let the user escape to shell.
We are thinking about using wildcards but it seems that the wildcards
that works for suders file does not works when the backend is the LDAP.
IMHO this question should be better asked on sudo-users list:
https://www.sudo.ws/mailman/listinfo/sudo-users
On sudo-users there are people who can explain in more detail why you
should not use sudo like that.
Especially granting read access to log files should be done by
appropriate group ownership and file permissions/ACLs.
Some introduction to the security issues:
https://www.sweharris.org/post/2018-08-26-minimal-sudo/
Ciao, Michael.
12:58 p.m.
I would also agree that this is probably better suited for the sudo-users list, however I
will add that in general you should allow the sudoedit program instead of allowing direct
sudo use to vi, nano, emacs, etc:
user@host:~$ ldapsearch -Y GSSAPI -QLLL -b
"cn=pgsql-mgr-default,ou=SUDOers,dc=harmonywave,dc=cloud" | grep sudoedit
sudoCommand: sudoedit /etc/apt/*
sudoCommand: sudoedit /etc/docker/*
sudoCommand: sudoedit /etc/logrotate.d/postgresql-common
sudoCommand: sudoedit /etc/postgresql-common/*
sudoCommand: sudoedit /etc/postgresql-common/pg_upgradecluster.d/*
sudoCommand: sudoedit /etc/postgresql/*/main/*
sudoCommand: sudoedit /etc/postgresql/*/main/conf.d/*
This solves/avoids the root escalation issues with editors.
On 10/7/21 12:54 PM, Michael Ströder wrote:
On 10/7/21 13:51, Dario García Díaz-Miguel wrote:
> We have a LDAP group that should be able to vi, tail and less all the files contained
inside /var/log/
Bad idea because less and vi let the user escape to shell.
> We are thinking about using wildcards but it seems that the wildcards that works for
suders file does not works when the backend is the LDAP.
IMHO this question should be better asked on sudo-users list:
https://www.sudo.ws/mailman/listinfo/sudo-users
On sudo-users there are people who can explain in more detail why you should not use sudo
like that.
Especially granting read access to log files should be done by appropriate group
ownership and file permissions/ACLs.
Some introduction to the security issues:
https://www.sweharris.org/post/2018-08-26-minimal-sudo/
Ciao, Michael.
--
Thanks,
Joshua Schaeffer
718
days inactive
718
days old
openldap-technical@openldap.org
2 comments
3 participants
participants (3)
-
Dario García Díaz-Miguel -
Joshua Schaeffer -
Michael Ströder