HOWTO Setup sudo to Avoid Entering a Password

[bchat]

Recommended Setup
Instead of a password-less setup I recommend simply putting your userid into the sudo group. You will have to enter a password once and a while, but it is more secure because it doesn't leave you as vulnerable to malicious scripts that use sudo to get root access. When you enter your password you won't have to enter it again for a certain amount of time.

You should add your userid to the sudo group.This is the command you would use if you wanted to do this, replacing "bill" with your own userid:

Code: Select all

usermod --groups sudo --append bill

Password-Less Setup

DISCLAIMER: Following this procedure leaves you vulnerable to attacks from scripts that use sudo to get root access.

To setup sudo so that you don't need to enter a password, follow these steps:

Steps

1. Become root by entering the "su" command followed by the root password, when prompted.
2. Used your editor to create a file in the /etc/sudoers.d directory. You can name the file whatever you want. I named it sudoers-custom. For example:

   Code: Select all

   vi /etc/sudoers.d/sudoers-custom

3. Add the following line to the file, replacing "bill" with your userid because "bill" is my userid:

   Code: Select all

   bill    ALL=(ALL:ALL) NOPASSWD: ALL
   

[ziggybopbopdoo]

If you are reckless in regards to security then you might as well do this.

If you care about the security of your system you would never do this.

If you are hyper vigilant about security then you would not even have sudo installed if it isn't necessary.

[caduceus]

have you ever read the sudoers manual. this and other items in the manual configs is what makes the whole system difficult.
here is a set of procedures.
here is the way to basterdize it.

[Randicus]

Do not be hard on the OP caduceus. This is a wonderful how-to. It almost removes those "annoying" security features of a Unix-based system entirely. The only step left is to configure automatic log-in as root without a password. Then the system would be configured perfectly!

[ziggybopbopdoo]

I have no idea what he is bastardizing and certainly a admin can configure his system any way he wishes.

I would suggest a little warning but then again if someone is going to tweak then they certainly should understand their actions have consequences.

Heck I always like to give enough rope for someone to hang themselves, makes for great entertainment.

[Randicus]

certainly a admin can configure his system any way he wishes.

But if that person does something that is incorrect, unwise, foolish or stupid, that person should not give others instructions to do the same. Posts like the OP are an argument for guides to need a moderator's permission before being added to the how-to section. With the continual decline in the board's quality, such a system might need to be considered.

[ziggybopbopdoo]

But if that person does something that is incorrect, unwise, foolish or stupid, that person should not give others instructions to do the same.

I agree, if it is inherently dangerous and glaringly obvious that in no situation could it be useful/desirable then it certainly should certainly get the torch. Could you please explain what about this is unwise, incorrect, foolish or stupid?


I do not see anything incorrect about properly configuring sudo. It is capable of being configured with no password so it is a valid configuration. It is simply a utility and a way of configuring the utility.

I do not see it as inherently unwise/foolish/stupid. It may be unwise/foolish/stupid depending on the situation but that is something each person will need to determine for themselves.

Now that I think about it I wonder why on earth I bother with a sudo password for myself. It doesn't actually make much sense in my situation. I don't run questionable code. I am the only user so no need for restricting which commands I can use. What would be the point in having to enter a password to run a command that I want to run?


As I mentioned a warning would be nice but then again the ramifications of doing this should be obvious anyway.

[Randicus]

Could you please explain what about this is unwise, incorrect, foolish or stupid?

Is disabling basic security features wise or unwise? That is for each to decide on their own.

I am the only user so no need for restricting which commands I can use. What would be the point in having to enter a password to run a command that I want to run?

That is fine if one knows what one is doing, but it is terrible advice to give to those who do not yet know. To use your earlier analogy, that is not giving someone enough rope to hang himself. It is giving him the rope and the idea.

[ziggybopbopdoo]

That is your whole arguement? You keep saying is is unwise, foolish, stupid, terrible advice yet you never actually say what makes it so.


No security feature is being disable, negated, or even worked around. A tool is being used. The admin is configuring sudo apropriately for the situation.


How is this terrible advice to give a user? The user certainly already knows his password so what would having him type it again solve or cause?


Certainly he isn't going to accidently type in sudo before a dangerous command and press enter accidently. If he does then he could of just as easily typed in his password accidently, opened up a root terminal accidently, su'd to root accidently, etc.

[curtaintwitcher]

Passwordless sudo potentially gives malicious code unrestricted access. If I write a script and precede every command with sudo, on a regular sudo setup, it will prompt for the password, on the OP's system it can silently compromise security.

[ziggybopbopdoo]

Passwordless sudo potentially gives malicious code unrestricted access. If I write a script and precede every command with sudo, on a regular sudo setup, it will prompt for the password, on the OP's system it can silently compromise security.

So I am dumb enough to run malicious code but I am smart enough not to enter my password when malicious code asks for it?

Really?

[Randicus]

[curtaintwitcher]

No, just run the X server as root, go ahead, knock yourself out.

[Randicus]

on the OP's system it can silently compromise security.

but I am smart enough not to enter my password when malicious code asks for it?

I highlighted the word you missed.

[ziggybopbopdoo]

No, just run the X server as root, go ahead, knock yourself out.

Logging into a graphical environment as root would be a totally different issue. That would be a one of those inherently dangerous situations. Lets stick to this issue or create a new thread please.

[ziggybopbopdoo]

on the OP's system it can silently compromise security.

but I am smart enough not to enter my password when malicious code asks for it?

I highlighted the word you missed.

Oh yea I missed it. So the MAJOR security issue is that in one case the code ran silently. In both cases the code was run but one of them was silent and the other wasn't. That is the big security issue? Not the compromise itself, not the idiocy of running untrusted code but only that one ran silently. Once again my respone is....REALLY?

If I am dumb enough to run malicious code then there is no reason to think I would not enter my password anyway. True it would not run silently but the end result would be the exact same.

Oh no, the code ran silently after I downloaded it, chown'd/chmod'd it, and executed it. Oh no I would definately be smart enough after that to not enter my password when asked. No silent code for me.

So either I am dumb enough to run malicious code and dumb enough to enter a password or I am not dumb enough to do either. You cant make a hypothetical user dumb as a box of rocks one minute yet sharp as a tack the next.

Not to mention, if you are going to run malicious code then I dont care about sudo access all I need is a keystroke logger!

[ziggybopbopdoo]

Not to mention, if you are going to run malicious code then I dont care about sudo access ...

enough fun stuff to do with user privys...

create a desktop file in the autostart folder to startup anything I want started

crank up your browser and direct it to a page where I could run some code against

check and see if you have ssh running and use that for all sorts of fun

I could just wget tons of kiddie porn onto your computer and notify the authorities and let them have fun with you.

not to mention plain old privilege escalation exploits if I did need higher privileges

But since it isn't run silently it isn't a security risk.

[Birdy]

Yall bark at the wrong tree.
The OP is in touch with a higher source: http://devotional.upperroom.org/ (from da signature).
No need to worry about earthly matters (An eternety with passwordless root rights, how cool does that sound?).

[ziggybopbopdoo]

I wish I could get the creeps about this, in the past it was possible for me to do so just for shits and giggles, but everytime I run scenarios nowadays I come up empty.

Either users are not reckless/ignorant regarding their system, in which case this is a non-issue as nobody would ever have a chance to abuse this setup or users are reckless in which case this is pretty minor as far as reckless behavior goes. I guess you could argue that, for reckless users, it adds to the recklessness. It would be like arguing that someone should not do something slightly reckless while they are already doing something catasrophic at the time. Either way it is the admin doing this and the risks should be glaringly obvious. It isn't something a user could do without realizing the exact ramifications. The point of the howto isn't cryptic or confusing. It doesn't need explaining to be understood. It isn't like expecting users to look at apt-listbugs to hopefully keep things in working order, it doesn't rely on understanding the difference in using release codenames in sources, ad nauseum.

Wanting to remove this howto would be like other forums banning dangerous commands and discussion of them.

[dilberts_left_nut]

Wanting to remove this howto would be like other forums banning dangerous commands and discussion of them.

+1

It is simply information (also available elsewhere) that some may find useful.
I question exactly *which* situations would call for it, but that may be just me...

You say you don't intentionally run malware, but would not a browser expolit script (which you may not intentionally run) also get root rights by simply invoking sudo?