210 Technique 31: Gaining Privileges

Sometimes, you need to do those things because users come and go, passwords are forgotten, and files need changing. Save yourself a lot of time by limiting your powers and minimizing the damage that you can do. Save the power for when you really need it.

Gaining Superuser Privileges

Given all the exciting and hazardous things that a superuser can do, how do you become one? Simple: Just type su at the command prompt. Okay, the process is not quite as simple as that — you also have to know the superuser’s password.

Here’s a short example. Say that you want to modify the /etc/motd file. (The content of /etc/motd is displayed whenever you log in to your system — motd stands for message of the day.) Customizing /etc/ motd is a quick way to alert your users that something important is happening today. On most systems, /etc/motd can be modified only by the superuser, as described in the following steps:

1. Log in to your system as a normal (that is, nonsuperuser) user.

2. Type the su command at the prompt:

[freddie@bastille /]$ su

su requests the superuser password:

Password: <enter the superuser password here>

3. Enter the password.

If you’ve entered the correct password, the prompt changes from $ to # to remind you that you hold elevated privileges. See the “Do- it-yourself identity checking” sidebar for details on an even better way to see your privileges at the prompt.

[root@bastille /]#

At this point, su starts a new, highly privileged shell for you.

4. Overwrite the /etc/motd file as follows:

[root@bastille /]# echo “Bastille will be down this evening for an upgrade” > /etc/motd

[root@bastille /]#

5. Now here’s the most important part: Exit the privileged shell, forfeiting your new privileges:

[root@bastille /]# exit [freddie@bastille /]$

Do-it-yourself identity checking

The bash shell is just trying to be helpful when it changes your prompt from $ to # (and back again), but if you modify your prompt, you can’t rely on this cue. For a more definitive hint, the id command is your answer. id prints out your current identity:

[freddie@bastille /]$ id uid=501(freddie) gid=501(freddie)

groups=501(freddie)

Notice that id printed your user ID (and name) and a list of groups to which you belong (in this case, a single group named freddie). Now give yourself superuser privileges and try the id command again:

[freddie@bastille /]$ su Password:

[root@bastille /]# id uid=0(root) gid=0(root) groups=

0(root),1(bin), ...

[root@bastille /]# exit [freddie@bastille /]$ id uid=501(freddie) gid=501(freddie)

groups=501(freddie)

You see that the su command changes more than just your privileges: It changes your identity as well.

Pretending to Be Other Users

Because su gives you a way to become the superuser, you may be thinking that su stands for superuser.

In fact, su stands for substitute user: You can impersonate any user with su (as long as you know the right password).

Limiting Privileges with sudo 211

One reason that you might want to impersonate another user is to gain privileges to a particular piece of software, but you may not need all the privileges of the superuser to accomplish what you need to do. If you give yourself only the privileges that you need instead of giving yourself the power to accidentally destroy your system, you’ll save yourself a lot of grief and wasted time.

To see how impersonating a user without gaining all the powers of the superuser works, take MySQL as an example. When you install a MySQL database, you usually create a new user account for the MySQL administrator. The MySQL administrator is not a real person (in most cases), it’s just a name for a set of privileges. To fire up your MySQL database, you must become the MySQL administrator for a while:

[freddie@bastille /]$ su – mysql [mysql@bastille /]$ id

uid = 301(mysql) gid=301(mysql) groups=301(mysql)

[mysql@bastille /]$ mysqld_safe & [mysql@bastille /]$ exit

Notice the hyphen in this command, which tells su to invoke the login scripts for user mysql. When you run su without a hyphen, you’re impersonating another user. When you run su with a hyphen, you’re impersonating another user and inheriting the environment variables (and shell aliases and functions) that belong to that user.

The most common problem you run into

(if you forget the hyphen) is that your $PATH environment variable is wrong. For example, if you forget the hyphen when you su mysql, it’s pretty unlikely that the mysqld_safe command will be in your $PATH search path: mysqld_safe is on mysql’s search path. In other words, su - is a complete impersonation.

Limiting Privileges with sudo

a bazooka; sure, you can hunt squirrels that way, but it’s safer to use a smaller armament. If you’re running a shell while you have superuser privileges, it’s just too easy to make a typing mistake that deletes important information. (Trust us, we’ve done that a few too many times.)

One way to avoid shooting yourself in the foot is to use sudo instead of su. From a user’s point of view, sudo is very similar to su: Each command starts a new program that holds elevated privileges. su gives you all privileges, but sudo gives you only the privileges granted by an administrator. In other words, sudo gives you a way to grant partial privileges to those who need them, without giving them the whole bazooka. Really, you need to su only when you configure sudo.

The whole point of using sudo (instead of su) is to save yourself time by avoiding disasters. If you decide to use su in your normal course of work, be sure to read Techniques 49 and 50 (backup and recovery).

sudo is controlled by a configuration file named /etc/sudoers. The layout of a sudoers file can be a bit confusing at first, but don’t be intimidated. Here’s a simple /etc/sudoers file:

# file:	/etc/sudoers
freddie	bastille = /bin/mount

The first line is a comment (anything that follows a # is treated as a comment). The second line grants user freddie the right to run the /bin/mount command as long as he’s logged into a computer named bastille.

Now if freddie wants to mount a file system, he’ll have to ask sudo to do the work for him:

[freddie@bastille /]$ sudo mount /dev/cdrom /mnt/cdrom

[freddie@bastille /]$

		When you add entries to the sudoers file, be
What’s wrong with the su command? Running a shell		sure to include the complete pathname to
		each command. If you don’t, dastardly users
as the superuser is sort of like hunting squirrels with

212 Technique 31: Gaining Privileges

can simply slip a bogus program (with the same name) into their search path and gain privileges that you don’t want them to have.

The first time you edit the /etc/sudoers file, you’ll notice that it’s already filled in with sample entries. Don’t even look at them. They’re too confusing. Just add the one or two lines that you need and ignore the samples.

Freddie can now mount CDs, but he can’t unmount them. That’s easy to fix; just add the umount command to the list of privileges:

# file: /etc/sudoers

freddie bastille = /bin/mount, /bin/ umount

Now freddie can mount and unmount file systems. But what if you want freddie to mount and unmount only CDs, not other file systems? That’s easy, too:

# file: /etc/sudoers

freddie bastille = /bin/mount /dev/cdrom, /bin/umount /dev/cdrom

Save time by including host names in the sudoers file, maintaining a single master copy of the file, and copying it to each machine on your network. That way, you don’t have to create a separate sudoers file for each machine. In fact, you can store the sudoers file in CVS

(see Technique 13) to maintain a complete history of all the privileges you’ve ever granted on your entire network.

Of course, you can also list multiple users in the same sudoers file:

# file: /etc/sudoers

freddie bastille = /bin/mount /dev/cdrom, /bin/umount /dev/cdrom

franklin,tex versaille = /usr/bin/reboot, /sbin/dump, /sbin/restore

The third line grants two users (franklin and tex) the right to reboot and the rights to backup and restore, but only on a host named versaille.

You can see the pattern: Each entry starts with a user name (or a list of user names), a host name (or a list of host names), an equals sign, and then a command (or list of commands). Each entry grants a set of privileges to one or more users on one or more hosts.

The man pages for sudo (and sudoers) state that you must use the visudo command to edit the /etc/sudoers file. That’s not really true; you can use any editor you like. visudo does some extra error checking whenever you save your file, but we find the error messages to be more confusing than helpful.

32 sudo Pseudonyms

Technique

Save Time By

Creating a User_Alias to manage group privileges

Using a Host_Alias to assign resource privileges to groups

Creating a Cmnd_Alias to keep dangerous com-

mands under control

Sharing superuser commands without sharing the password

Every system administrator walks a thin tightrope. On one hand, you must secure your system against both accidental and intentional damage. On the other hand, you can’t tighten security to the point

where average users can’t get their jobs done. In a traditional Linux (or UNIX) system, privileges are granted to the superuser. If you need a privilege, you impersonate the superuser (with the su command). The problem with this approach is that you gain all privileges as soon as you know the superuser password. Give yourself enough privileges to mount a CD, and you’ve also gained enough privileges to delete every file on your computer. sudo (see Technique 31) can help by handing out privileges to specific users and programs. But if you have a mediumto large-sized network, managing sudo privileges can become a time consuming chore.

Assigning privileges with sudo aliases can help make quick work of the task. A sudo alias is an easy way to refer to a group of users, hosts, or commands when handing out privileges that are normally given to the superuser. The elements of the superuser privileges can be assigned individually, so the administrator doesn’t have to give out the root password. Only the privileges that a user really needs are given out.

With sudo aliases, you can create User_Alias groups to assign privileges to groups of users. If the group (or department) gains new users, just add those new users to the User_Alias, and they automatically have all the privileges shared by that group. No one gets the superuser password, so you don’t need to worry about runaway superuser privileges.

Host aliases allow you to control groups of computers with one set of privilege assignments. You can quickly combine user aliases and host aliases to grant access to machine resources to the users that really need the resources, but still restrict the superuser privileges that might pose a security threat to the system.

In this technique, we show you how to save time by using sudo’s aliases to assign privileges to groups. When you become a sudo superuser, you really start to save time. In this technique, we show you how to use sudo aliases to save time assigning privileges. And your system will be a safer place for it.