Defining the Alias 215

The /etc/sudoers file opens.

The file contains four commented lines, acting as placeholders for alias definitions.

4. Enter the aliases under the appropriate headings.

For example, if you’re creating a Cmnd_Alias, place it under the comment that says # Cmnd_ Alias specifications. See the next section, “Defining the Alias,” for more information about the format of an alias.

5. When you’re finished adding aliases, save the file and exit the editor.

When you save the file edits, you may get an error message in the terminal window:

Warning: undeclared Host_Alias ‘NAME’ referenced near line 12

>>>sudoers file: syntax error, line 11<<<

What now?

The sudoers error messages aren’t very helpful. Odds are, you made a typing error, so enter an e to reopen and edit the file and then check your entry. sudo is particularly fussy about capitalization; the first letter of the alias type and the word alias need to be capitalized.

Defining the Alias

Before you can add an alias, you need to decide what the alias will contain. This takes a bit of thought, but as you think about your users and their roles in the workplace, some logical divisions of privileges will probably emerge.

Model the sudo aliases against the real-world roles that your users take on and the realworld privileges that the company structure might impose. A management hierarchy might translate into a hierarchy of user aliases and privileges.

Here’s the basic format of an alias definition:

Alias_Type ALIASNAME = member one, member two

Note that capitalization is important in the sudoers file. Alias names may contain only uppercase letters, numbers, and underscores (and must begin with a letter). The words User_Alias, Runas_Alias, Host_Alias, and Cmnd_Alias must all be captalized as shown in this sentence.

Creating a User_Alias

To create a User_Alias named ACCTG consisting of Freddie, Franklin, and Georgette, add the following code to the /etc/sudoers file:

User_Alias ACCTG = freddie, franklin, georgette

To create an alias consisting of the members of another group but excluding a certain member, you can define a group as follows:

User_Alias MGMT = ACCTG, ! georgette

The ! excludes Georgette from the MGMT group.

You can use the ! to exclude the rights to certain privileges from certain users, but don’t consider that to be absolute security. Wily users can find their way around a lack of privileges if they really want to.

Creating a Runas_Alias

The command to create a Runas_Alias is similar to the command to create a User_Alias, but you can also specify members by their user numbers:

Runas_Alias OPERATORS = #1, murphy, rachel, bernie

A single user can belong to many aliases — the user gains the privileges of each group. In a small company, the timesaving benefits might not be immediately obvious, but if you’re managing the

216 Technique 32: sudo Pseudonyms

privileges of dozens of users, aliases can really help speed things up.

Simplifying group managment with a Host_Alias

Use the Host_Alias to make management of groups of computers easier. To add a Host_Alias named

FRANCE consisting of bastille, versaille, and louvre, add the following line to the sudo configuration file:

Host_Alias SERVERS = bastille, versaille, louvre

You can also specify computers by IP addresses:

Host_Alias SERVERS = 192.168.0.1,

192.168.0.36, 192.168.0.22

You can use a Host_Alias in combination with a User_Alias to assign the user group privileged access to a group of computers without giving out the superuser password.

Mounting and unmounting CDs without the superuser password

You might want to allow users to mount and unmount CDs without becoming the superuser. If you don’t want to expose the privilege on all your computers, create a Host_Alias that includes the computers that the users will access. To do so, follow these steps:

1. Add the Host_Alias to the Host Alias Specification section of the sudoers file:

Host_Alias CDROMHOSTS = 192.168.0.1,

192.168.0.28, 192.168.0.218

2. Add a line in the User Privilege Specification section of the sudoers file that gives the privileges to everyone:

ALL CDROMHOSTS = NOPASSWD: /sbin/umount /dev/cdrom, /sbin/mount /dev/cdrom

ALL is a built-in alias that matches all items of that particular kind (all users, all hosts, and so on). Use the expression ALL where you would

put a user name, and it will include all the users. Use the expression ALL where you would use a host name, and it will interpret it to mean all the hosts it knows about.

Instead of using ALL, you can substitute your own User_Alias into the command and limit the users that can mount and unmount CDs.

After you set up users by following the steps in this section, the users need to add sudo to the front of the mount and umount commands when entering them to use their sudo privileges.

Including the NOPASSWD flag exempts your users from having to enter their sudo passwords. Passwords offer an extra line of security, but for some things (such as mounting a CD), your users will thank you for not requiring a password.

Managing access to dangerous commands with command aliases

Use command aliases to easily manage privileges for dangerous commands. When a user needs to use a dangerous command, you can ration the access instead of giving out the superuser password and unlimited access to all commands. Here are some commands you might consider controlling with sudo:

su

rm

mkfs

kill

killall

parted

One handy command that other users would find helpful, but that normally requires superuser privileges, is rpm. If you read Techniques 17 and 18, you already know how handy rpm is when it comes to installing and updating software. And with sudo aliases, you can share the tool without sharing the superuser password.

Defining the Alias 217

1.

2.

	To add a command alias to the sudo configura-	Cmnd_Alias RPM = /bin/rpm
	tion file, define the Cmnd_Alias with the fully	3. Then add a line to the sudoers file under the
	qualified pathname to the command:
		User Privilege Specification section:
	Cmnd_Alias DANGER = /usr/su, /usr/bin/
		OPERATORS ALL = NOPASSWD: RPM
	kill, /usr/bin/killall, /bin/rm,

sbin/mkfs

The location of the commands may vary system to system. Use the fully-qualified pathname when you define your command alias.

Add a command alias in the Cmnd Alias Specifications section of the sudoers file to create an alias for the RPM command:

This line grants access to the rpm command to all members of the OPERATORS User_Alias on ALL host machines.

OPERATORS must add sudo to the front of the rpm command in order for sudo to grant the required privilege: $ sudo rpm -Uhv rpmpackage.rpm.

33	Securing Your
	Connections
Technique	with SSH

Save Time By

Keeping your private bits private

Using a secure GUI across a network

Using public-key authentication for remote login

Using scp to copy files

Forwarding ports to securely breach a firewall

In the good old days, if you wanted to log in to a remote computer, you simply ran telnet. The telnet program would reach across a network and give you a remote command line. When you typed a command

into the telnet client, the characters that you typed were sent blissfully over the wire, and the telnet server on the other end would execute the command and send the results back to you. Were we really so young then? With the advent of the Internet, new villains appeared, eager to grab our passwords and credit card numbers as they leapt from ISP to ISP. The problem with telnet is that everything that you type is sent across the network in the clear. Anyone watching the bits stream across the network can see your private bits. The solution to this problem is SSH.

SSH, which is an acronym for secure shell, encrypts your data as it travels across a network so that passwords, financial data, and private e-mail are never exposed to any hacker who can intercept them. An SSH connection consists of two parts: a server and a client. An SSH server waits patiently on a host computer, listening on a specific port for a client to log in. When an SSH client connects to a server, the two programs begin a lengthy negotiating session that results in a fully encrypted connection.

SSH provides a remote command line. With SSH, you can start graphical programs that run on the server but display their data on your local computer.

SSH also provides port forwarding. With port forwarding, you can tunnel through firewalls to gain access to machines on the other side. Forwarded data is protected traveling back and forth to the protected host, while the server remains secure behind its firewall.

In this technique, we introduce you to the benefits of using an SSH client. SSH provides a secure connection across a local network or over the Internet, through firewalls, and with great speed, and it merges with your desktop environment via a quick link. We show you how to use your SSH client (which comes complimentary with Fedora) to do all of these things.