Plant, Dean wrote:
I see your trying to protect your users from becoming root. You do realise that with that sudo configuration a user can still run "sudo /bin/bash" or any of the other shells to gain root access.
Hi Dean,
I don't think that's correct. One of the purposes of the sudoers file is you can limit users to specific programs, excluding them from others. This entry, which I just tested in my CentOS5.2 box, allows the user tldap to use yum, but not /bin/bash:-
tldap ALL=/usr/bin/yum Here's what happens when I try sudo as user tldap:- [EMAIL PROTECTED] ~]$ sudo yum update Loading "fastestmirror" plugin Loading "priorities" plugin Loading mirror speeds from cached hostfile * base: rsync.atworks.co.jp * updates: rsync.atworks.co.jp * centosplus: mirror.exetel.com.au * addons: mirror.exetel.com.au * extras: mirror.exetel.com.au 0 packages excluded due to repository priority protections Setting up Update Process No Packages marked for Update [EMAIL PROTECTED] ~]$ sudo /bin/bash Sorry, user tldap is not allowed to execute '/bin/bash' as root on www [EMAIL PROTECTED] ~]$ Cheers, Ian _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
