The security model of sudo versus su
Some time ago I wrote about the three faces of sudo,
where one of the faces was basically 'sudo as the replacement for
su in how sysadmins get unrestricted root privileges' and I said
that this created a different security model than with su. Today
I want to talk about what that new model is and how I see it differing
from su's in a way that makes me like it less.
To start with we need to talk about the security model of su. Su
has a simple security model: you must know the root password and
generally be in a restricted group. Then you can either get a root
shell or execute a command as root by giving su the root password,
and you must do this for every shell or command that you want.
(If your version of su is not configured to require membership
in group 'wheel' or the local equivalent, the security model is
that anyone at all who knows the root password can use su to
assume root powers.)
Sudo's normal security model is that if you are in a restricted group and know your own password, you can run commands as root or get a root shell by typing your own password. Once you've typed your password once you can then run commands as root without any prompt for a certain amount of time.
There are two big differences between these two security models. The
first is the choice of password that you are challenged with, where
sudo's choice is noticeably weaker. With sudo the security of root
access rests not on the root password alone but the passwords of
everyone who has root access. Since people's regular passwords are
used much more often and more broadly than the root password, my
view is that they are more exposed (including stored in programs). An attacker who compromises even one
sysadmin password now has immediate access to root by logging in as the
sysadmin and repeating the password that they already know; they don't
need to compromise an additional secret.
The second is that sudo effectively creates a temporary environment
where you have root powers by using a magic prefix. An attacker
that can detect this environment (or try blindly) and inject commands
into it (either directly or, for example, via a shell script that
you're running) can hijack this special power even without knowing
your password and immediately use root powers. My view is that this
makes a post-sudo shell session unusually dangerous and damaging.
It also somewhat increases the possibility of simple accidents,
since an errant sudo command will go through without a pause that
would give you a chance to reconsider.
Either or both of these changes can be turned off via sudoers
settings. But then you've reduced sudo to a variant of su.
Maybe that's what you want (sudo does have better logging than
su and some additional features), but I don't think it's the
common way to use sudo as a su replacement. Maybe I'm wrong
here, though; I'd be interested to hear if places that use sudo
as a su replacement turn off these.
Comments on this page:
|
|