sudon't – blog by Tony Finch : linux

[–] turbowafflz@lemmy.world 15 points 6 months ago (2 children)

I feel like an important thing he forgot to mention though is that it lets you allow multiple users to have root privileges without having to share passwords or SSH keys

[–] hunger@programming.dev 23 points 6 months ago (1 children)

Why would they need to share ssh keys? Ssh will happily accept dozens of allowed keys.

[–] turbowafflz@lemmy.world 2 points 6 months ago

Oh true yeah I always forget about that

[–] lemmyreader@lemmy.ml 7 points 6 months ago

Indeed useful to not having to share passwords. I think sudo historically started as a way to let some users in a company for example manage printer server settings without having a root password. (And I believe it was Ubuntu in 2004 which promoted sudo and forced the default user after an installation to use sudo to perform root commands).

[–] just_another_person@lemmy.world 13 points 6 months ago (1 children)

Somebody call the Wahhhmbulance. This guy is outmoded. How about expanded security permissions for small groups of people in a larger directory? How about PAM auth plugins? How about escalation preventiontion for those same people, PLUS auditing instead of just seeing "root did something dumb".

I don't even get why this gent even bothered to wine and complain about this except that he doesn't "get it". This has been a solved issue for over 20 years now, and you don't see large swathes of folks bitching and moaning about sudo at all.

[–] 7heo@lemmy.ml 13 points 6 months ago (1 children)

If you need to provide tools that cross security boundaries then [...] a small web app is better [than sudo].

A web app? Effin really!!? 🤨

[–] GenderNeutralBro@lemmy.sdf.org 11 points 6 months ago

This is the part that confused me most. At the first mention of web apps, I just thought, okay, if you have a web server you can have it run under a service account that can do what it needs to do. Sure. Kind of beside the point, but sure.

Then this came at the end and and I did a double-take. He's really suggesting a web app as a substitute for sudo in general? Two questions:

Wat?
Wut?

[+] MonkderDritte@feddit.de -9 points 6 months ago* (last edited 6 months ago) (2 children)

Sudo and doas are 1000x (in loc) more complex than they need to be for destop pc. Yet they are always default installed and some tools even expect them.

edit: didn't know that doas is that small. I thought it has ~1/10 of sudo's code but it's actually ~2k vs. 132k of sudo.

[–] just_another_person@lemmy.world 18 points 6 months ago (1 children)

I await your much improved solution then. It sounds so simple, I bet you knock it out over the weekend, right?

[–] MonkderDritte@feddit.de 0 points 6 months ago (1 children)

Actually, i thought about merging rdo and ssu, both a bit over 100 loc in C. Yes, it would be feasible over a weekend. I just have a lot of other stuff i need to do first.

[–] lemmyreader@lemmy.ml 3 points 6 months ago (1 children)

Actually, i thought about merging rdo and ssu, both a bit over 100 loc in C.

Found ssu here : https://github.com/illiliti/ssu Can't find rdo. What is it ?

[–] MonkderDritte@feddit.de 3 points 6 months ago* (last edited 6 months ago) (1 children)

https://codeberg.org/sw1tchbl4d3/rdo

Thought about "merging" because ssu works without asking for password, but it has weak argument parsing (need 'ssu -- stuff') and works only on cli stuff. "Merging" meaning taking some inspirations from rdo to fix ssu. But ssu is great if used in yay (aur helper) or for nano, mv & co.

[–] lemmyreader@lemmy.ml 3 points 6 months ago

Thanks

[+] velox_vulnus@lemmy.ml 8 points 6 months ago* (last edited 3 weeks ago) (2 children)

[deleted]

[–] NekkoDroid@programming.dev 5 points 6 months ago* (last edited 6 months ago) (1 children)

doas is relativly simple (a few hundred LOC), especially compared to sudo. The main benefit of run0 over doas is that it isn't a SUID binary, they are similary complex.

[–] d3Xt3r@lemmy.nz 5 points 6 months ago

doas is relativly simple (a few hundred LOC)

Actually it's close to 2k lines of code (1,946 to be exact). But yes, it's certainly a lot simpler than sudo (132k).

[–] MonkderDritte@feddit.de 1 points 6 months ago

I use rdo and ssu, each with a bit over 100 loc C code. Though they both have their own strong and weak points, i'm sure there are other similiar tools around.

Linux

Rules

Related Communities