Problem: root is too powerful

• giving out root privilege is dangerous
• but it's too much bother to do things for others.
• Normal users can't help themselves.

Readers-Writers problem

• If two entities try to WRITE the same file at the same time,
• the LAST CLOSE wins! (race condition)
• Suppose two people edit /etc/passwd at same time!
• One is going to lose => lose integrity (you no longer know what's in your system).

Risks

• normal people can make mistakes as root and destroy systems.
• normal people can expose the real root password to sniffing.

Solution: power broking

• sudo: limited root privilege broker.
• allows a limited number of users to do some things as root
  • clearing printers.
  • breaking locks on screens.
  • bumping students out of labs.
• without giving anyone the real root password.

Using sudo:

• sudoers: a file describing access rights contains
  • host aliases:

     Host_Alias      SERVER=andante,largo,allegro,conbrio
     Host_Alias      LAB_CLIENT=c1,c2,c3,c4,c5,c6,c7,c8,c9,c10
     Host_Alias      SUNS=SERVER,LAB_CLIENT
    

  • user aliases:

     User_Alias      FACULTY=couch,dwk,ablumer,margo
    

  • command aliases:

     Cmnd_Alias      PRINTING=/usr/lib/lpsched,/usr/sbin/lpshut,/usr/bin/cancel
     Cmnd_Alias      REBOOT=/usr/sbin/reboot,/usr/sbin/halt,/usr/sbin/shutdown
    

  • Command patterns

     couch           blackhole=REBOOT
     FACULTY         ALL=PRINTING
    

• To utilize a command, simply type

   sudo /usr/sbin/reboot
  

• sudo asks you for your own password,

   Password: 
  

• and if correct, does what you wish!