Subject: Re: [lists@globalintersec.com: [Global InterSec 2002041701] Sudo Password Prompt Vulnerability.]
To: Jan Schaumann <jschauma@netbsd.org>
From: Thor Lancelot Simon <tls@rek.tjls.com>
List: tech-security
Date: 04/26/2002 07:46:51
On Thu, Apr 25, 2002 at 09:21:57PM -0400, Jan Schaumann wrote:
> ipthomas@mac.com wrote:
> 
> > 	I'm curious as to why so many publications these days tell users to 
> > use sudo rather then su.
> 
> A few weeks ago, there was a somewhat lengthy but informative thread on
> sage-members regarding su/sudo practices.  I've not yet determined how
> to access the ML's archive (if it exists), otherwise I could probably
> give you better examples.
> 
> Anyway, I think the main reason sudo is popular is that it prevents
> people from running around as root.  Sure, many of you guys may be

So what?  su -c can do that, without the complexity of sudo and without
the false sense of security.  If you want to let a user run one
particular binary as root, copy it and use group permissions (or ACLs
if your chosen Unix allows that; sadly NetBSD does not).

Sudo is both extraneous and dangerous.  When I find that I'm running
a system that relies on sudo in some way, one of the first things I do is
remove it.  And I've got to say that after about 15 years running Unix
systems, I am never particularly impressed with advice or discussion
from the SAGE types; that they'd advocate using sudo does little to change
that perception on my part.

Thor