Re: [gentoo-user] Rooted/compromised Gentoo, seeking advice

[Indexer <indexer@internode.on.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On 10/08/2010, at 11:44 AM, Frank Steinmetzger wrote:

> Am Dienstag, 10. August 2010 schrieb Paul Hartman:
> 
>> Typing that long password into sudo every time I ran a command was a
>> hassle
> 
> I’ve never used sudo, and never really liked the idea of it. In fact I’m 
> always amused and slightly annoyed by the sheer amount of sudo one can find in 
> your typical ubuntu howto. ;-)
> 
> It’s one reason why I abstained from installing Truecrypt 6, because it 
> requires sudo (Yes I know, in default setup you can’t do much with it. It is 
> but an issue of principle). However, because I need root commands regularly 
> (for example to initiate the VPN to my uni’s WiFi), I usually have one tab in 
> Yakuake where I do a normal su once after login.
> 
> And for more safety on my part, I also use different prompts: red hostname for 
> root console, green user@hostname for nonroot.
> -- 
> Gruß | Greetings | Qapla'
> What’s right is right, otherwise it’d be wrong.

I hope you realise the use of "sudo -i" will give you a root shell just like su. The reason sudo is preferred is that it means between multiple administrators, you can eliminate the need for a shared password. sudo can also control who and what groups can access sudo, and even subsets of commands.

sudo also has a "grace timer" in which once you prove your identity with your password once, you can use sudo without a password for a period of time after that. This can also be canceled with sudo -k

In terms of system administration best practices, sudo is the way to go. You will see it used in all server administration tasks to escalate privileges, in a secure manner.

William Brown

pgp.mit.edu



-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)

iQIcBAEBAgAGBQJMYLhgAAoJEHF16AnLoz6JhJ8QAL5SO5DRmcQ3wXLdtMZooACu
WT4qyfKBnfMqakLJlSWYOH6tuIoK/mVYpeCpQmjpTuKaE90tnLnngCOVnG7puyqG
LkPBNew3iOsO0JJcNzCcMiwWQ1C7d2hkSyNl48FVwBwaVgbPmWL6flPLxwHxdbU1
O2Kke8ku2dAVRTg9NdnPnTcc7y1h2/VYLwqSY10ybHS4I6a7YuhEIeGZtCqfEZ6d
0WkbUaU2IJFEVskR2pRV3Oh8FOgjW1XpYPzGrzQgpByghVgDxalFpC89g3xVw2ue
bbRZNcn6NfZnfS/ltsCLr0mzSkV9xUXtYJkSQWN2jZbXM5rr+5gQXk1CqYLeDkjS
4HFST6bFfUUl7KMlo/mfH7PSD3Coa1J/DwcZFM9xkMx/sTy/TDsQhG1Qgb5jSn4u
/TVYRwkvNj/KXBolDPcEQkZ6h35R8h9gGFRaW9u1+O2YyLC8uOyFUhd0iHNo0+s0
r4Q0wiwnY7I5CI2ZQ5h2blbYzqyvgSa43rYp3rho9cp4LktDKO2qfoIW/CV/0Q6r
NmWcuzaU17QTAQn8VL2SUfG0zqXgCI4NlQcU8iNnYFRGUTvdx4crjzrgIqYm2rc+
PbpFuLl4Uz000hsQYXWfy9hwIMbxilT4F9AOpKmyU392GZ/22WUvoMk2uhzt8aCf
w44gvZvW1e44buFM2L/z
=AR4J
-----END PGP SIGNATURE-----