Learn / Linux Fundamentals / Accounts and Access

Sudo and Root

guidedeasy 25 min · 95 points

First Bit is still up for grabs: be the first to finish this room.

Some things only root may do, and handing someone the root password so they can do one of them is how small favours turn into permanent access. sudo exists to avoid that: it lets a named account run named commands as root, and writes down every use.

In this room you'll learn what root actually is, how to find out what you're allowed to run, and why a good sudo rule is a narrow one. Then you'll use the single command Iris has been given to read a file she otherwise can't touch.

CYB//RANGE Live lab

Task 1 What root is

Root is simply the account with UID 0, and the kernel skips almost every permission check for it. It isn't a mode you switch into, and it isn't the name: an account called dave with UID 0 is every bit as root as one called root.

There are two ways to become someone else, and they are not the same:

$ su -                  # become root, by typing root's password
$ sudo <command>        # run one command as root, by typing your own

su needs the other account's password, so everyone who may use it shares one secret, and nothing records who did what. sudo needs your password, grants only what a rule allows, and logs each command with the name of whoever ran it. On most modern systems root has no usable password at all, which makes su - impossible on purpose.

That's the security argument in one line: with sudo, access can be given narrowly, taken back from one person, and attributed afterwards. With a shared root password, none of those are true.

Rules live in /etc/sudoers, and usually in separate files under /etc/sudoers.d/. Edit them with visudo, never a plain editor: it checks the syntax before saving, and a sudoers file with a typo in it stops sudo working for everybody, including whoever needs to fix it.

An account is root when its UID is what?

*

Which of su and sudo makes you type the other account's password? (Two letters.)

**

Which command should you always use to edit sudo's rules? (One word.)

******

Task 2 Reading the rules

You don't have to guess what you may run. sudo -l prints your own rules:

$ sudo -l
User iris may run the following commands on box:
    (root) NOPASSWD: /usr/bin/cat /srv/finance/ledger.txt

Read that as: as root, without being asked for a password, exactly this command on exactly this file.

A rule has four parts: who, on which hosts, as whom, and what.

iris    ALL=(root)  NOPASSWD: /usr/bin/cat /srv/finance/ledger.txt
root    ALL=(ALL:ALL) ALL
%sudo   ALL=(ALL:ALL) ALL

A name starting with % is a group, which is why adding someone to the sudo group on Debian gives them full root: that third line already grants it.

Narrow rules matter more than they look. ALL at the end means every command, which is the same as giving out root. Even a specific command can be too much if the command can be talked into running something else: anything that can open an editor, run a shell or start a program of your choosing is a full escalation the moment it runs as root. less, find, vi and awk all can, and all have been handed out as "just one command" by someone trying to be careful.

The narrow version names the exact command and its arguments, and picks a program that does only one thing. cat on one named file can print that file, and that is all it can ever do.

Which command prints the sudo rules that apply to you? (Two words.)

**** **

Which character at the start of a sudoers name means it's a group, not a user? (One character.)

*

Which word at the end of a rule lets that user run every command as root? (Three letters.)

***

Task 3 Try it on a real machine

Iris needs one file out of the finance folder, and IT have given her just enough to read it and nothing else.

Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as iris.
Read ~/todo.txt, then try it the obvious way: ls -ld /srv/finance and cat /srv/finance/ledger.txt. Both fail. The folder's permissions say why.
Ask what you're allowed to run: sudo -l.
Run exactly that command, and read the ledger.
Try one more thing afterwards: sudo -n cat /etc/shadow. Being allowed one command is not being allowed the program. (-n means don't prompt; without it sudo asks for a password before telling you no, and iris hasn't got one.)

What are /srv/finance's permissions, as the nine characters ls -ld shows after the d?

*********

sudo -l names one program iris may run as root. Which? (Full path.)

/***/***/***

Run the one command she's allowed and read the ledger. What key is in it?

RZ{************************}