Privilege escalation with sudo

Privilege escalation with sudo

Normal user in Linux can be allowed to execute privileged commands with sudo rights.

Sudoers configuration file is /etc/sudoers, however editing this file directly is not advisable either you can use visudo to edit this file or create a template file under /etc/sudoers.d. 

I would suggest use template file under /etc/sudoers.d which will be more easier to manage multiple user privileges and it can me efficient in managing granular access. 

Syntax - Who Where = (Runas-Who:group) What_Commands

Who - which user you want to give sudo rights/privilege.

where - In what server you want to grant the user access to execute mentioned commands.

Runas-Who:group - As which user will the user execute the granted commands. 

What_commands - Finally the commands that you want to provide access to user for executing. 

User Shiva is a normal user here and he is now allowed to list the repositories on the server without providing root password. 

NOPSSWD directive may be a security issue as it will not ask for a password when elevating privilege to execute the command. 

To over come this security issue you may use the line "defaults     !targetpw" - This will ask for the users password when elevating privilege.

Example: 

# visudo /etc/sudoers.d/shiva

defaults !targetpw

shiva ALL = (ALL:ALL) /usr/sbin/yum repolist

You can also enforce asking for root users password when elevating privilege. 

"defaults targetpw" 

Best practice:

Edit sudoers file with visudo which will validate the content when exiting and if anything wrong in the format it will show you error and you can edit the file to fix the issues. 

While editing the sudoers template, ensure you have two session opened with root rights and let one session be running with TOP command. After implementing sudoers config make sure that sudo command is working without any problem on a new session and then you can terminate the top command and its session. It would be helpful if the sudoers went wrong and you are locked out of root. 

This situation can occur when you have wrong sudo file and there is no root user login allowed directly. 

To validate the sudoers configuration you created using visudo -vf %s if it is formatted correctly

Linux - HA Cluster Maintenance

Linux - HA Cluster Maintenance

What is a cluster ? 

A group or collection of servers that is providing same service/application. 

In this blog we will see about setting cluster into maintenance mode and releasing cluster out of maintenance mode. 

What is Maintenance mode ? 

Maintenance mode is when the server is not available to service the customers and is currently undergoing a maintenance task. 

With HA Cluster enabled, If we need to perform some activity on the cluster managed pools/servers, we will need to enable cluster maintenance mode so that you do not see any unexpected behaviors from the system.

To enable cluster Maintenance following command is used. 

For SUSE Clusters 

crm configure property maintenance-mode=true

For Redhat Cluster

pcs property set maintenance-mode=true

When you have enabled/set the Maintenance mode you can perform start/stop or any config update on the cluster managed resources. During this period cluster will not interfere with these resources. 

Once we have completed the required activity to release cluster from maintenance mode following command is used. 

For SUSE Clusters 

crm configure property maintenance-mode=false

For Redhat Cluster

pcs property set maintenance-mode=false

Creating and modifying user in Linux

Creating and modifying user in Linux

    By default when you Install Linux Operating system a user will be created and that user will have full sudo privilege. However when ever you create a user after installing OS, you will need to provision required privilege for that user. In this blog i will show you few commands with useradd and usermod. 

    The following user karthick has been created when OS was installed and this user is added to the Wheel group to get the sudo privilege. User karthick can run privileged commands with his password. 

    To create a normal user in command line providing the users home directory and UID we will use as -d to specify user home directory and -u for UID.

#useradd -d <Path_To_User's_HomeDirectory> -u UID

UID is a unique identifier number used to identify the user. 

    This user does not have privilege to execute root level commands. However if we need to provide root access we will need to add this user to wheel group. To do so we will use usermod command

Adding users to this wheel group will gain complete root access for the user. 

    If you do not want user to have complete root access and instead provide granular or role based access we can provision that through sudo template. you can create a sudoers template/drop-in file under /etc/sudoers.d directory. 

We will see about sudoers template file in much more detail in upcoming blogs.