Re: Debian 12.9 and use of sudo for regular accounts

2025-02-22 Thread Greg
On 2025-02-21, Jonathan Dowland wrote: > On Fri Feb 21, 2025 at 2:36 PM GMT, Greg wrote: >> If you had to pick a man page to be inscrutable, this wouldn't be the >> one. > > I mean, for me, it is: don't tell me worse ones. I don't think I want to > see them… > It is? How odd. I've never used it

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-21 Thread jeremy ardley
On 22/2/25 06:49, Tom Dial wrote: On 2/20/25 22:17, jeremy ardley wrote: On 21/2/25 09:40, Tom Dial wrote: The TL;DR here is that for maintaining personal workstations and servers it makes more sense to log in as root, do the work as required, then log out. Or there is "sudo -i" to get an in

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-21 Thread Tom Dial
On 2/20/25 22:17, jeremy ardley wrote: On 21/2/25 09:40, Tom Dial wrote: The TL;DR here is that for maintaining personal workstations and servers it makes more sense to log in as root, do the work as required, then log out. Or there is "sudo -i" to get an interactive root shell and avoid prepe

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-21 Thread Jonathan Dowland
On Fri Feb 21, 2025 at 2:36 PM GMT, Greg wrote: If you had to pick a man page to be inscrutable, this wouldn't be the one. I mean, for me, it is: don't tell me worse ones. I don't think I want to see them… -- Please do not CC me for listmail. 👱🏻 Jonathan Dowland ✎j...@debian.o

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-21 Thread Jeffrey Walton
On Fri, Feb 21, 2025 at 9:37 AM Greg wrote: > > On 2025-02-21, wrote: > > > >> > The straight, but blunt, answer here, I think, is to read the man pages > >> > for sudo and sudoers > > >> In principle I agree with this advice but the sudoers manpage is > >> notoriously, famously inscrutable. > >

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-21 Thread Greg
On 2025-02-21, wrote: > >> > The straight, but blunt, answer here, I think, is to read the man pages >> > for sudo and sudoers >> In principle I agree with this advice but the sudoers manpage is >> notoriously, famously inscrutable. > > Start with the EXAMPLES section. Work from there. It'll com

ssh root login (was: Debian 12.9 and use of sudo for regular accounts)

2025-02-21 Thread Frank Guthausen
On Fri, 21 Feb 2025 13:17:21 +0800 jeremy ardley wrote: > > Logging in as root on a server is highly dangerous, especially if it > has an internet facing ssh port. There is an approach which might be helpful here and there: spawn a second ssh daemon with root login and bind network to localhost

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-21 Thread tomas
On Fri, Feb 21, 2025 at 09:12:49AM +, Jonathan Dowland wrote: > On Fri Feb 21, 2025 at 1:40 AM GMT, Tom Dial wrote: > > The straight, but blunt, answer here, I think, is to read the man pages > > for sudo and sudoers > > In principle I agree with this advice but the sudoers manpage is > notori

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-21 Thread Jonathan Dowland
On Fri Feb 21, 2025 at 1:40 AM GMT, Tom Dial wrote: The straight, but blunt, answer here, I think, is to read the man pages for sudo and sudoers In principle I agree with this advice but the sudoers manpage is notoriously, famously inscrutable. -- Please do not CC me for listmail. 👱🏻

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread jeremy ardley
On 21/2/25 09:40, Tom Dial wrote: The TL;DR here is that for maintaining personal workstations and servers it makes more sense to log in as root, do the work as required, then log out. Or there is "sudo -i" to get an interactive root shell and avoid prepending every command with "sudo." L

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread jeremy ardley
On 21/2/25 09:40, Tom Dial wrote: The TL;DR here is that for maintaining personal workstations and servers it makes more sense to log in as root, do the work as required, then log out. Or there is "sudo -i" to get an interactive root shell and avoid prepending every command with "sudo." A

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread Timothy M Butterworth
On Thu, Feb 20, 2025 at 5:46 PM Nicolas George wrote: > Jeffrey Walton (HE12025-02-20): > >and members of sudo can run any command. > > Is it because of this last line: > > > rootALL=(ALL:ALL) ALL > > > > sudoALL=(ALL:ALL) ALL > # User privilege specification rootALL=

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread Lee
On Thu, Feb 20, 2025 at 6:42 PM Jeffrey Walton wrote: > > Hi Everyone, > > I have a fresh Debian 12.9 install. My user account is part of sudo > group, and members of sudo can run any command. No... the "sudo" user can run any command: > sudoALL=(ALL:ALL) ALL I have %sudo ALL=(ALL:ALL)

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread Tom Dial
The straight, but blunt, answer here, I think, is to read the man pages for sudo and sudoers (i.e., the /etc/suduoers file that does access control for the sudo command. The command is very flexible and can be tuned to allow specified sudoers to use elevated privilege only to execute specific c

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread Xiyue Deng
Jeffrey Walton writes: > Hi Everyone, > > I have a fresh Debian 12.9 install. My user account is part of sudo > group, and members of sudo can run any command. However, I get an > error when trying to use sudo: > > $ sudo ls > [sudo] password for jwalton: > jwalton is not in the sudoe

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread Jeffrey Walton
On Thu, Feb 20, 2025 at 5:46 PM Nicolas George wrote: > > Jeffrey Walton (HE12025-02-20): > >and members of sudo can run any command. > > Is it because of this last line: > > > rootALL=(ALL:ALL) ALL > > > > sudoALL=(ALL:ALL) ALL > > ? But does it mean the previous one gives

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread Nicolas George
Jeffrey Walton (HE12025-02-20): >and members of sudo can run any command. Is it because of this last line: > rootALL=(ALL:ALL) ALL > > sudoALL=(ALL:ALL) ALL ? But does it mean the previous one gives sudo privileges to all members of the root group? Or is it that the last

Re: Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread Alexander V. Makartsev
On 21.02.2025 03:29, Jeffrey Walton wrote: ... sudoALL=(ALL:ALL) ALL I've rebooted the machine twice. I know the failure is not due to stale login information. Does anyone know why I cannot use sudo in this case? Jeff Your line misses % for some reason. sudo in your case is the nam

Debian 12.9 and use of sudo for regular accounts

2025-02-20 Thread Jeffrey Walton
Hi Everyone, I have a fresh Debian 12.9 install. My user account is part of sudo group, and members of sudo can run any command. However, I get an error when trying to use sudo: $ sudo ls [sudo] password for jwalton: jwalton is not in the sudoers file. $ groups jwalton cdrom