Disable sudo user to edit sudoers file
I want to disable a user to edit sudoers file, so I added a line in sudoers file:
Cmnd_Alias BLOCK = !/usr/sbin/visudo, !/bin/nano /etc/sudoersit blocks if a user tries to edit like this:
sudo nano /etc/sudoersbut when he's enter to etc:
cd /etc
sudo nano sudoers... he can use nano, and edit sudoers.
how can i solve this? thanks
22 Answers
From my standpoint... if you don't want a user to be changing things as sudo, you should NOT be granting sudo access in the first place. This is for the same reason you don't give your bank account information to Nigerian prince scammers - if they have your information (or access) they will have access beyond what you probably want to grant the individual.
Giving sudo access in a way that lets them use any command except some commands ("blacklisting" commands) is MUCH harder to implement, and in fact the sudo and sudoers mechanisms are not really built to do this kind of blacklisting in a safe way.
Conversely, giving this hypothetical user sudo access for only some commands (and not all commands), by specifically specifying the things they can execute as sudo on the sudoers line, is the proper way to really do this type of restrictions with sudo ("whitelisting" commands instead of blacklisting them)
This said, if you REALLY want to go this route, then...
In the second method, he's not using the full path. The command blocks you've initiated here deny access when the command and arguments are identical matches. The utilities are unfortunately stupid and don't actually equate arguments passed in as fully qualified on-disk paths and need to be exact matches to what's being executed.
Add to the list such that you get this:
Cmnd_Alias BLOCK = !/usr/sbin/visudo, !/bin/nano /etc/sudoers, !/bin/nano sudoers... however there are a trillion ways to circumvent this, so you really should be whitelisting access to commands rather than blacklisting commands that sudoers are not supposed to use.
I usually use the following:
username ALL=ALL, !/usr/bin/su *,!/usr/bin/sudo *, !/usr/sbin/visudo, !/usr/bin/* *sudoersNot sure if I missed out anything. Definitely not fool proof, but the best that I can come out with so far :)
