3

I want to make it impossible for any root commands to be issued during a Live Boot session. I don't want anyone being able to sign in as root. Period!

So, is it possible to stop the sudo service? If so, would this accomplish what I'm trying to do?

I tried the three possible stop service commands below but chkconfig --list show sudo still working:

(1)

sudo stop sudo

(2)

sudo /etc/init.d/sudo stop

(3)

sudo service sudo stop
Improve this question
5
  • 2
    Really? Why would you think sudo is a service? Just curious what lead you there. (Because sudo is a command.) No user can sudo successfully unless the same is in the admin group.
    – user8290
    Jan 30, 2012 at 1:36
  • 3
    This question makes me smile :)...
    – RolandiXor
    Jan 30, 2012 at 2:05
  • 1
    ... actually, a totally valid and interesting question :) A really good answer to this explains exactly what sudo does, how to disable it and how to close it down even more (e.g. try typing "sudo su" within a guest session - that behaviour should be exactly what the user wants)
    – Stefano Palazzo
    Jan 30, 2012 at 3:49
  • chkconfig --list, it shows all services, lists the run levels, sudo is one of them.
    – bambuntu
    Jan 31, 2012 at 6:21
  • @Ignatio Thanks! I know it's not important to you now, but thought it worth a mention that the chkconfig command is not an Ubuntu-native tool. Apparently, it is just dumbly picking up scripts in /etc/init.d directory. If you cat /etc/init.d/sudo you can see that only the "start" switch does anything at all.
    – user8290
    Jan 31, 2012 at 23:34

2 Answers 2

Reset to default
4

You have to restrict Physical access. If someone has physical access to your computer (hard drive) they have root access, regardless of OS.

This is why they keep servers in locked rooms =)

Second best is an encrypted installation. That will make it difficult or impossible for someone with physical access to access your data, assuming the computer is shut off and they do not install a modified kernel.

To further refine my answer, now that you have asked about setting up a kiosk ..

First, you need root access via some mechanism, sudo or su, take you pick, to perform system administration. Since completely disabling sudo , su, or all root access is unrealistic. With what you have posted, I would look at locking down your kiosk with apparmor (take a look at the apparmor profile for the gurest account as a template).

If you do not know how to use apparmor, use a distro that is built as a kiosk. Why re-creating the wheel?

Options here

1) Use Ubuntu with the guest account. The guest account is confined by apparmor:

http://dangertux.wordpress.com/2011/11/22/341/

2) There are other options

Fedora makes a kiosk spin, locked down with selinux

http://spins.fedoraproject.org/kiosk/#home

3) Other distors

http://webconverger.org/

Improve this answer
2
  • My patrons need physical access. Ok, let me make things clearer. The terminal is a kiosk with a live remastered Ubuntu disk running. I do not want a password to open any root access period. What I am imagining here is it will be remastered Ubunutu distro running live that's in infinite non-root user loop. I want it to purposely run this way. Is there any way to pipe all root attempts to null or something? I want a complete root lockout and user locked in (no logout, no shutdown, only physical power down.)
    – bambuntu
    Jan 31, 2012 at 6:32
  • See my updated answer.
    – Panther
    Jan 31, 2012 at 16:16
2

You can't get rid of sudo the way you think, but you can explicitly define what users are allowed to do, all the way from disallowing sudo through to requiring passwords for particular commands. It is very powerful.

You do this through the use of sudoers

From Ubuntu.com:

The /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands.

It does this through four kinds of aliases: User_Alias, Runas_Alias, Host_Alias and Cmnd_Alias which work as their names suggest.

which

Improve this answer
2
  • Ok, so how do I disable all commands from sudo? Could I change global permissions restricting sudo altogether from everything?
    – bambuntu
    Jan 31, 2012 at 6:34
  • 1
    This is probably the right answer but it's incomplete :(
    – roadmr
    Jan 31, 2012 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .