I'd like to disable getting root at all for users who ssh in - including "sudo su" cause that's pretty much the same thing... Can this be done? Assume that I'M not ssh'ing in, and have physical access to the machine, but want to prevent other users from gaining root without physical access.
2 Answers
I can't think to a generic way of having the same user able to do sudo
in a graphical terminal (which is a virtual tty) and not on a ssh
connection --- that in the end is just another kind of virtual tty.
What I can think as an approximate solution is:
have trusted users that can do
sudo
(1), call themalpha
andbeta
have users that can't do
sudo
(1), call themaleph
ybet
Now, forbid ssh login to alpha
y beta
using the DenyUsers
directive in /etc/ssh/sshd.conf
:
DenyUsers alpha beta
If you want that the user alpha
y aleph
can share files, you can make them the same group or members of an additional group and adjust the file permissions accordingly.
Footnotes:
(1) Just a reminder: a user can do sudo
if it's a member of the group sudo
or adm
(depending on Ubuntu version). To remove the ability for an user to do sudo:
gpasswd -d user sudo
gpasswd -d user adm
and to enable it:
gpasswd -a user sudo
gpasswd -a user adm
(one or the other --- check with groups
which is the correct group in your system).
-
Thank you, the DenyUsers thing seems like it will work well enough. Nov 20, 2014 at 17:17
If you don't require a fool-proof solution, you can make a wrapper for sudo that checks to see if you're logged in over SSH before running the real sudo. Just create a /usr/local/bin/sudo
script, mark it executable (sudo chmod +x /usr/local/bin/sudo
), and add these contents:
#!/bin/sh
if [ "$SSH_CLIENT" != "" ]; then
echo "remote sudo access is disabled" 1>&2
exit 1
fi
/usr/bin/sudo "$@"
Flaws:
- while it works for
sudo
, it can be bypassed by calling/usr/bin/sudo
directly - it relies on the contents of the
SSH_CLIENT
environment variable, so a user can bypass the restriction by clearing this environment variable
It's possible there's ways to address these issues, but if you just need something to stop your "typical" user then this should work.
sudo
access is a good start. Restricting to SSH Key Auth only is another good step.