So, I recently secured my root log-in and all sudo requests with 2-factor authentication. However, I noticed that if a user with sudo access that does NOT have 2FA enabled could easily sudo su and gain complete root access. Basically, I want to make sure that this can't happen, and it will still ask for the root password if you try to su root or sudo su.
1 Answer
Add
Defaults rootpw
to your sudoers file. This will have "sudo" ask for a "root" password and not the "current user" password. You can use a "group" to restrict this to that group.
Manual. The Arch wiki is very solid.
Always use visudo to edit your sudoers file (it will validate changes).
-
This is probably not what OP wants, as it will ask for the root password every time, not just when running
su.– fkraiemFeb 15, 2016 at 8:42 -
Actually, that's perfect :D. My intention was to further secure this. If anyone managed to get themselves into the sudo group, this will help stop them.– user323419Feb 15, 2016 at 14:47
-
1It does. Using a good password and changing the password every so often helps too.– RinzwindFeb 15, 2016 at 14:53
-
This even makes
sudorequests call for the 2FA verification code for root. Even if they were clever enough to figure out the root password now, they're stopped for sure.– user323419Feb 15, 2016 at 15:02
sudoto the command will execute 'su' as super user, if no other user is specified to the sudo command - super user has god powers and can do anything in the system - I don't think you can achieve this.sudois not "complete root access". Unless you restricted which commands can be run withsudo, it definitely is.