3

I've recently started to use my GitHub account as a way to synchronize my various config files across computers, including my /etc/sudoers. Are there any security vulnerabilities that this exposes?

Edit: If it makes a difference, I'm on 14.10.

0

2 Answers 2

3

My initial reaction was to say it's a bad idea. However, having looked at your specific personal sudoers file, I'd say, no; it looks pretty standard for an Ubuntu system. You're not exposing any of

  • specific software versions (that may have vulnerabilities)
  • non-standard usernames (though if I was a bad guy, I'd be trying 'josh' or 'joshua'

I quickly looked at the other config files in your GitHub repo and they seem fine -- for the moment! For the future, you'd have to very careful when changing your config files, always remaining conscious that such changes will be public.

In general, I'd prefer to use a private repo to save having to think about the possible ramifications of each and every change being committed. I have my own remote repos set up on my personal Ubuntu server for this reason but AIUI, Bitbucket provide free private repos.

Managing /etc

I don't actually store /etc files in my repos. For re-running changes to configuration files, I make those changes using sed commands, e.g., to automatically change the amount of information being reported by logwatch, I run:

sudo sed -i.bak "s/^Detail.*$/Detail = High/" /usr/share/logwatch/default.conf/logwatch.conf

To add an email alias for webmaster if one doesn't already exist, I run:

grep -i webmaster /etc/aliases || sudo sed -i.bak '1 a\webmaster:\troot' /etc/aliases

I also use a package called etckeeper to keep track of all changes to the /etc directory tree using git. However, so far I've only ever used it as a historical record for the system in question and as a means to roll back any changes to /etc which don't work out. It has an option to push its commit to a remote repo but haven't (yet) used it.

Other more complicated solutions (which I haven't yet got around to learning) are configuration management tools such as Chef or Puppet which can be used for quickly recreating system configurations.

5
  • While I've zero interest or experience in cracking, it was trivially easy to find Josha's GitHub profile since he advertises it in his profile. If I could do it in a few seconds, so could anyone. I'm happy to edit my answer to remove the direct link. Apr 20, 2015 at 15:43
  • 1
    Also, the only lines which differ from the default (for 12.04) are %sudo ALL=NOPASSWD: ALL and the mail_badpass line which are both fairly standard. Apr 20, 2015 at 15:46
  • 1
    @AnthonyGeoghegan in what universe is a NOPASSWD: ALL line fairly standard? Now, let's hope the OP hasn't also left his private key lying around in the open.
    – muru
    Apr 20, 2015 at 16:20
  • @AnthonyGeoghegan: If I was't fine with a link to my GitHub being posted, I wouldn't have added it to my profile. But I'll get a private repo if I ever add something unusual. Apr 20, 2015 at 17:11
  • @muru I'll qualify that statement by replacing "standard" with "common". I'd further qualify the statement by prefacing it with "In my experience". I've co-administrated a number of machines where all users are trusted and are members of the admin group and we used sudo more for logging admin commands. Apr 20, 2015 at 18:09
0

I would advise you not to publish anything in a public repository, which is located in the /etc directory. This information will make you vulnerable in the worst case. The risk that you overlook a file containing sensitive data is too large.

Maybe it's enough if you only commit the data, but do not push. Then the changes are saved locally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.